9bf12fbe84e506a0140eb076aa974d514bc9af7a798ffb7f66e3ac3b963b7f3c

Analysis

max time kernel
134s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

qu1cksc0pe_carved-0.exe
Size

8.3MB
MD5

6247f01f917b6aff71cc41b672d4ead2
SHA1

8c9560a43c703f22ad02a0b3a5fe02979feeaa53
SHA256

9bf12fbe84e506a0140eb076aa974d514bc9af7a798ffb7f66e3ac3b963b7f3c
SHA512

d0037a620ba66fdc15d195d2eee659a9d69e560d30b236d631818094b4572a1e2313127a9125d835498f0e4138d24b706d65e1ec77f436959728c094cc59df3c
SSDEEP

196608:zW8Dj4Tqcw+ABFnZoWXKi3HA31zJMrFhqX2A4r:qA0wPzZoWXKi3HAlzIYXer

Score

9^/10

collection credential_access discovery execution spyware stealer upx

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3092	powershell.exe
4192	powershell.exe
4192	powershell.exe
4356	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	qu1cksc0pe_carved-0.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
4216	cmd.exe
2656	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
5092	Baron.exe
3324	Baron.exe
4732	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
3324	Baron.exe
3324	Baron.exe
3324	Baron.exe
3324	Baron.exe
3324	Baron.exe
3324	Baron.exe
3324	Baron.exe
3324	Baron.exe
3324	Baron.exe
3324	Baron.exe
3324	Baron.exe
3324	Baron.exe
3324	Baron.exe
3324	Baron.exe
3324	Baron.exe
3324	Baron.exe
3324	Baron.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00070000000234b9-96.dat	upx
behavioral2/memory/3324-100-0x00007FFF41E10000-0x00007FFF423F8000-memory.dmp	upx
behavioral2/files/0x0007000000023485-102.dat	upx
behavioral2/memory/3324-104-0x00007FFF50880000-0x00007FFF508A4000-memory.dmp	upx
behavioral2/files/0x00070000000234b7-105.dat	upx
behavioral2/memory/3324-107-0x00007FFF55F20000-0x00007FFF55F2F000-memory.dmp	upx
behavioral2/files/0x0007000000023486-156.dat	upx
behavioral2/files/0x0007000000023484-155.dat	upx
behavioral2/files/0x00070000000234bf-154.dat	upx
behavioral2/files/0x00070000000234bd-153.dat	upx
behavioral2/files/0x00070000000234bc-152.dat	upx
behavioral2/files/0x00070000000234b8-149.dat	upx
behavioral2/files/0x00070000000234b6-148.dat	upx
behavioral2/memory/3324-161-0x00007FFF4D120000-0x00007FFF4D14D000-memory.dmp	upx
behavioral2/memory/3324-162-0x00007FFF4D830000-0x00007FFF4D849000-memory.dmp	upx
behavioral2/memory/3324-163-0x00007FFF43E10000-0x00007FFF43E33000-memory.dmp	upx
behavioral2/memory/3324-164-0x00007FFF41C90000-0x00007FFF41E03000-memory.dmp	upx
behavioral2/memory/3324-165-0x00007FFF49780000-0x00007FFF49799000-memory.dmp	upx
behavioral2/memory/3324-166-0x00007FFF55E20000-0x00007FFF55E2D000-memory.dmp	upx
behavioral2/memory/3324-167-0x00007FFF41E10000-0x00007FFF423F8000-memory.dmp	upx
behavioral2/memory/3324-168-0x00007FFF43670000-0x00007FFF4369E000-memory.dmp	upx
behavioral2/memory/3324-171-0x00007FFF41850000-0x00007FFF41908000-memory.dmp	upx
behavioral2/memory/3324-175-0x00007FFF4D120000-0x00007FFF4D14D000-memory.dmp	upx
behavioral2/memory/3324-174-0x00007FFF55930000-0x00007FFF5593D000-memory.dmp	upx
behavioral2/memory/3324-173-0x00007FFF43D10000-0x00007FFF43D24000-memory.dmp	upx
behavioral2/memory/3324-178-0x00007FFF4D830000-0x00007FFF4D849000-memory.dmp	upx
behavioral2/memory/3324-179-0x00007FFF41730000-0x00007FFF4184C000-memory.dmp	upx
behavioral2/memory/3324-172-0x00007FFF55F20000-0x00007FFF55F2F000-memory.dmp	upx
behavioral2/memory/3324-170-0x00007FFF50880000-0x00007FFF508A4000-memory.dmp	upx
behavioral2/memory/3324-169-0x00007FFF41910000-0x00007FFF41C85000-memory.dmp	upx
behavioral2/memory/3324-283-0x00007FFF43E10000-0x00007FFF43E33000-memory.dmp	upx
behavioral2/memory/3324-304-0x00007FFF41C90000-0x00007FFF41E03000-memory.dmp	upx
behavioral2/memory/3324-305-0x00007FFF49780000-0x00007FFF49799000-memory.dmp	upx
behavioral2/memory/3324-308-0x00007FFF43670000-0x00007FFF4369E000-memory.dmp	upx
behavioral2/memory/3324-309-0x00007FFF41910000-0x00007FFF41C85000-memory.dmp	upx
behavioral2/memory/3324-321-0x00007FFF41850000-0x00007FFF41908000-memory.dmp	upx
behavioral2/memory/3324-333-0x00007FFF50880000-0x00007FFF508A4000-memory.dmp	upx
behavioral2/memory/3324-346-0x00007FFF41730000-0x00007FFF4184C000-memory.dmp	upx
behavioral2/memory/3324-338-0x00007FFF41C90000-0x00007FFF41E03000-memory.dmp	upx
behavioral2/memory/3324-332-0x00007FFF41E10000-0x00007FFF423F8000-memory.dmp	upx
behavioral2/memory/3324-361-0x00007FFF41730000-0x00007FFF4184C000-memory.dmp	upx
behavioral2/memory/3324-362-0x00007FFF41850000-0x00007FFF41908000-memory.dmp	upx
behavioral2/memory/3324-360-0x00007FFF55930000-0x00007FFF5593D000-memory.dmp	upx
behavioral2/memory/3324-359-0x00007FFF43D10000-0x00007FFF43D24000-memory.dmp	upx
behavioral2/memory/3324-357-0x00007FFF41910000-0x00007FFF41C85000-memory.dmp	upx
behavioral2/memory/3324-356-0x00007FFF43670000-0x00007FFF4369E000-memory.dmp	upx
behavioral2/memory/3324-355-0x00007FFF55E20000-0x00007FFF55E2D000-memory.dmp	upx
behavioral2/memory/3324-354-0x00007FFF49780000-0x00007FFF49799000-memory.dmp	upx
behavioral2/memory/3324-353-0x00007FFF41C90000-0x00007FFF41E03000-memory.dmp	upx
behavioral2/memory/3324-352-0x00007FFF43E10000-0x00007FFF43E33000-memory.dmp	upx
behavioral2/memory/3324-351-0x00007FFF4D830000-0x00007FFF4D849000-memory.dmp	upx
behavioral2/memory/3324-350-0x00007FFF4D120000-0x00007FFF4D14D000-memory.dmp	upx
behavioral2/memory/3324-349-0x00007FFF55F20000-0x00007FFF55F2F000-memory.dmp	upx
behavioral2/memory/3324-348-0x00007FFF50880000-0x00007FFF508A4000-memory.dmp	upx
behavioral2/memory/3324-347-0x00007FFF41E10000-0x00007FFF423F8000-memory.dmp	upx

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	ip-api.com

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
2372	tasklist.exe
2952	tasklist.exe
516	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3688 set thread context of 4936	3688	qu1cksc0pe_carved-0.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu1cksc0pe_carved-0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu1cksc0pe_carved-0.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3124	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4388	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3688	qu1cksc0pe_carved-0.exe
3688	qu1cksc0pe_carved-0.exe
3688	qu1cksc0pe_carved-0.exe
3688	qu1cksc0pe_carved-0.exe
4192	powershell.exe
4192	powershell.exe
3092	powershell.exe
3092	powershell.exe
4356	powershell.exe
4356	powershell.exe
2656	powershell.exe
2656	powershell.exe
4192	powershell.exe
4192	powershell.exe
4356	powershell.exe
2656	powershell.exe
3092	powershell.exe
4192	powershell.exe
4192	powershell.exe
4192	powershell.exe
4348	powershell.exe
4348	powershell.exe
4348	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3688	qu1cksc0pe_carved-0.exe
Token: SeDebugPrivilege	4192	powershell.exe
Token: SeDebugPrivilege	2372	tasklist.exe
Token: SeDebugPrivilege	2952	tasklist.exe
Token: SeDebugPrivilege	3092	powershell.exe
Token: SeDebugPrivilege	516	tasklist.exe
Token: SeDebugPrivilege	4356	powershell.exe
Token: SeIncreaseQuotaPrivilege	5052	WMIC.exe
Token: SeSecurityPrivilege	5052	WMIC.exe
Token: SeTakeOwnershipPrivilege	5052	WMIC.exe
Token: SeLoadDriverPrivilege	5052	WMIC.exe
Token: SeSystemProfilePrivilege	5052	WMIC.exe
Token: SeSystemtimePrivilege	5052	WMIC.exe
Token: SeProfSingleProcessPrivilege	5052	WMIC.exe
Token: SeIncBasePriorityPrivilege	5052	WMIC.exe
Token: SeCreatePagefilePrivilege	5052	WMIC.exe
Token: SeBackupPrivilege	5052	WMIC.exe
Token: SeRestorePrivilege	5052	WMIC.exe
Token: SeShutdownPrivilege	5052	WMIC.exe
Token: SeDebugPrivilege	5052	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5052	WMIC.exe
Token: SeRemoteShutdownPrivilege	5052	WMIC.exe
Token: SeUndockPrivilege	5052	WMIC.exe
Token: SeManageVolumePrivilege	5052	WMIC.exe
Token: 33	5052	WMIC.exe
Token: 34	5052	WMIC.exe
Token: 35	5052	WMIC.exe
Token: 36	5052	WMIC.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeIncreaseQuotaPrivilege	5052	WMIC.exe
Token: SeSecurityPrivilege	5052	WMIC.exe
Token: SeTakeOwnershipPrivilege	5052	WMIC.exe
Token: SeLoadDriverPrivilege	5052	WMIC.exe
Token: SeSystemProfilePrivilege	5052	WMIC.exe
Token: SeSystemtimePrivilege	5052	WMIC.exe
Token: SeProfSingleProcessPrivilege	5052	WMIC.exe
Token: SeIncBasePriorityPrivilege	5052	WMIC.exe
Token: SeCreatePagefilePrivilege	5052	WMIC.exe
Token: SeBackupPrivilege	5052	WMIC.exe
Token: SeRestorePrivilege	5052	WMIC.exe
Token: SeShutdownPrivilege	5052	WMIC.exe
Token: SeDebugPrivilege	5052	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5052	WMIC.exe
Token: SeRemoteShutdownPrivilege	5052	WMIC.exe
Token: SeUndockPrivilege	5052	WMIC.exe
Token: SeManageVolumePrivilege	5052	WMIC.exe
Token: 33	5052	WMIC.exe
Token: 34	5052	WMIC.exe
Token: 35	5052	WMIC.exe
Token: 36	5052	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1344	WMIC.exe
Token: SeSecurityPrivilege	1344	WMIC.exe
Token: SeTakeOwnershipPrivilege	1344	WMIC.exe
Token: SeLoadDriverPrivilege	1344	WMIC.exe
Token: SeSystemProfilePrivilege	1344	WMIC.exe
Token: SeSystemtimePrivilege	1344	WMIC.exe
Token: SeProfSingleProcessPrivilege	1344	WMIC.exe
Token: SeIncBasePriorityPrivilege	1344	WMIC.exe
Token: SeCreatePagefilePrivilege	1344	WMIC.exe
Token: SeBackupPrivilege	1344	WMIC.exe
Token: SeRestorePrivilege	1344	WMIC.exe
Token: SeShutdownPrivilege	1344	WMIC.exe
Token: SeDebugPrivilege	1344	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1344	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 2312	3688	qu1cksc0pe_carved-0.exe	94
PID 3688 wrote to memory of 2312	3688	qu1cksc0pe_carved-0.exe	94
PID 3688 wrote to memory of 2312	3688	qu1cksc0pe_carved-0.exe	94
PID 3688 wrote to memory of 1332	3688	qu1cksc0pe_carved-0.exe	95
PID 3688 wrote to memory of 1332	3688	qu1cksc0pe_carved-0.exe	95
PID 3688 wrote to memory of 1332	3688	qu1cksc0pe_carved-0.exe	95
PID 3688 wrote to memory of 4936	3688	qu1cksc0pe_carved-0.exe	96
PID 3688 wrote to memory of 4936	3688	qu1cksc0pe_carved-0.exe	96
PID 3688 wrote to memory of 4936	3688	qu1cksc0pe_carved-0.exe	96
PID 3688 wrote to memory of 4936	3688	qu1cksc0pe_carved-0.exe	96
PID 3688 wrote to memory of 4936	3688	qu1cksc0pe_carved-0.exe	96
PID 3688 wrote to memory of 4936	3688	qu1cksc0pe_carved-0.exe	96
PID 3688 wrote to memory of 4936	3688	qu1cksc0pe_carved-0.exe	96
PID 3688 wrote to memory of 4936	3688	qu1cksc0pe_carved-0.exe	96
PID 4936 wrote to memory of 5092	4936	qu1cksc0pe_carved-0.exe	97
PID 4936 wrote to memory of 5092	4936	qu1cksc0pe_carved-0.exe	97
PID 5092 wrote to memory of 3324	5092	Baron.exe	98
PID 5092 wrote to memory of 3324	5092	Baron.exe	98
PID 3324 wrote to memory of 4380	3324	Baron.exe	99
PID 3324 wrote to memory of 4380	3324	Baron.exe	99
PID 3324 wrote to memory of 4552	3324	Baron.exe	100
PID 3324 wrote to memory of 4552	3324	Baron.exe	100
PID 3324 wrote to memory of 1956	3324	Baron.exe	103
PID 3324 wrote to memory of 1956	3324	Baron.exe	103
PID 4380 wrote to memory of 4192	4380	cmd.exe	105
PID 4380 wrote to memory of 4192	4380	cmd.exe	105
PID 3324 wrote to memory of 1740	3324	Baron.exe	106
PID 3324 wrote to memory of 1740	3324	Baron.exe	106
PID 3324 wrote to memory of 4296	3324	Baron.exe	107
PID 3324 wrote to memory of 4296	3324	Baron.exe	107
PID 3324 wrote to memory of 4068	3324	Baron.exe	110
PID 3324 wrote to memory of 4068	3324	Baron.exe	110
PID 3324 wrote to memory of 4216	3324	Baron.exe	111
PID 3324 wrote to memory of 4216	3324	Baron.exe	111
PID 3324 wrote to memory of 4272	3324	Baron.exe	113
PID 3324 wrote to memory of 4272	3324	Baron.exe	113
PID 3324 wrote to memory of 4328	3324	Baron.exe	139
PID 3324 wrote to memory of 4328	3324	Baron.exe	139
PID 3324 wrote to memory of 3876	3324	Baron.exe	118
PID 3324 wrote to memory of 3876	3324	Baron.exe	118
PID 1740 wrote to memory of 2372	1740	cmd.exe	120
PID 1740 wrote to memory of 2372	1740	cmd.exe	120
PID 4552 wrote to memory of 3092	4552	cmd.exe	121
PID 4552 wrote to memory of 3092	4552	cmd.exe	121
PID 4296 wrote to memory of 2952	4296	cmd.exe	122
PID 4296 wrote to memory of 2952	4296	cmd.exe	122
PID 1956 wrote to memory of 4356	1956	cmd.exe	123
PID 1956 wrote to memory of 4356	1956	cmd.exe	123
PID 4272 wrote to memory of 516	4272	cmd.exe	124
PID 4272 wrote to memory of 516	4272	cmd.exe	124
PID 4328 wrote to memory of 2476	4328	cmd.exe	125
PID 4328 wrote to memory of 2476	4328	cmd.exe	125
PID 4068 wrote to memory of 5052	4068	cmd.exe	126
PID 4068 wrote to memory of 5052	4068	cmd.exe	126
PID 4216 wrote to memory of 2656	4216	cmd.exe	127
PID 4216 wrote to memory of 2656	4216	cmd.exe	127
PID 3876 wrote to memory of 4388	3876	cmd.exe	128
PID 3876 wrote to memory of 4388	3876	cmd.exe	128
PID 3324 wrote to memory of 3432	3324	Baron.exe	129
PID 3324 wrote to memory of 3432	3324	Baron.exe	129
PID 3432 wrote to memory of 1560	3432	cmd.exe	131
PID 3432 wrote to memory of 1560	3432	cmd.exe	131
PID 3324 wrote to memory of 2904	3324	Baron.exe	132
PID 3324 wrote to memory of 2904	3324	Baron.exe	132

C:\Users\Admin\AppData\Local\Temp\qu1cksc0pe_carved-0.exe
"C:\Users\Admin\AppData\Local\Temp\qu1cksc0pe_carved-0.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Users\Admin\AppData\Local\Temp\qu1cksc0pe_carved-0.exe
  "C:\Users\Admin\AppData\Local\Temp\qu1cksc0pe_carved-0.exe"
  2⤵
  PID:2312
- C:\Users\Admin\AppData\Local\Temp\qu1cksc0pe_carved-0.exe
  "C:\Users\Admin\AppData\Local\Temp\qu1cksc0pe_carved-0.exe"
  2⤵
  PID:1332
- C:\Users\Admin\AppData\Local\Temp\qu1cksc0pe_carved-0.exe
  "C:\Users\Admin\AppData\Local\Temp\qu1cksc0pe_carved-0.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Users\Admin\AppData\Local\Temp\Baron.exe
    "C:\Users\Admin\AppData\Local\Temp\Baron.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Baron.exe
      "C:\Users\Admin\AppData\Local\Temp\Baron.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:3324
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Baron.exe'"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4380
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Baron.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4192
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4552
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3092
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‏ .scr'"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1956
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‏ .scr'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4356
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1740
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2372
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4296
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2952
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4068
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5052
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        5⤵
        Clipboard Data
        Suspicious use of WriteProcessMemory
        
        PID:4216
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        6⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2656
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4272
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:516
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4328
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:2476
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3876
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:4388
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3432
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:1560
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:2904
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:4596
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:4968
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:696
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:4352
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4328
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:2248
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        5⤵
        
        PID:3132
      - C:\Windows\system32\tree.com
        
        tree /A /F
        6⤵
        
        PID:1504
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "getmac"
        5⤵
        
        PID:1256
      - C:\Windows\system32\getmac.exe
        
        getmac
        6⤵
        
        PID:5032
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI50922\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\andnk.zip" *"
        5⤵
        
        PID:1224
      - C:\Users\Admin\AppData\Local\Temp\_MEI50922\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI50922\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\andnk.zip" *
        6⤵
        Executes dropped EXE
        
        PID:4732
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        5⤵
        
        PID:1212
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1344
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        5⤵
        
        PID:3436
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        6⤵
        
        PID:736
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:4688
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        
        PID:1748
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
        5⤵
        
        PID:2484
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4192
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        5⤵
        
        PID:2392
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        6⤵
        Detects videocard installed
        
        PID:3124
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
        5⤵
        
        PID:4212
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\qu1cksc0pe_carved-0.exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Baron.exe

Filesize
7.4MB

MD5
564e63f6af284a2c487c0e474500b098

SHA1
137b9893cf8abb3960cf330ba29d0b07d119de8c

SHA256
d8f0e9b04d7b2e25996ba4dff86d1bc322c9a1d5e964f70c97eba53214ab3eff

SHA512
2a558885cdca2afaff0e301d60d21ee19bf2ca9c5a963fe63bbbc9c5bf5af0b3c58e472460c4035749e0116ddc1733bca36ec3132bcd0e427799f1bf8c303292

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\_bz2.pyd

Filesize
46KB

MD5
0c13627f114f346604b0e8cbc03baf29

SHA1
bf77611d924df2c80aabcc3f70520d78408587a2

SHA256
df1e666b55aae6ede59ef672d173bd0d64ef3e824a64918e081082b8626a5861

SHA512
c97fa0f0988581eae5194bd6111c1d9c0e5b1411bab47df5aa7c39aad69bfbeca383514d6aaa45439bb46eacf6552d7b7ed08876b5e6864c8507eaa0a72d4334

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\_ctypes.pyd

Filesize
57KB

MD5
38fb83bd4febed211bd25e19e1cae555

SHA1
4541df6b69d0d52687edb12a878ae2cd44f82db6

SHA256
cd31af70cbcfe81b01a75ebeb2de86079f4cbe767b75c3b5799ef8b9f0392d65

SHA512
f703b231b675c45accb1f05cd34319b5b3b7583d85bf2d54194f9e7c704fbcd82ef2a2cd286e6a50234f02c43616fbeccfd635aefd73424c1834f5dca52c0931

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\_decimal.pyd

Filesize
104KB

MD5
7ba541defe3739a888be466c999c9787

SHA1
ad0a4df9523eeeafc1e67b0e4e3d7a6cf9c4dfac

SHA256
f90efa10d90d940cde48aafe02c13a0fc0a1f0be7f3714856b7a1435f5decf29

SHA512
9194a527a17a505d049161935432fa25ba154e1aee6306dee9054071f249c891f0ca7839de3a21d09b57fdc3f29ee7c4f08237b0dfffafa8f0078cfe464bed3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-console-l1-1-0.dll

Filesize
3KB

MD5
3127e73e09b2f660dbb1b6a3e23159ca

SHA1
d121de4d3cc1788317015f61b3abcea651830c2c

SHA256
a3db4aca7b1ba6f802df24916f086e4a803093ffb29f8902c18b8a09aa18ddcb

SHA512
8daf52fddb4066fd4106fab0c1c34e7bab4522230090242783ed1838a49da3de9453c4cb8379c03112b9c1d353cc3c32e0eef20890429f62209082ade9464cb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-datetime-l1-1-0.dll

Filesize
2KB

MD5
727e82d02106289000923bef8916771b

SHA1
5e5edad1487e1553d8017f49b54289162ed3a516

SHA256
93ebce911997392650aee0f22b72687787c55c7a4a731724a58c45dc3e1f6cc6

SHA512
ec8a3faa00463db6bf24e7cb764fd6a17f4a3df4cd21810eeef5f2684c0cab0c1cb2bafb5074fe3641cfee2814e0defa938fc9a881ed7dbd5c1b34ede9858946

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-debug-l1-1-0.dll

Filesize
2KB

MD5
2882b2bcd74b4d79e21f5349da2931bc

SHA1
ebeaff6f40ea6148193a9cc3368e8d9894fd53d4

SHA256
dcafa02c5e11d38c590754ee6a23dc65c3342308bb28435efb75de914f2b3652

SHA512
3d8e97f67217ed52c60b0fb871e2d0fa163fe1a1fb42c2888813d496fae9ef621f8daeed7984f8368d3b6de45857013df5d77e1694cfd5f4d95bc219bef82fd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
2KB

MD5
94671f5b4c8cbaaa25b6948b9af8eacd

SHA1
71ad4f949f80efca1bb493f6678c8afeeb923646

SHA256
5eb1c0679756b46c57acaf600246ceff260b88f602215e4a94231ef0c30b0af7

SHA512
10247a1f40f429ef22b68c51c9df4cff7c64f79fe09485a1a7f4fd6fd3f9b13801f6336ed6a7c1804918dc1e78660f6f4126c8052bfc0cff15906c941bbee12c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-file-l1-1-0.dll

Filesize
4KB

MD5
aa766b098462eff6f0f129b5c6ef1c5e

SHA1
3be25b0d330586a08c317d97ea139d096b35b0b6

SHA256
34790e8f47a8f478a4ba4f89695cea1be64d16ff416542ec3036acb5633009ed

SHA512
3fd9e39cd161e164c9c3f42140a5659f516416985238f93c97bfa9079ab203cd7f920c675fc891fddcab683c52d876838cb623c26d7a3c8b7a0c1799dcfada11

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-file-l1-2-0.dll

Filesize
4KB

MD5
cb3e0dd38c444938ce1c189aadd29a3f

SHA1
45b985ccd1d30c67c757580d4e9abe6ca7be4dd7

SHA256
b2d983883afd758913a7db54222a2db4bfeb1051b0c0f92e8faae93c0bc90fc4

SHA512
cde637e676819a05cfe6f757bcb6a1aca72bd7d4422e7cedfbf9d8ba42b47eac7868a821fce93e6d0f1de20672a8de7362f9dba0066db812c74e060134fc293e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-file-l2-1-0.dll

Filesize
2KB

MD5
4a18beda5038c5203993191431b98d62

SHA1
facba10698a89a42c0e419bac056366e809dedc0

SHA256
3144bccc1385efc1ff204442a5aecc0a990776341a268fad15aa605449fca04a

SHA512
fd4a1963babe134202c5b9c97b8a83c0dc1c7e58f04a5cb12f6ccf7ae6ac41f13303fb3d01052e2b670805a7e2d21c193ee888e98e68054dd52b9bdc636a7597

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-handle-l1-1-0.dll

Filesize
2KB

MD5
d525807d6a2d16bd9b8b22ffe99b7c26

SHA1
2f78df1d946a2de936c3f9b6cc88fe401aa74b72

SHA256
1ab5fe4396f72938193a8ce5e18fcb522f84dd24591f39ec1302fc822f875496

SHA512
013b2c635e6be446096de81a2003e1f65658d203f5f6eae3477cd54ea5ff3eec929ed41cf6e33a61aaa201ca920cdf9f96eb34eb8ebd526146d2da2910a3a9d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-heap-l1-1-0.dll

Filesize
3KB

MD5
065dff75d5e5a28bbf5b2e1b7b3fbf5c

SHA1
c4dc31ea4888e5e7ca5e8155f0eafe25ad781073

SHA256
59d807fe256fc61866ee54dc4f18bb4f8901d902f7e23b15ecbf7b7a4dc6fc5f

SHA512
067ae4cab058be6bfca080c95ea5123413e11b7ff6a84eccc10d750fac2719ee5d86a6362d0d4155b54ace6c4d44d7a55b627236ebea7d3fd0b9620ed2f10a57

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
2KB

MD5
d0da5a427b151f8c524948d13c51cab4

SHA1
a51ac6ba7814188b669c7abbfdee535d798f05e1

SHA256
65912b7d8ad3423ad4609b9e2e3c262647d5273706796f043c9b515f1e8c78f2

SHA512
01ef7f3c43ac8e81e25edd324f56f7916ff990cf7350f582a0e2ce67ed54f584bb72d95d8faf129964351771f5099e36e8f02f1b067cf05b3349b64ea696bcde

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
3KB

MD5
465c8ca52d6a5ebb8cdddaddcc6255c2

SHA1
d51db3b2382a0457533350e687489d91a229e5e8

SHA256
e68ff1811bfe8cd7682c45a1d562c90ccb35a70971cd75d195c7773d668e1dc4

SHA512
0641ef1524c00183c0693ee301ab0d982d4ba4bdc1326294d20a9cdd8f5c1af16a0038c6fd11d490a1db09221c6729fe03e6329a4262d6055bb5b37b32f8b393

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-localization-l1-2-0.dll

Filesize
4KB

MD5
3018f5b28a9e26395b7933ebcfd6f40c

SHA1
ea38f03430f1a54e9b37e9694eabc7487b6e7201

SHA256
0c62b8ab1e5f30d4a9eadcd412677e0ab5e4e9304f0870a4ee562f08d09ccc7e

SHA512
f9a81f4565d083f30049ee8e4c4da996ba86c7c20e58d3dcd102eb41ab58c6d94941545ea2ee3aa538d352847efdd84376144ff852bdef4ea3c54dab4e5ced47

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-memory-l1-1-0.dll

Filesize
3KB

MD5
db31bdb3725819fc5c5df30c608673c3

SHA1
5253f48e153b9c722acac8ee558e9a6091f5ee3e

SHA256
3115632c9bea1ccdeb7747689aa65fa36291788339793fce306afb03ca748a6c

SHA512
5db501b57d129511afa868716d82f27b8505be5c0e2edb5c1509b38b2537f14586da71c4424055bfe1b812f333e3f30d63e52501700ccdf848a37e49a0235cbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
3KB

MD5
a8d532500495d617ca1b9f5525494486

SHA1
9542ccb68fd7e5337953c25fb33589c486d98788

SHA256
c0d62d6a9350e66fb144e297c49ae2a8efb997148807a60dbac1aa95c88fa8f4

SHA512
68cdfcf37a60931567f341c4b1cf2751123a90733622daa1c02d2a8937b32d7faa4537fc4f93d238cff6f2fab11f7710c1dc15812d1ba028898f8a4dfb0cd10d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-path-l1-1-0.dll

Filesize
3KB

MD5
2cd77f6e2fa6a502e352369426eae1c1

SHA1
abb54114f3677944af582afb6ea1f4a7785537c8

SHA256
e39ca111d81e6e5d90cf13fa0aee525d8a2740b84d2c5cd378dd69e4f79f8b0f

SHA512
47d47a49b8f89f64bd0d4bda344456784e8b0721f9ba32ce3b88e6dd5bec06bfb781dc44495ac17b4c50dfe679e1d18594fa91ccdfa26bed055a2c4a5c7c2906

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
3KB

MD5
9ce4f24efdf1a23bd71206b870b2a049

SHA1
2faac945038e108b21c5f9a0c175622f65f30072

SHA256
f4cae758d318b23e76ddf50202768f4cbea9cc16d36114f4cecb15957206e4af

SHA512
86c4db450bd26bfa007c032514e862a026e0317a48d1b05cf489b30b33985f01b98eafff2073d86028622694599070d80c95ae6b4c31b4832c55c6261575019c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
4KB

MD5
624033b39b9c5e1eb13d5ede2d213ddf

SHA1
055995c888275105e3560f07a2442e28295588f6

SHA256
83a0079fbf50719b46275f9cc5675a299c987862ba7ad3ad0ee5f6e714400af5

SHA512
1200daec55e5f5e80489022efe3ee67baae64278f9289e828deb8a3507355e2d643e9fefa7cf21c2056b4c5458270ef605697f38c3f3cacd41d23e3ded3c7ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
4KB

MD5
004f7f67994de33959d6480ef4d4f515

SHA1
76e83db625d504d1feec5dec918552f9ec51c4c3

SHA256
053a83b3f8ac76232952bdb8fb5c5067f06ba48f82b474829c25326adbd26361

SHA512
d187950683c79b1dffe4432fb476071a203cb14d7987377f71538b81fd36077f181fb7d64e9e4e30099f239764e6cbb501b65c095cd4532bc0b2ab9fbd7755a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-profile-l1-1-0.dll

Filesize
2KB

MD5
0b786fa5d778e0ea9a2175263320ee8c

SHA1
83553ac046847ab0c852403e512e748b73be5dec

SHA256
a124c3f8402636219e06beb708d8be67f6dbaa7ff4f6d402b50734230fcfba1b

SHA512
bb29f985653105e23f52f381bef5ac1f8d1a34d1eca4678f50fc6f308860104d073fc1551f42ae4f460c32366e95c95f7d9bf84b34b7ff48bd3921904f94607a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
3KB

MD5
7db9f8a411f116ba765000e6500fb926

SHA1
4267018a03d814b8963ab1e256ee9ea8f0a33fed

SHA256
f8dd900d459335eedbe3855f1ba7858e19dfc0d348ebd25e6548d4ecb0da61b1

SHA512
54f4c79747e2de6f26bef354a4328fe7f596b8d8ac0f2c14220e8998a1980553a09bca61756316e12846b502cacc45ab4f90efcff0deb3c9e39037e5cc52556c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-string-l1-1-0.dll

Filesize
2KB

MD5
c8196cd707f4a41c4a763b8e6d2ede7a

SHA1
371be162f04e7742246c0d9c9b2ad31a25043978

SHA256
b5082680b5ca71fdea49e8e23efbda2b72f6e1b1a48782b4b63530ee7be19a2c

SHA512
3690d87e9eddf0de7d71bfbab831d80009b572e5c2f181fb23b2966d1249861aeff61ebbb16e46836697b443a0c1af2cfdfc930e9f010b613337ed5ac475a306

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-synch-l1-1-0.dll

Filesize
3KB

MD5
4219b20d53c2c6b533ae93ed45876351

SHA1
8973762e7c4ace85a1d9aaa1dd35fac6bd48c0ed

SHA256
c75a838ff92199678df2ad04a31f609309967cf6b66d34c58d26eb3909e6daa5

SHA512
b73fc539d6a36e38a557d3dcf44fabd1500ccea9c9c10c0101104b10d1923e46cd78be0791b9fcbb1603da7a1ccd33e6a3e3b807bc5f5448d24e44351b5e100d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-synch-l1-2-0.dll

Filesize
4KB

MD5
bc03011a527274767effd05f90d26011

SHA1
56659c88000ff70422e818ad827fdcb01f036de2

SHA256
7f840e721c8cd073631f03159565219d24128eaca905668cfc7394889b908b9e

SHA512
600d1163ffb6b7244770a67f2a543b387a33940178dbbc010ad8c5a5e32872bb0d065e1dcf5a985174577922762ccd2b462cf40c1d4d6dc99e07d22daaee098a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
3KB

MD5
705476aaa1ef452e50c61fa56f84d919

SHA1
f86ada80b5c2c528fb328d1aaacc817e538ccc85

SHA256
1d7a5a3cd3185d839d31c83dcb2192a08a80c4a7ec17eae550ab5a4d84b189d9

SHA512
db6fdec0f758a955a4fa888571ad2496f072d9f580895628aa2da143daa4f64c9fbdf5d9a6950bc06ca5f69395c04515d77c1ee45744c4e7600c1e5dd4cd559e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-timezone-l1-1-0.dll

Filesize
3KB

MD5
a84f802749ae5a0aa522f203ece20b7f

SHA1
3c631ce4107b2ffc9a4a06c16d41d7d0ea0a9b2f

SHA256
e4d28023eca5bd147ac645048b18bd7272735da10c30c2dbc83cd1c96703d869

SHA512
52b68a300ae56eb8a3b3f811cc7368afe5d4f1e8ee37b6fdae0878978952041bd5467eaaaec23aab12c1735ed3afd8134b2171b633ee1dae3b159e99d765a71d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-core-util-l1-1-0.dll

Filesize
2KB

MD5
2d8249636011cf1467be41c8bdf7c765

SHA1
c7edaf6444690db617f58b0506dd979e1f2314a4

SHA256
84ce120aae88dd77a71c30630d409382f2ad22b11be4ccedd1800c4bb2ca4937

SHA512
4732c247b6505c48a41a0c5ba933f2c7dc63301f09ff891f2e50ef765c3eae00d520d9e08cb5229d6e90048aa826caf34a282b5fb80f10a63ee987a60836f9ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-crt-conio-l1-1-0.dll

Filesize
12KB

MD5
21ab8a6f559d1e49c8ffa3cdaf037839

SHA1
87f2edace67ebe04ba869ba77c6f3014d9cb60c0

SHA256
30b677b95de5fcbaa2ae67088822a5feabdb63a53101cc44de83067018b457c8

SHA512
6f117397ee46519a5cf29d3c8a72503861a78a83ccbc56bd4447ab2f4693857147c35292c87cb5ba5efadde97bce3735aedb0275fcabea1006c1621945a44498

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-crt-convert-l1-1-0.dll

Filesize
15KB

MD5
f5d4ef8a0c33cbf321dd51abafd5ffb2

SHA1
c85b87aa33f3fcee76facc1d0fec65f1cc5f1b55

SHA256
053e6f664d1aebe7fd120bf89056f2612b7667e1f71df0dddb504e04c58a508a

SHA512
9d85e5c320699c079df98695641f24d9baada5514435ae9b69c28ad3c3b5c29129cd46d0f8f2398fc94ade30777ed44ca5f75f6e78eb86d64ceb32c71046479c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-crt-environment-l1-1-0.dll

Filesize
11KB

MD5
f5f31dc3b928073274bcdf7b4d4136f9

SHA1
07624699fd428b5e60a5ffdafe3ad1b820aa2b8d

SHA256
5cde06aaddd28e0bb3afe756215d6ae5f2eb20b00413a6a1d2095d81493c5ddd

SHA512
9458453d9530f6652f3580e988ed0f8320268a2a1a4d4a017a00935f6133fc3e8f91e8bbba07b1f628eba1a3822e4a3c3a8b72c2861950e1ede9521dd04868b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
13KB

MD5
861a2fd3afb4557ba49a6d60a02c39bf

SHA1
03622632d5e810b87b806ddfc0ed6ea3d2171b96

SHA256
c1a072b49acb82640104aada665ff948415cc57dfcbc495d4d85b1f18d84a1a3

SHA512
ae20bb93d7661d47048042a3a21d95f0c1b20918f170fee77cd7de2b9367a3f819b39e45cb6c58689603f1670cf3c46cdf6453162f3d88871c794df13460f374

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-crt-heap-l1-1-0.dll

Filesize
11KB

MD5
156da44de8586202cd7badda883b5994

SHA1
de58f32e2172d31a55df26f0d9a0c5ac9880efdd

SHA256
6e0460ea48738b50c8628038368e4e4b425fb6aa5de76f7fe06f2473fabc0e9e

SHA512
a80a316db9fd3f6907e28771bd39c00244f510096eab3daf617c65962bb223c728505a40dc2c3f651cc49df5d7bfa6f660ea1f9889aeb2bcf9b93a2eb6c0503e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-crt-locale-l1-1-0.dll

Filesize
11KB

MD5
10c18ee8eb974e9f6382917ad3cd7d11

SHA1
3308cd7d9d29e42e137fd348b96545c206ea7096

SHA256
3a292b3ae218086edd2d136fcc9eb65e788caa6933c864908a07f004fecd9972

SHA512
a18769ce5ef8e0da4b9bf997d9c8800e9d715c54f603cac6534cadc0ade3f9c70a0e9fc2e607d1dfd6d7326f9fb4f519466cd0953591494d0376d1624d77f1de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-crt-math-l1-1-0.dll

Filesize
20KB

MD5
fd374a7f3079a4f7d96b4c8a1e71b1a3

SHA1
3f3c768239d26cf8c6f83af96131e7b8e85ed017

SHA256
f7117aa5df8fbfed9f625cbe11cd64fdac1220099484b3ae534107d02a99058d

SHA512
3f7d9d632e434ed01588c4eea69483197040588f09fdf0a9acb902ea59664ec2a0257723ab61fbe56545d14462be475919da8f072f5e1e720569cbb3a776110c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-crt-process-l1-1-0.dll

Filesize
12KB

MD5
9600008630390e2209199e7791185075

SHA1
7e85b6c55a2d17c0d9ffc96649a92f3e73d6757c

SHA256
0e16041aa9cff135af254e79d85b5f3944bf21e9448bc07f058894eb2013f724

SHA512
8690cde896e5731074c4a703ed0a26fe5fc136a13e57656c3a92ca5a6915ec741d587258e02e60cb4b1ccafd24e110c248641c06f8d839c0c1e235b0318491b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
15KB

MD5
1b923d7b425ee35cc865715e8ff2b920

SHA1
0302fe5cd576c9e28f1e9939ac04ac6ad89e371e

SHA256
fd40b4d21e907f8c168504bba248ca7eed4a84537ceec8a9903112e531b6a406

SHA512
62571b373b969889d07be3fc26146d93fed2955d6e9b336e4fc8f8759db98a8ec4154b6df5244c3b37cd3bfd7f153b2c6be7799845a02e0446c41a6898f82f31

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
17KB

MD5
d263b7ce85efdc007c40aabca5acb255

SHA1
b7fac5089b3990cddc2435138e89da2d5d515032

SHA256
37dfd6cd14f191e97e5f1674422e79febfcae062b4a56959f76ff63803e58a55

SHA512
6bc594fcb1ad5149f27c86674e78bae447e6d3f2e494e2749eaeb15af28a212dad075ec441541b490774770e77377e798a3dced94c1e9b9cfdc4f5c95bf936f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-crt-string-l1-1-0.dll

Filesize
17KB

MD5
1a3292019af01d7a6ed8bc52686840e6

SHA1
e1684c73ae12cd341250d544afcc539856c9bb43

SHA256
e01b24d0fe72ae8d2c76b287d1286741940b84808e4bf11514402a0a6d2706f9

SHA512
941c238c96de015d511bf691e878592ff8c71556ce95b3fba268bf9dc6a2e2ecde3c02b4dff66d3eeaf3b177624b193c42691c692e293982126ef70a10caf48b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-crt-time-l1-1-0.dll

Filesize
13KB

MD5
1bf2af4deb96801edfde04a763ea4028

SHA1
f6a9a0a603b34d212620f8b513b48039e8576f47

SHA256
e4fd646a54d9a21c52c1480e5ae36bb519a7e2237a026725570776d61a43b5a1

SHA512
42fe94de60a8eb5f3b401047316440a4f36e3184f1cb9e22f750b37627ca2a6199fb55cb950b6e5cfebbe413554128723b17bc421301768ddf9636ad3c9d07d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\api-ms-win-crt-utility-l1-1-0.dll

Filesize
11KB

MD5
fcfb6405cf54d78c5baa81a66802918c

SHA1
ffa88fadee5b00f7daf1a10baea98274c590e697

SHA256
91067f7c04812981dd32ea882c7931d128219eb376190500389bc5e60a5a116e

SHA512
cb9f02217d5fb73c91f758f29c5b6d4ed607e75bf94b90a63371902b4910d68f328f406cab6bd1f273382514b4b8e1facb0d6a3f7f09536f7b627dba7e94e80b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\base_library.zip

Filesize
1.4MB

MD5
83d235e1f5b0ee5b0282b5ab7244f6c4

SHA1
629a1ce71314d7abbce96674a1ddf9f38c4a5e9c

SHA256
db389a9e14bfac6ee5cce17d41f9637d3ff8b702cc74102db8643e78659670a0

SHA512
77364aff24cfc75ee32e50973b7d589b4a896d634305d965ecbc31a9e0097e270499dbec93126092eb11f3f1ad97692db6ca5927d3d02f3d053336d6267d7e5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\blank.aes

Filesize
98KB

MD5
ed34048411f417353ecdfa0b4087271e

SHA1
9f916c0ccd57bdfced94494e1040261da3c17119

SHA256
88a75a4801a9a512d0ef5b158175260ab545e322b378ed02fd43ec9b2f0d135f

SHA512
76132ac58d0ffed733a5c8269423c9c61f165f0c997641e7b6b6b077164eed9465f546d97809d3a655e505163bdcebb0666742b41bf19e44347892e5f911e013

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\libcrypto-1_1.dll

Filesize
1.1MB

MD5
daa2eed9dceafaef826557ff8a754204

SHA1
27d668af7015843104aa5c20ec6bbd30f673e901

SHA256
4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914

SHA512
7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\libffi-8.dll

Filesize
24KB

MD5
90a6b0264a81bb8436419517c9c232fa

SHA1
17b1047158287eb6471416c5df262b50d6fe1aed

SHA256
5c4a0d4910987a38a3cd31eae5f1c909029f7762d1a5faf4a2e2a7e9b1abab79

SHA512
1988dd58d291ee04ebfec89836bb14fcaafb9d1d71a93e57bd06fe592feace96cdde6fcce46ff8747339659a9a44cdd6cf6ac57ff495d0c15375221bf9b1666e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\libssl-1_1.dll

Filesize
203KB

MD5
eac369b3fde5c6e8955bd0b8e31d0830

SHA1
4bf77158c18fe3a290e44abd2ac1834675de66b4

SHA256
60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c

SHA512
c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\python311.dll

Filesize
1.6MB

MD5
bb46b85029b543b70276ad8e4c238799

SHA1
123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c

SHA256
72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0

SHA512
5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\select.pyd

Filesize
24KB

MD5
abf7864db4445bbbd491c8cff0410ae0

SHA1
4b0f3c5c7bf06c81a2c2c5693d37ef49f642a9b7

SHA256
ddeade367bc15ea09d42b2733d88f092da5e880362eabe98d574bc91e03de30e

SHA512
8f55084ee137416e9d61fe7de19e4cff25a4b752494e9b1d6f14089448ef93e15cd820f9457c6ce9268781bd08e3df41c5284801f03742bc5c40b3b81fb798c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\sqlite3.dll

Filesize
608KB

MD5
ddd0dd698865a11b0c5077f6dd44a9d7

SHA1
46cd75111d2654910f776052cc30b5e1fceb5aee

SHA256
a9dd0275131105df5611f31a9e6fbf27fd77d0a35d1a73a9f4941235fbc68bd7

SHA512
b2ee469ea5a6f49bbdd553363baa8ebad2baf13a658d0d0c167fde7b82eb77a417d519420db64f325d0224f133e3c5267df3aa56c11891d740d6742adf84dbe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\ucrtbase.dll

Filesize
971KB

MD5
bd8b198c3210b885fe516500306a4fcf

SHA1
28762cb66003587be1a59c2668d2300fce300c2d

SHA256
ce2621719f1358508c2c33bcc1380d78a737ca20cd18c0ac89f38e1be788d9a2

SHA512
c32b6c083d3a7da01085718e5685e9a04034be91251c065794ceef1dfaaf6573fdd845cbc84e926ab3f510d295649cb6e497564fbe52cc79c053357c645c11a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI50922\unicodedata.pyd

Filesize
293KB

MD5
bb3fca6f17c9510b6fb42101fe802e3c

SHA1
cb576f3dbb95dc5420d740fd6d7109ef2da8a99d

SHA256
5e2f1bbfe3743a81b00717011094798929a764f64037bedb7ea3d2ed6548eb87

SHA512
05171c867a5d373d4f6420136b6ac29fa846a85b30085f9d7fabcbb4d902afee00716dd52010ed90e97c18e6cb4e915f13f31a15b2d8507e3a6cfa80e513b6a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1vb01heq.uje.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3324-163-0x00007FFF43E10000-0x00007FFF43E33000-memory.dmp

Filesize
140KB

Download
memory/3324-338-0x00007FFF41C90000-0x00007FFF41E03000-memory.dmp

Filesize
1.4MB

Download
memory/3324-347-0x00007FFF41E10000-0x00007FFF423F8000-memory.dmp

Filesize
5.9MB

Download
memory/3324-348-0x00007FFF50880000-0x00007FFF508A4000-memory.dmp

Filesize
144KB

Download
memory/3324-349-0x00007FFF55F20000-0x00007FFF55F2F000-memory.dmp

Filesize
60KB

Download
memory/3324-350-0x00007FFF4D120000-0x00007FFF4D14D000-memory.dmp

Filesize
180KB

Download
memory/3324-351-0x00007FFF4D830000-0x00007FFF4D849000-memory.dmp

Filesize
100KB

Download
memory/3324-352-0x00007FFF43E10000-0x00007FFF43E33000-memory.dmp

Filesize
140KB

Download
memory/3324-353-0x00007FFF41C90000-0x00007FFF41E03000-memory.dmp

Filesize
1.4MB

Download
memory/3324-354-0x00007FFF49780000-0x00007FFF49799000-memory.dmp

Filesize
100KB

Download
memory/3324-355-0x00007FFF55E20000-0x00007FFF55E2D000-memory.dmp

Filesize
52KB

Download
memory/3324-356-0x00007FFF43670000-0x00007FFF4369E000-memory.dmp

Filesize
184KB

Download
memory/3324-357-0x00007FFF41910000-0x00007FFF41C85000-memory.dmp

Filesize
3.5MB

Download
memory/3324-359-0x00007FFF43D10000-0x00007FFF43D24000-memory.dmp

Filesize
80KB

Download
memory/3324-360-0x00007FFF55930000-0x00007FFF5593D000-memory.dmp

Filesize
52KB

Download
memory/3324-362-0x00007FFF41850000-0x00007FFF41908000-memory.dmp

Filesize
736KB

Download
memory/3324-361-0x00007FFF41730000-0x00007FFF4184C000-memory.dmp

Filesize
1.1MB

Download
memory/3324-332-0x00007FFF41E10000-0x00007FFF423F8000-memory.dmp

Filesize
5.9MB

Download
memory/3324-100-0x00007FFF41E10000-0x00007FFF423F8000-memory.dmp

Filesize
5.9MB

Download
memory/3324-161-0x00007FFF4D120000-0x00007FFF4D14D000-memory.dmp

Filesize
180KB

Download
memory/3324-162-0x00007FFF4D830000-0x00007FFF4D849000-memory.dmp

Filesize
100KB

Download
memory/3324-107-0x00007FFF55F20000-0x00007FFF55F2F000-memory.dmp

Filesize
60KB

Download
memory/3324-164-0x00007FFF41C90000-0x00007FFF41E03000-memory.dmp

Filesize
1.4MB

Download
memory/3324-165-0x00007FFF49780000-0x00007FFF49799000-memory.dmp

Filesize
100KB

Download
memory/3324-166-0x00007FFF55E20000-0x00007FFF55E2D000-memory.dmp

Filesize
52KB

Download
memory/3324-167-0x00007FFF41E10000-0x00007FFF423F8000-memory.dmp

Filesize
5.9MB

Download
memory/3324-168-0x00007FFF43670000-0x00007FFF4369E000-memory.dmp

Filesize
184KB

Download
memory/3324-171-0x00007FFF41850000-0x00007FFF41908000-memory.dmp

Filesize
736KB

Download
memory/3324-175-0x00007FFF4D120000-0x00007FFF4D14D000-memory.dmp

Filesize
180KB

Download
memory/3324-174-0x00007FFF55930000-0x00007FFF5593D000-memory.dmp

Filesize
52KB

Download
memory/3324-173-0x00007FFF43D10000-0x00007FFF43D24000-memory.dmp

Filesize
80KB

Download
memory/3324-178-0x00007FFF4D830000-0x00007FFF4D849000-memory.dmp

Filesize
100KB

Download
memory/3324-179-0x00007FFF41730000-0x00007FFF4184C000-memory.dmp

Filesize
1.1MB

Download
memory/3324-172-0x00007FFF55F20000-0x00007FFF55F2F000-memory.dmp

Filesize
60KB

Download
memory/3324-170-0x00007FFF50880000-0x00007FFF508A4000-memory.dmp

Filesize
144KB

Download
memory/3324-169-0x00007FFF41910000-0x00007FFF41C85000-memory.dmp

Filesize
3.5MB

Download
memory/3324-104-0x00007FFF50880000-0x00007FFF508A4000-memory.dmp

Filesize
144KB

Download
memory/3324-346-0x00007FFF41730000-0x00007FFF4184C000-memory.dmp

Filesize
1.1MB

Download
memory/3324-283-0x00007FFF43E10000-0x00007FFF43E33000-memory.dmp

Filesize
140KB

Download
memory/3324-304-0x00007FFF41C90000-0x00007FFF41E03000-memory.dmp

Filesize
1.4MB

Download
memory/3324-305-0x00007FFF49780000-0x00007FFF49799000-memory.dmp

Filesize
100KB

Download
memory/3324-308-0x00007FFF43670000-0x00007FFF4369E000-memory.dmp

Filesize
184KB

Download
memory/3324-309-0x00007FFF41910000-0x00007FFF41C85000-memory.dmp

Filesize
3.5MB

Download
memory/3324-321-0x00007FFF41850000-0x00007FFF41908000-memory.dmp

Filesize
736KB

Download
memory/3324-333-0x00007FFF50880000-0x00007FFF508A4000-memory.dmp

Filesize
144KB

Download
memory/3688-8-0x0000000074FF0000-0x00000000757A0000-memory.dmp

Filesize
7.7MB

Download
memory/3688-10-0x000000000BC60000-0x000000000C454000-memory.dmp

Filesize
8.0MB

Download
memory/3688-2-0x0000000005A60000-0x0000000006004000-memory.dmp

Filesize
5.6MB

Download
memory/3688-3-0x00000000054B0000-0x0000000005542000-memory.dmp

Filesize
584KB

Download
memory/3688-4-0x0000000074FF0000-0x00000000757A0000-memory.dmp

Filesize
7.7MB

Download
memory/3688-5-0x0000000005470000-0x000000000547A000-memory.dmp

Filesize
40KB

Download
memory/3688-6-0x0000000008060000-0x0000000008072000-memory.dmp

Filesize
72KB

Download
memory/3688-7-0x0000000074FFE000-0x0000000074FFF000-memory.dmp

Filesize
4KB

Download
memory/3688-1-0x0000000000290000-0x0000000000ADE000-memory.dmp

Filesize
8.3MB

Download
memory/3688-0-0x0000000074FFE000-0x0000000074FFF000-memory.dmp

Filesize
4KB

Download
memory/3688-9-0x0000000006810000-0x0000000006820000-memory.dmp

Filesize
64KB

Download
memory/3688-11-0x000000000E4F0000-0x000000000E58C000-memory.dmp

Filesize
624KB

Download
memory/3688-16-0x0000000074FF0000-0x00000000757A0000-memory.dmp

Filesize
7.7MB

Download
memory/4192-255-0x00000214F1710000-0x00000214F1732000-memory.dmp

Filesize
136KB

Download
memory/4936-17-0x0000000074FF0000-0x00000000757A0000-memory.dmp

Filesize
7.7MB

Download
memory/4936-18-0x0000000074FF0000-0x00000000757A0000-memory.dmp

Filesize
7.7MB

Download
memory/4936-13-0x0000000000400000-0x0000000000BB2000-memory.dmp

Filesize
7.7MB

Download
memory/4936-39-0x0000000074FF0000-0x00000000757A0000-memory.dmp

Filesize
7.7MB

Download