Analysis

  • max time kernel
    5s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2022, 06:03

General

  • Target
    stub2.exe
  • Size 20.4MB
  • Sample221231-gr2jeshc62
  • SHA256 82b53444cb1607da0d82f371e6976f765a236a1468e88f6385ee24f2e6f5d1bb
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 32 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\stub2.exe
    "C:\Users\Admin\AppData\Local\Temp\stub2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:372
    • C:\Users\Admin\AppData\Local\Temp\stub2.exe
      "C:\Users\Admin\AppData\Local\Temp\stub2.exe"
      2⤵
      • Loads dropped DLL
      PID:3972
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:4148
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command "Get-NetAdapter | Disable-NetAdapter -Confirm:$True""
          3⤵
            PID:2352
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command "Get-NetAdapter | Disable-NetAdapter -Confirm:$True"
              4⤵
                PID:1504
        • C:\Users\Admin\AppData\Local\Temp\stub2.exe
          "C:\Users\Admin\AppData\Local\Temp\stub2.exe"
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:372
          • C:\Users\Admin\AppData\Local\Temp\stub2.exe
            "C:\Users\Admin\AppData\Local\Temp\stub2.exe"
            2⤵
            • Loads dropped DLL
            PID:3972
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "ver"
              3⤵
                PID:4148
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell -Command "Get-NetAdapter | Disable-NetAdapter -Confirm:$True""
                3⤵
                  PID:2352
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -Command "Get-NetAdapter | Disable-NetAdapter -Confirm:$True"
                    4⤵
                      PID:1504

              Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    _raw_ecb.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\Crypto\Cipher\_raw_ecb.pyd
                    • Size 13KB
                    • SHA256 974b1278a0bab19b066a4a18c6418e558a485cbdbd8de08a5c7f8bcee1f01620
                    • MD5 SHA1 SHA512 SSDEEP

                    _raw_ecb.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\Crypto\Cipher\_raw_ecb.pyd
                    • Size 13KB
                    • SHA256 974b1278a0bab19b066a4a18c6418e558a485cbdbd8de08a5c7f8bcee1f01620
                    • MD5 SHA1 SHA512 SSDEEP

                    _raw_ecb.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\Crypto\Cipher\_raw_ecb.pyd
                    • Size 13KB
                    • SHA256 974b1278a0bab19b066a4a18c6418e558a485cbdbd8de08a5c7f8bcee1f01620
                    • MD5 SHA1 SHA512 SSDEEP

                    _raw_ecb.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\Crypto\Cipher\_raw_ecb.pyd
                    • Size 13KB
                    • SHA256 974b1278a0bab19b066a4a18c6418e558a485cbdbd8de08a5c7f8bcee1f01620
                    • MD5 SHA1 SHA512 SSDEEP

                    _imaging.cp310-win_amd64.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\PIL\_imaging.cp310-win_amd64.pyd
                    • Size 727KB
                    • SHA256 8f61c716cb7c0b8eb2d4e94e618c3f5025829ca07ff6556dbd672a9a1e46a1f5
                    • MD5 SHA1 SHA512 SSDEEP

                    _imaging.cp310-win_amd64.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\PIL\_imaging.cp310-win_amd64.pyd
                    • Size 727KB
                    • SHA256 8f61c716cb7c0b8eb2d4e94e618c3f5025829ca07ff6556dbd672a9a1e46a1f5
                    • MD5 SHA1 SHA512 SSDEEP

                    _imaging.cp310-win_amd64.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\PIL\_imaging.cp310-win_amd64.pyd
                    • Size 727KB
                    • SHA256 8f61c716cb7c0b8eb2d4e94e618c3f5025829ca07ff6556dbd672a9a1e46a1f5
                    • MD5 SHA1 SHA512 SSDEEP

                    _imaging.cp310-win_amd64.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\PIL\_imaging.cp310-win_amd64.pyd
                    • Size 727KB
                    • SHA256 8f61c716cb7c0b8eb2d4e94e618c3f5025829ca07ff6556dbd672a9a1e46a1f5
                    • MD5 SHA1 SHA512 SSDEEP

                    VCRUNTIME140.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\VCRUNTIME140.dll
                    • Size 96KB
                    • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
                    • MD5 SHA1 SHA512 SSDEEP

                    VCRUNTIME140.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\VCRUNTIME140.dll
                    • Size 96KB
                    • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
                    • MD5 SHA1 SHA512 SSDEEP

                    VCRUNTIME140.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\VCRUNTIME140.dll
                    • Size 96KB
                    • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
                    • MD5 SHA1 SHA512 SSDEEP

                    VCRUNTIME140.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\VCRUNTIME140.dll
                    • Size 96KB
                    • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
                    • MD5 SHA1 SHA512 SSDEEP

                    _asyncio.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_asyncio.pyd
                    • Size 34KB
                    • SHA256 7d534cf96c53f5e19819042a2f9de2abe6bf9081ca6fe00d910dcc0ffc429f27
                    • MD5 SHA1 SHA512 SSDEEP

                    _asyncio.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_asyncio.pyd
                    • Size 34KB
                    • SHA256 7d534cf96c53f5e19819042a2f9de2abe6bf9081ca6fe00d910dcc0ffc429f27
                    • MD5 SHA1 SHA512 SSDEEP

                    _asyncio.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_asyncio.pyd
                    • Size 34KB
                    • SHA256 7d534cf96c53f5e19819042a2f9de2abe6bf9081ca6fe00d910dcc0ffc429f27
                    • MD5 SHA1 SHA512 SSDEEP

                    _asyncio.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_asyncio.pyd
                    • Size 34KB
                    • SHA256 7d534cf96c53f5e19819042a2f9de2abe6bf9081ca6fe00d910dcc0ffc429f27
                    • MD5 SHA1 SHA512 SSDEEP

                    _bz2.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_bz2.pyd
                    • Size 47KB
                    • SHA256 23b5b56995cd8f6fa3c8391ead57607e4b50cf9fac03bc7207f6243bba48f0f0
                    • MD5 SHA1 SHA512 SSDEEP

                    _bz2.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_bz2.pyd
                    • Size 47KB
                    • SHA256 23b5b56995cd8f6fa3c8391ead57607e4b50cf9fac03bc7207f6243bba48f0f0
                    • MD5 SHA1 SHA512 SSDEEP

                    _bz2.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_bz2.pyd
                    • Size 47KB
                    • SHA256 23b5b56995cd8f6fa3c8391ead57607e4b50cf9fac03bc7207f6243bba48f0f0
                    • MD5 SHA1 SHA512 SSDEEP

                    _bz2.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_bz2.pyd
                    • Size 47KB
                    • SHA256 23b5b56995cd8f6fa3c8391ead57607e4b50cf9fac03bc7207f6243bba48f0f0
                    • MD5 SHA1 SHA512 SSDEEP

                    _cffi_backend.cp310-win_amd64.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_cffi_backend.cp310-win_amd64.pyd
                    • Size 71KB
                    • SHA256 fdddacb17346ba86b16e2256afac9bce66799be4f5bc47eb3c6cbdda24bd0d91
                    • MD5 SHA1 SHA512 SSDEEP

                    _cffi_backend.cp310-win_amd64.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_cffi_backend.cp310-win_amd64.pyd
                    • Size 71KB
                    • SHA256 fdddacb17346ba86b16e2256afac9bce66799be4f5bc47eb3c6cbdda24bd0d91
                    • MD5 SHA1 SHA512 SSDEEP

                    _cffi_backend.cp310-win_amd64.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_cffi_backend.cp310-win_amd64.pyd
                    • Size 71KB
                    • SHA256 fdddacb17346ba86b16e2256afac9bce66799be4f5bc47eb3c6cbdda24bd0d91
                    • MD5 SHA1 SHA512 SSDEEP

                    _cffi_backend.cp310-win_amd64.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_cffi_backend.cp310-win_amd64.pyd
                    • Size 71KB
                    • SHA256 fdddacb17346ba86b16e2256afac9bce66799be4f5bc47eb3c6cbdda24bd0d91
                    • MD5 SHA1 SHA512 SSDEEP

                    _ctypes.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_ctypes.pyd
                    • Size 56KB
                    • SHA256 a17db998cdb092da6b8773bee65a38fad5803b4f538fd67d8cec83c821e3d4d0
                    • MD5 SHA1 SHA512 SSDEEP

                    _ctypes.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_ctypes.pyd
                    • Size 56KB
                    • SHA256 a17db998cdb092da6b8773bee65a38fad5803b4f538fd67d8cec83c821e3d4d0
                    • MD5 SHA1 SHA512 SSDEEP

                    _ctypes.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_ctypes.pyd
                    • Size 56KB
                    • SHA256 a17db998cdb092da6b8773bee65a38fad5803b4f538fd67d8cec83c821e3d4d0
                    • MD5 SHA1 SHA512 SSDEEP

                    _ctypes.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_ctypes.pyd
                    • Size 56KB
                    • SHA256 a17db998cdb092da6b8773bee65a38fad5803b4f538fd67d8cec83c821e3d4d0
                    • MD5 SHA1 SHA512 SSDEEP

                    _hashlib.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_hashlib.pyd
                    • Size 33KB
                    • SHA256 660fc521ff09ca8d951717aabc9b9c0708c6d593f7c4a85bea0a120f72746ec4
                    • MD5 SHA1 SHA512 SSDEEP

                    _hashlib.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_hashlib.pyd
                    • Size 33KB
                    • SHA256 660fc521ff09ca8d951717aabc9b9c0708c6d593f7c4a85bea0a120f72746ec4
                    • MD5 SHA1 SHA512 SSDEEP

                    _hashlib.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_hashlib.pyd
                    • Size 33KB
                    • SHA256 660fc521ff09ca8d951717aabc9b9c0708c6d593f7c4a85bea0a120f72746ec4
                    • MD5 SHA1 SHA512 SSDEEP

                    _hashlib.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_hashlib.pyd
                    • Size 33KB
                    • SHA256 660fc521ff09ca8d951717aabc9b9c0708c6d593f7c4a85bea0a120f72746ec4
                    • MD5 SHA1 SHA512 SSDEEP

                    _lzma.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_lzma.pyd
                    • Size 84KB
                    • SHA256 b1493265332259181d70d8c9bbf5cf321d2b97efdf67ac6ab87ae291d5460b6c
                    • MD5 SHA1 SHA512 SSDEEP

                    _lzma.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_lzma.pyd
                    • Size 84KB
                    • SHA256 b1493265332259181d70d8c9bbf5cf321d2b97efdf67ac6ab87ae291d5460b6c
                    • MD5 SHA1 SHA512 SSDEEP

                    _lzma.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_lzma.pyd
                    • Size 84KB
                    • SHA256 b1493265332259181d70d8c9bbf5cf321d2b97efdf67ac6ab87ae291d5460b6c
                    • MD5 SHA1 SHA512 SSDEEP

                    _lzma.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_lzma.pyd
                    • Size 84KB
                    • SHA256 b1493265332259181d70d8c9bbf5cf321d2b97efdf67ac6ab87ae291d5460b6c
                    • MD5 SHA1 SHA512 SSDEEP

                    _overlapped.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_overlapped.pyd
                    • Size 30KB
                    • SHA256 c0c3ff494fa001637d155a6ba4f3fc9efbfcb26e84b179ce0dedeed5c15f4f80
                    • MD5 SHA1 SHA512 SSDEEP

                    _overlapped.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_overlapped.pyd
                    • Size 30KB
                    • SHA256 c0c3ff494fa001637d155a6ba4f3fc9efbfcb26e84b179ce0dedeed5c15f4f80
                    • MD5 SHA1 SHA512 SSDEEP

                    _overlapped.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_overlapped.pyd
                    • Size 30KB
                    • SHA256 c0c3ff494fa001637d155a6ba4f3fc9efbfcb26e84b179ce0dedeed5c15f4f80
                    • MD5 SHA1 SHA512 SSDEEP

                    _overlapped.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_overlapped.pyd
                    • Size 30KB
                    • SHA256 c0c3ff494fa001637d155a6ba4f3fc9efbfcb26e84b179ce0dedeed5c15f4f80
                    • MD5 SHA1 SHA512 SSDEEP

                    _queue.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_queue.pyd
                    • Size 24KB
                    • SHA256 daf177f1017153c75095607ac8b6143e06c302174fec49d4b1ad761c68e9aa6a
                    • MD5 SHA1 SHA512 SSDEEP

                    _queue.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_queue.pyd
                    • Size 24KB
                    • SHA256 daf177f1017153c75095607ac8b6143e06c302174fec49d4b1ad761c68e9aa6a
                    • MD5 SHA1 SHA512 SSDEEP

                    _queue.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_queue.pyd
                    • Size 24KB
                    • SHA256 daf177f1017153c75095607ac8b6143e06c302174fec49d4b1ad761c68e9aa6a
                    • MD5 SHA1 SHA512 SSDEEP

                    _queue.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_queue.pyd
                    • Size 24KB
                    • SHA256 daf177f1017153c75095607ac8b6143e06c302174fec49d4b1ad761c68e9aa6a
                    • MD5 SHA1 SHA512 SSDEEP

                    _socket.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_socket.pyd
                    • Size 41KB
                    • SHA256 d9ae1fad2ce6dce51f30c7b0bebd58fdbb95db390d27900bd3364fef4045ac76
                    • MD5 SHA1 SHA512 SSDEEP

                    _socket.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_socket.pyd
                    • Size 41KB
                    • SHA256 d9ae1fad2ce6dce51f30c7b0bebd58fdbb95db390d27900bd3364fef4045ac76
                    • MD5 SHA1 SHA512 SSDEEP

                    _socket.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_socket.pyd
                    • Size 41KB
                    • SHA256 d9ae1fad2ce6dce51f30c7b0bebd58fdbb95db390d27900bd3364fef4045ac76
                    • MD5 SHA1 SHA512 SSDEEP

                    _socket.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_socket.pyd
                    • Size 41KB
                    • SHA256 d9ae1fad2ce6dce51f30c7b0bebd58fdbb95db390d27900bd3364fef4045ac76
                    • MD5 SHA1 SHA512 SSDEEP

                    _sqlite3.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_sqlite3.pyd
                    • Size 48KB
                    • SHA256 d287f01b6f29dfdb844549326fb561c707005f687af51ea84d240ce3e8ab63fe
                    • MD5 SHA1 SHA512 SSDEEP

                    _sqlite3.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_sqlite3.pyd
                    • Size 48KB
                    • SHA256 d287f01b6f29dfdb844549326fb561c707005f687af51ea84d240ce3e8ab63fe
                    • MD5 SHA1 SHA512 SSDEEP

                    _sqlite3.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_sqlite3.pyd
                    • Size 48KB
                    • SHA256 d287f01b6f29dfdb844549326fb561c707005f687af51ea84d240ce3e8ab63fe
                    • MD5 SHA1 SHA512 SSDEEP

                    _sqlite3.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_sqlite3.pyd
                    • Size 48KB
                    • SHA256 d287f01b6f29dfdb844549326fb561c707005f687af51ea84d240ce3e8ab63fe
                    • MD5 SHA1 SHA512 SSDEEP

                    _ssl.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_ssl.pyd
                    • Size 60KB
                    • SHA256 db0a43792cfeceff032963e1535d9ff5ef12dc276fff66104afc3ce2b83d3420
                    • MD5 SHA1 SHA512 SSDEEP

                    _ssl.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_ssl.pyd
                    • Size 60KB
                    • SHA256 db0a43792cfeceff032963e1535d9ff5ef12dc276fff66104afc3ce2b83d3420
                    • MD5 SHA1 SHA512 SSDEEP

                    _ssl.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_ssl.pyd
                    • Size 60KB
                    • SHA256 db0a43792cfeceff032963e1535d9ff5ef12dc276fff66104afc3ce2b83d3420
                    • MD5 SHA1 SHA512 SSDEEP

                    _ssl.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_ssl.pyd
                    • Size 60KB
                    • SHA256 db0a43792cfeceff032963e1535d9ff5ef12dc276fff66104afc3ce2b83d3420
                    • MD5 SHA1 SHA512 SSDEEP

                    _tkinter.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_tkinter.pyd
                    • Size 37KB
                    • SHA256 38c9544a0fd60d6ac9b2df2a9a062ba140e7c88199855ab01e6fc82f184eab48
                    • MD5 SHA1 SHA512 SSDEEP

                    _tkinter.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_tkinter.pyd
                    • Size 37KB
                    • SHA256 38c9544a0fd60d6ac9b2df2a9a062ba140e7c88199855ab01e6fc82f184eab48
                    • MD5 SHA1 SHA512 SSDEEP

                    _tkinter.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_tkinter.pyd
                    • Size 37KB
                    • SHA256 38c9544a0fd60d6ac9b2df2a9a062ba140e7c88199855ab01e6fc82f184eab48
                    • MD5 SHA1 SHA512 SSDEEP

                    _tkinter.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\_tkinter.pyd
                    • Size 37KB
                    • SHA256 38c9544a0fd60d6ac9b2df2a9a062ba140e7c88199855ab01e6fc82f184eab48
                    • MD5 SHA1 SHA512 SSDEEP

                    base_library.zip

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\base_library.zip
                    • Size 1.0MB
                    • SHA256 93623ec5644c0859e9b5b68f9443cde443195422247cae891dc427c848e885ba
                    • MD5 SHA1 SHA512 SSDEEP

                    base_library.zip

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\base_library.zip
                    • Size 1.0MB
                    • SHA256 93623ec5644c0859e9b5b68f9443cde443195422247cae891dc427c848e885ba
                    • MD5 SHA1 SHA512 SSDEEP

                    libcrypto-1_1.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\libcrypto-1_1.dll
                    • Size 1.1MB
                    • SHA256 4b4b20645af4b8bdd614dcb0859d6e9fcffd7996b774c3f7beb7f7f564adfe97
                    • MD5 SHA1 SHA512 SSDEEP

                    libcrypto-1_1.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\libcrypto-1_1.dll
                    • Size 1.1MB
                    • SHA256 4b4b20645af4b8bdd614dcb0859d6e9fcffd7996b774c3f7beb7f7f564adfe97
                    • MD5 SHA1 SHA512 SSDEEP

                    libcrypto-1_1.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\libcrypto-1_1.dll
                    • Size 1.1MB
                    • SHA256 4b4b20645af4b8bdd614dcb0859d6e9fcffd7996b774c3f7beb7f7f564adfe97
                    • MD5 SHA1 SHA512 SSDEEP

                    libcrypto-1_1.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\libcrypto-1_1.dll
                    • Size 1.1MB
                    • SHA256 4b4b20645af4b8bdd614dcb0859d6e9fcffd7996b774c3f7beb7f7f564adfe97
                    • MD5 SHA1 SHA512 SSDEEP

                    libcrypto-1_1.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\libcrypto-1_1.dll
                    • Size 1.1MB
                    • SHA256 4b4b20645af4b8bdd614dcb0859d6e9fcffd7996b774c3f7beb7f7f564adfe97
                    • MD5 SHA1 SHA512 SSDEEP

                    libcrypto-1_1.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\libcrypto-1_1.dll
                    • Size 1.1MB
                    • SHA256 4b4b20645af4b8bdd614dcb0859d6e9fcffd7996b774c3f7beb7f7f564adfe97
                    • MD5 SHA1 SHA512 SSDEEP

                    libffi-7.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\libffi-7.dll
                    • Size 23KB
                    • SHA256 1a106569ac0ad3152f3816ff361aa227371d0d85425b357632776ac48d92ea8a
                    • MD5 SHA1 SHA512 SSDEEP

                    libffi-7.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\libffi-7.dll
                    • Size 23KB
                    • SHA256 1a106569ac0ad3152f3816ff361aa227371d0d85425b357632776ac48d92ea8a
                    • MD5 SHA1 SHA512 SSDEEP

                    libffi-7.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\libffi-7.dll
                    • Size 23KB
                    • SHA256 1a106569ac0ad3152f3816ff361aa227371d0d85425b357632776ac48d92ea8a
                    • MD5 SHA1 SHA512 SSDEEP

                    libffi-7.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\libffi-7.dll
                    • Size 23KB
                    • SHA256 1a106569ac0ad3152f3816ff361aa227371d0d85425b357632776ac48d92ea8a
                    • MD5 SHA1 SHA512 SSDEEP

                    libssl-1_1.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\libssl-1_1.dll
                    • Size 200KB
                    • SHA256 e2607aa4f951cfd900ff6a56c5235c0fabeb9bafaf9a0981a0b1004eaca84c7f
                    • MD5 SHA1 SHA512 SSDEEP

                    libssl-1_1.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\libssl-1_1.dll
                    • Size 200KB
                    • SHA256 e2607aa4f951cfd900ff6a56c5235c0fabeb9bafaf9a0981a0b1004eaca84c7f
                    • MD5 SHA1 SHA512 SSDEEP

                    libssl-1_1.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\libssl-1_1.dll
                    • Size 200KB
                    • SHA256 e2607aa4f951cfd900ff6a56c5235c0fabeb9bafaf9a0981a0b1004eaca84c7f
                    • MD5 SHA1 SHA512 SSDEEP

                    libssl-1_1.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\libssl-1_1.dll
                    • Size 200KB
                    • SHA256 e2607aa4f951cfd900ff6a56c5235c0fabeb9bafaf9a0981a0b1004eaca84c7f
                    • MD5 SHA1 SHA512 SSDEEP

                    pyexpat.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\pyexpat.pyd
                    • Size 86KB
                    • SHA256 d8abb2ed0979460d90893aa8be7da1892ad40cb505d12f6525d35e3fc6ee2808
                    • MD5 SHA1 SHA512 SSDEEP

                    pyexpat.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\pyexpat.pyd
                    • Size 86KB
                    • SHA256 d8abb2ed0979460d90893aa8be7da1892ad40cb505d12f6525d35e3fc6ee2808
                    • MD5 SHA1 SHA512 SSDEEP

                    pyexpat.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\pyexpat.pyd
                    • Size 86KB
                    • SHA256 d8abb2ed0979460d90893aa8be7da1892ad40cb505d12f6525d35e3fc6ee2808
                    • MD5 SHA1 SHA512 SSDEEP

                    pyexpat.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\pyexpat.pyd
                    • Size 86KB
                    • SHA256 d8abb2ed0979460d90893aa8be7da1892ad40cb505d12f6525d35e3fc6ee2808
                    • MD5 SHA1 SHA512 SSDEEP

                    python3.DLL

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\python3.DLL
                    • Size 63KB
                    • SHA256 5d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5
                    • MD5 SHA1 SHA512 SSDEEP

                    python3.DLL

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\python3.DLL
                    • Size 63KB
                    • SHA256 5d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5
                    • MD5 SHA1 SHA512 SSDEEP

                    python3.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\python3.dll
                    • Size 63KB
                    • SHA256 5d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5
                    • MD5 SHA1 SHA512 SSDEEP

                    python3.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\python3.dll
                    • Size 63KB
                    • SHA256 5d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5
                    • MD5 SHA1 SHA512 SSDEEP

                    python3.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\python3.dll
                    • Size 63KB
                    • SHA256 5d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5
                    • MD5 SHA1 SHA512 SSDEEP

                    python3.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\python3.dll
                    • Size 63KB
                    • SHA256 5d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5
                    • MD5 SHA1 SHA512 SSDEEP

                    python310.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\python310.dll
                    • Size 1.4MB
                    • SHA256 35a6266bfad221a17ceaa83d11de51f57ee4461c87749616b9038acadcd4f2e3
                    • MD5 SHA1 SHA512 SSDEEP

                    python310.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\python310.dll
                    • Size 1.4MB
                    • SHA256 35a6266bfad221a17ceaa83d11de51f57ee4461c87749616b9038acadcd4f2e3
                    • MD5 SHA1 SHA512 SSDEEP

                    python310.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\python310.dll
                    • Size 1.4MB
                    • SHA256 35a6266bfad221a17ceaa83d11de51f57ee4461c87749616b9038acadcd4f2e3
                    • MD5 SHA1 SHA512 SSDEEP

                    python310.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\python310.dll
                    • Size 1.4MB
                    • SHA256 35a6266bfad221a17ceaa83d11de51f57ee4461c87749616b9038acadcd4f2e3
                    • MD5 SHA1 SHA512 SSDEEP

                    pythoncom310.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\pywin32_system32\pythoncom310.dll
                    • Size 194KB
                    • SHA256 36ebf27c3dd1efb6c5b726008588b142ce0f29e7057bac6826218ecca961e6ad
                    • MD5 SHA1 SHA512 SSDEEP

                    pythoncom310.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\pywin32_system32\pythoncom310.dll
                    • Size 194KB
                    • SHA256 36ebf27c3dd1efb6c5b726008588b142ce0f29e7057bac6826218ecca961e6ad
                    • MD5 SHA1 SHA512 SSDEEP

                    pythoncom310.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\pywin32_system32\pythoncom310.dll
                    • Size 194KB
                    • SHA256 36ebf27c3dd1efb6c5b726008588b142ce0f29e7057bac6826218ecca961e6ad
                    • MD5 SHA1 SHA512 SSDEEP

                    pythoncom310.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\pywin32_system32\pythoncom310.dll
                    • Size 194KB
                    • SHA256 36ebf27c3dd1efb6c5b726008588b142ce0f29e7057bac6826218ecca961e6ad
                    • MD5 SHA1 SHA512 SSDEEP

                    pywintypes310.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\pywin32_system32\pywintypes310.dll
                    • Size 64KB
                    • SHA256 8f9cc8363f74fd2cc1bfa75779efe593973dba9d1b607f6eb6ccd121e3c3ea1e
                    • MD5 SHA1 SHA512 SSDEEP

                    pywintypes310.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\pywin32_system32\pywintypes310.dll
                    • Size 64KB
                    • SHA256 8f9cc8363f74fd2cc1bfa75779efe593973dba9d1b607f6eb6ccd121e3c3ea1e
                    • MD5 SHA1 SHA512 SSDEEP

                    pywintypes310.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\pywin32_system32\pywintypes310.dll
                    • Size 64KB
                    • SHA256 8f9cc8363f74fd2cc1bfa75779efe593973dba9d1b607f6eb6ccd121e3c3ea1e
                    • MD5 SHA1 SHA512 SSDEEP

                    pywintypes310.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\pywin32_system32\pywintypes310.dll
                    • Size 64KB
                    • SHA256 8f9cc8363f74fd2cc1bfa75779efe593973dba9d1b607f6eb6ccd121e3c3ea1e
                    • MD5 SHA1 SHA512 SSDEEP

                    select.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\select.pyd
                    • Size 24KB
                    • SHA256 f66c7dbb9969c3f306cec8cff8a40009c468f0cce89f59844dacdffda14b44b9
                    • MD5 SHA1 SHA512 SSDEEP

                    select.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\select.pyd
                    • Size 24KB
                    • SHA256 f66c7dbb9969c3f306cec8cff8a40009c468f0cce89f59844dacdffda14b44b9
                    • MD5 SHA1 SHA512 SSDEEP

                    select.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\select.pyd
                    • Size 24KB
                    • SHA256 f66c7dbb9969c3f306cec8cff8a40009c468f0cce89f59844dacdffda14b44b9
                    • MD5 SHA1 SHA512 SSDEEP

                    select.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\select.pyd
                    • Size 24KB
                    • SHA256 f66c7dbb9969c3f306cec8cff8a40009c468f0cce89f59844dacdffda14b44b9
                    • MD5 SHA1 SHA512 SSDEEP

                    sqlite3.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\sqlite3.dll
                    • Size 605KB
                    • SHA256 4bcc9a970f9c7d3a3f8a9076751b553584bfbaebe88f10642528ce1994a4ad3d
                    • MD5 SHA1 SHA512 SSDEEP

                    sqlite3.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\sqlite3.dll
                    • Size 605KB
                    • SHA256 4bcc9a970f9c7d3a3f8a9076751b553584bfbaebe88f10642528ce1994a4ad3d
                    • MD5 SHA1 SHA512 SSDEEP

                    sqlite3.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\sqlite3.dll
                    • Size 605KB
                    • SHA256 4bcc9a970f9c7d3a3f8a9076751b553584bfbaebe88f10642528ce1994a4ad3d
                    • MD5 SHA1 SHA512 SSDEEP

                    sqlite3.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\sqlite3.dll
                    • Size 605KB
                    • SHA256 4bcc9a970f9c7d3a3f8a9076751b553584bfbaebe88f10642528ce1994a4ad3d
                    • MD5 SHA1 SHA512 SSDEEP

                    tcl86t.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\tcl86t.dll
                    • Size 672KB
                    • SHA256 f4cd957c2d47ee5fe43e78a77b4998e964501c6c92bdf8f7f77aa0b51798b13f
                    • MD5 SHA1 SHA512 SSDEEP

                    tcl86t.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\tcl86t.dll
                    • Size 672KB
                    • SHA256 f4cd957c2d47ee5fe43e78a77b4998e964501c6c92bdf8f7f77aa0b51798b13f
                    • MD5 SHA1 SHA512 SSDEEP

                    tcl86t.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\tcl86t.dll
                    • Size 672KB
                    • SHA256 f4cd957c2d47ee5fe43e78a77b4998e964501c6c92bdf8f7f77aa0b51798b13f
                    • MD5 SHA1 SHA512 SSDEEP

                    tcl86t.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\tcl86t.dll
                    • Size 672KB
                    • SHA256 f4cd957c2d47ee5fe43e78a77b4998e964501c6c92bdf8f7f77aa0b51798b13f
                    • MD5 SHA1 SHA512 SSDEEP

                    cp1252.enc

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\tcl\encoding\cp1252.enc
                    • Size 1KB
                    • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
                    • MD5 SHA1 SHA512

                    cp1252.enc

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\tcl\encoding\cp1252.enc
                    • Size 1KB
                    • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
                    • MD5 SHA1 SHA512

                    tk86t.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\tk86t.dll
                    • Size 620KB
                    • SHA256 62ca7aaf50f93de949f2d0c24e88f2f965bf65849adb2adf0f1998def599862a
                    • MD5 SHA1 SHA512 SSDEEP

                    tk86t.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\tk86t.dll
                    • Size 620KB
                    • SHA256 62ca7aaf50f93de949f2d0c24e88f2f965bf65849adb2adf0f1998def599862a
                    • MD5 SHA1 SHA512 SSDEEP

                    tk86t.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\tk86t.dll
                    • Size 620KB
                    • SHA256 62ca7aaf50f93de949f2d0c24e88f2f965bf65849adb2adf0f1998def599862a
                    • MD5 SHA1 SHA512 SSDEEP

                    tk86t.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\tk86t.dll
                    • Size 620KB
                    • SHA256 62ca7aaf50f93de949f2d0c24e88f2f965bf65849adb2adf0f1998def599862a
                    • MD5 SHA1 SHA512 SSDEEP

                    ucrtbase.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\ucrtbase.dll
                    • Size 971KB
                    • SHA256 d4277c54edfeb960b4163f6bec2415297047ed44963cb04c2c91a9e2604f58f6
                    • MD5 SHA1 SHA512 SSDEEP

                    ucrtbase.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\ucrtbase.dll
                    • Size 971KB
                    • SHA256 d4277c54edfeb960b4163f6bec2415297047ed44963cb04c2c91a9e2604f58f6
                    • MD5 SHA1 SHA512 SSDEEP

                    ucrtbase.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\ucrtbase.dll
                    • Size 971KB
                    • SHA256 d4277c54edfeb960b4163f6bec2415297047ed44963cb04c2c91a9e2604f58f6
                    • MD5 SHA1 SHA512 SSDEEP

                    ucrtbase.dll

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\ucrtbase.dll
                    • Size 971KB
                    • SHA256 d4277c54edfeb960b4163f6bec2415297047ed44963cb04c2c91a9e2604f58f6
                    • MD5 SHA1 SHA512 SSDEEP

                    unicodedata.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\unicodedata.pyd
                    • Size 288KB
                    • SHA256 62e4bd5cb298d2db1e6dbb12733f2342d28a2439eb3ee19e5f8e4cdeb255169a
                    • MD5 SHA1 SHA512 SSDEEP

                    unicodedata.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\unicodedata.pyd
                    • Size 288KB
                    • SHA256 62e4bd5cb298d2db1e6dbb12733f2342d28a2439eb3ee19e5f8e4cdeb255169a
                    • MD5 SHA1 SHA512 SSDEEP

                    unicodedata.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\unicodedata.pyd
                    • Size 288KB
                    • SHA256 62e4bd5cb298d2db1e6dbb12733f2342d28a2439eb3ee19e5f8e4cdeb255169a
                    • MD5 SHA1 SHA512 SSDEEP

                    unicodedata.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\unicodedata.pyd
                    • Size 288KB
                    • SHA256 62e4bd5cb298d2db1e6dbb12733f2342d28a2439eb3ee19e5f8e4cdeb255169a
                    • MD5 SHA1 SHA512 SSDEEP

                    win32api.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\win32api.pyd
                    • Size 48KB
                    • SHA256 42cc902c9f98561ebdacfa20a8cdc82146a66bf98944fdb830e0ac57c049f665
                    • MD5 SHA1 SHA512 SSDEEP

                    win32api.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\win32api.pyd
                    • Size 48KB
                    • SHA256 42cc902c9f98561ebdacfa20a8cdc82146a66bf98944fdb830e0ac57c049f665
                    • MD5 SHA1 SHA512 SSDEEP

                    win32api.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\win32api.pyd
                    • Size 48KB
                    • SHA256 42cc902c9f98561ebdacfa20a8cdc82146a66bf98944fdb830e0ac57c049f665
                    • MD5 SHA1 SHA512 SSDEEP

                    win32api.pyd

                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI3722\win32api.pyd
                    • Size 48KB
                    • SHA256 42cc902c9f98561ebdacfa20a8cdc82146a66bf98944fdb830e0ac57c049f665
                    • MD5 SHA1 SHA512 SSDEEP

                    memory/1504-239-0x0000025A2CE70000-0x0000025A2CE92000-memory.dmp

                    memory/1504-248-0x00007FF83B010000-0x00007FF83BAD1000-memory.dmp

                    memory/1504-239-0x0000025A2CE70000-0x0000025A2CE92000-memory.dmp

                    memory/1504-248-0x00007FF83B010000-0x00007FF83BAD1000-memory.dmp

                    memory/3972-234-0x00007FF83BD70000-0x00007FF83BD80000-memory.dmp

                    memory/3972-190-0x00007FF83D4F0000-0x00007FF83D51C000-memory.dmp

                    memory/3972-230-0x00007FF83BDC0000-0x00007FF83BDCF000-memory.dmp

                    memory/3972-231-0x00007FF83BDB0000-0x00007FF83BDC0000-memory.dmp

                    memory/3972-232-0x00007FF83BDA0000-0x00007FF83BDB0000-memory.dmp

                    memory/3972-228-0x00007FF83BDF0000-0x00007FF83BDFE000-memory.dmp

                    memory/3972-233-0x00007FF83BD80000-0x00007FF83BD92000-memory.dmp

                    memory/3972-146-0x00007FF83CB70000-0x00007FF83CFDE000-memory.dmp

                    memory/3972-227-0x00007FF83D200000-0x00007FF83D20F000-memory.dmp

                    memory/3972-235-0x00007FF83BD60000-0x00007FF83BD6F000-memory.dmp

                    memory/3972-236-0x00007FF83BD50000-0x00007FF83BD5E000-memory.dmp

                    memory/3972-225-0x00007FF83D220000-0x00007FF83D22F000-memory.dmp

                    memory/3972-240-0x00007FF83BD40000-0x00007FF83BD4F000-memory.dmp

                    memory/3972-209-0x00007FF83DAD0000-0x00007FF83DAE6000-memory.dmp

                    memory/3972-218-0x00007FF83BF70000-0x00007FF83C088000-memory.dmp

                    memory/3972-216-0x00007FF83D290000-0x00007FF83D2A4000-memory.dmp

                    memory/3972-215-0x00007FF83C090000-0x00007FF83C2DE000-memory.dmp

                    memory/3972-214-0x00007FF83C2E0000-0x00007FF83C477000-memory.dmp

                    memory/3972-211-0x00007FF83C480000-0x00007FF83C656000-memory.dmp

                    memory/3972-207-0x00007FF83E870000-0x00007FF83E880000-memory.dmp

                    memory/3972-206-0x00007FF83DDC0000-0x00007FF83DDD5000-memory.dmp

                    memory/3972-226-0x00007FF83D210000-0x00007FF83D21E000-memory.dmp

                    memory/3972-224-0x00007FF83D230000-0x00007FF83D268000-memory.dmp

                    memory/3972-174-0x00007FF83DB60000-0x00007FF83DB84000-memory.dmp

                    memory/3972-175-0x00007FF84CA60000-0x00007FF84CA6F000-memory.dmp

                    memory/3972-176-0x00007FF843E00000-0x00007FF843E19000-memory.dmp

                    memory/3972-177-0x00007FF83DB30000-0x00007FF83DB5D000-memory.dmp

                    memory/3972-180-0x00007FF83E8C0000-0x00007FF83E8D9000-memory.dmp

                    memory/3972-183-0x00007FF8443B0000-0x00007FF8443BD000-memory.dmp

                    memory/3972-189-0x00007FF83ED50000-0x00007FF83ED5D000-memory.dmp

                    memory/3972-190-0x00007FF83D4F0000-0x00007FF83D51C000-memory.dmp

                    memory/3972-195-0x00007FF83D4C0000-0x00007FF83D4EE000-memory.dmp

                    memory/3972-196-0x00007FF83C9E0000-0x00007FF83CA97000-memory.dmp

                    memory/3972-187-0x00007FF83DAF0000-0x00007FF83DB24000-memory.dmp

                    memory/3972-191-0x00007FF83D2B0000-0x00007FF83D2E1000-memory.dmp

                    memory/3972-200-0x00007FF83C660000-0x00007FF83C9D7000-memory.dmp

                    memory/3972-198-0x0000023B4F7F0000-0x0000023B4FB67000-memory.dmp

                    memory/3972-193-0x00007FF83CAA0000-0x00007FF83CB61000-memory.dmp

                    memory/3972-193-0x00007FF83CAA0000-0x00007FF83CB61000-memory.dmp

                    memory/3972-223-0x00007FF83BE00000-0x00007FF83BF69000-memory.dmp

                    memory/3972-198-0x0000023B4F7F0000-0x0000023B4FB67000-memory.dmp

                    memory/3972-191-0x00007FF83D2B0000-0x00007FF83D2E1000-memory.dmp

                    memory/3972-187-0x00007FF83DAF0000-0x00007FF83DB24000-memory.dmp

                    memory/3972-189-0x00007FF83ED50000-0x00007FF83ED5D000-memory.dmp

                    memory/3972-200-0x00007FF83C660000-0x00007FF83C9D7000-memory.dmp

                    memory/3972-183-0x00007FF8443B0000-0x00007FF8443BD000-memory.dmp

                    memory/3972-196-0x00007FF83C9E0000-0x00007FF83CA97000-memory.dmp

                    memory/3972-195-0x00007FF83D4C0000-0x00007FF83D4EE000-memory.dmp

                    memory/3972-229-0x00007FF83BDD0000-0x00007FF83BDE1000-memory.dmp

                    memory/3972-180-0x00007FF83E8C0000-0x00007FF83E8D9000-memory.dmp

                    memory/3972-177-0x00007FF83DB30000-0x00007FF83DB5D000-memory.dmp

                    memory/3972-176-0x00007FF843E00000-0x00007FF843E19000-memory.dmp

                    memory/3972-222-0x00007FF83D270000-0x00007FF83D28F000-memory.dmp

                    memory/3972-241-0x00007FF83BD30000-0x00007FF83BD3E000-memory.dmp

                    memory/3972-206-0x00007FF83DDC0000-0x00007FF83DDD5000-memory.dmp

                    memory/3972-207-0x00007FF83E870000-0x00007FF83E880000-memory.dmp

                    memory/3972-211-0x00007FF83C480000-0x00007FF83C656000-memory.dmp

                    memory/3972-175-0x00007FF84CA60000-0x00007FF84CA6F000-memory.dmp

                    memory/3972-214-0x00007FF83C2E0000-0x00007FF83C477000-memory.dmp

                    memory/3972-215-0x00007FF83C090000-0x00007FF83C2DE000-memory.dmp

                    memory/3972-216-0x00007FF83D290000-0x00007FF83D2A4000-memory.dmp

                    memory/3972-218-0x00007FF83BF70000-0x00007FF83C088000-memory.dmp

                    memory/3972-174-0x00007FF83DB60000-0x00007FF83DB84000-memory.dmp

                    memory/3972-240-0x00007FF83BD40000-0x00007FF83BD4F000-memory.dmp

                    memory/3972-244-0x00007FF83BCE0000-0x00007FF83BCF5000-memory.dmp

                    memory/3972-247-0x00007FF83BC20000-0x00007FF83BC38000-memory.dmp

                    memory/3972-209-0x00007FF83DAD0000-0x00007FF83DAE6000-memory.dmp

                    memory/3972-146-0x00007FF83CB70000-0x00007FF83CFDE000-memory.dmp

                    memory/3972-246-0x00007FF83BC90000-0x00007FF83BCBB000-memory.dmp

                    memory/3972-245-0x00007FF83BCC0000-0x00007FF83BCD1000-memory.dmp

                    memory/3972-225-0x00007FF83D220000-0x00007FF83D22F000-memory.dmp

                    memory/3972-236-0x00007FF83BD50000-0x00007FF83BD5E000-memory.dmp

                    memory/3972-235-0x00007FF83BD60000-0x00007FF83BD6F000-memory.dmp

                    memory/3972-234-0x00007FF83BD70000-0x00007FF83BD80000-memory.dmp

                    memory/3972-233-0x00007FF83BD80000-0x00007FF83BD92000-memory.dmp

                    memory/3972-232-0x00007FF83BDA0000-0x00007FF83BDB0000-memory.dmp

                    memory/3972-231-0x00007FF83BDB0000-0x00007FF83BDC0000-memory.dmp

                    memory/3972-230-0x00007FF83BDC0000-0x00007FF83BDCF000-memory.dmp

                    memory/3972-243-0x00007FF83BD00000-0x00007FF83BD11000-memory.dmp

                    memory/3972-229-0x00007FF83BDD0000-0x00007FF83BDE1000-memory.dmp

                    memory/3972-242-0x00007FF83BD20000-0x00007FF83BD2E000-memory.dmp

                    memory/3972-228-0x00007FF83BDF0000-0x00007FF83BDFE000-memory.dmp

                    memory/3972-227-0x00007FF83D200000-0x00007FF83D20F000-memory.dmp

                    memory/3972-226-0x00007FF83D210000-0x00007FF83D21E000-memory.dmp

                    memory/3972-224-0x00007FF83D230000-0x00007FF83D268000-memory.dmp

                    memory/3972-223-0x00007FF83BE00000-0x00007FF83BF69000-memory.dmp

                    memory/3972-222-0x00007FF83D270000-0x00007FF83D28F000-memory.dmp

                    memory/3972-241-0x00007FF83BD30000-0x00007FF83BD3E000-memory.dmp

                    memory/3972-244-0x00007FF83BCE0000-0x00007FF83BCF5000-memory.dmp

                    memory/3972-247-0x00007FF83BC20000-0x00007FF83BC38000-memory.dmp

                    memory/3972-246-0x00007FF83BC90000-0x00007FF83BCBB000-memory.dmp

                    memory/3972-245-0x00007FF83BCC0000-0x00007FF83BCD1000-memory.dmp

                    memory/3972-243-0x00007FF83BD00000-0x00007FF83BD11000-memory.dmp

                    memory/3972-242-0x00007FF83BD20000-0x00007FF83BD2E000-memory.dmp