Malware Analysis Report

2025-08-10 15:07

Sample ID 241103-zw52hstmby
Target free hecks.exe
SHA256 0e414694d08123f2f0639603ff0f3c8105554653d393a20d42b295cc74882244
Tags
upx discovery execution persistence privilege_escalation spyware stealer pyinstaller
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

0e414694d08123f2f0639603ff0f3c8105554653d393a20d42b295cc74882244

Threat Level: Likely malicious

The file free hecks.exe was found to be: Likely malicious.

Malicious Activity Summary

upx discovery execution persistence privilege_escalation spyware stealer pyinstaller

Command and Scripting Interpreter: PowerShell

Reads user/profile data of web browsers

Drops startup file

Loads dropped DLL

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

UPX packed file

Browser Information Discovery

Event Triggered Execution: Netsh Helper DLL

System Network Configuration Discovery: Wi-Fi Discovery

Detects Pyinstaller

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Detects videocard installed

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-03 21:05

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-03 21:05

Reported

2024-11-03 21:07

Platform

win7-20240903-en

Max time kernel

122s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\free hecks.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\free hecks.exe

"C:\Users\Admin\AppData\Local\Temp\free hecks.exe"

C:\Users\Admin\AppData\Local\Temp\free hecks.exe

"C:\Users\Admin\AppData\Local\Temp\free hecks.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI23442\ucrtbase.dll

MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

C:\Users\Admin\AppData\Local\Temp\_MEI23442\api-ms-win-core-localization-l1-2-0.dll

MD5 4c26932f8f1f490017add31f5ec0a533
SHA1 0da01a7c89b506fe3fd939344bb51b976efb3207
SHA256 dd3843c2e46b4e926c36150d614efe02ca0ebc1f767f64f471568adc35c2ef23
SHA512 eb2b87d187991fdc8e3a6577f20622d2d4a2a994dd375d8c27e1434ce786596533eacfbde8714db9959d88d6bcb91fdc8079c60c23f0eb920ba45c546a44e523

C:\Users\Admin\AppData\Local\Temp\_MEI23442\api-ms-win-core-processthreads-l1-1-1.dll

MD5 a6776c201baae1dd6f88048d7747d14c
SHA1 646119d2e440e6dad0ffb0fe449ab4fc27f09fbe
SHA256 ee99af71c347ff53c4e15109cb597759e657a3e859d9530680eeea8bb0540112
SHA512 a9137af8529fd96dbba22c5179a16d112ec0bfab9792babe0a9f1cca27408eff73ba89f498cb5f941a5aa44555529ee10484e6ca4a3fbf1627523acfde622b45

C:\Users\Admin\AppData\Local\Temp\_MEI23442\api-ms-win-core-file-l1-2-0.dll

MD5 4a060eec454c222a5381cd359dc00b81
SHA1 21e1bc115d04a74779e955ea16a16bd71454d9bb
SHA256 e6b2b05e14a6c6f5381e8f4c7f4fd28a499246fb4c8eafe1f08014b9273d70df
SHA512 16fb1f4ccdad05d07feb62e0cd078401f4023f9fab0fb15e52b927ca413e65eb32c2932ba59dbfa7f7ee0e8a8053748e27f2757e82e600db812271aa44a9433c

C:\Users\Admin\AppData\Local\Temp\_MEI23442\api-ms-win-core-timezone-l1-1-0.dll

MD5 10d466341e7ece8cf75b5d026105741b
SHA1 31d1e9b9a4511156695b5aa33d65b6a36f8139c2
SHA256 5ce391edb33c7055e724a4c3cecc64d16ba2aa4724cb99cd5aed00b0cecfbc82
SHA512 8778fd10c7360bd87db048a2b2ca6603455fd8cb4d0e18709f106b55db7cc92e7d6dc45385ff9def445b368376462e7d253442728d5e759faa97299b67a59e21

C:\Users\Admin\AppData\Local\Temp\_MEI23442\api-ms-win-core-file-l2-1-0.dll

MD5 50abf0a7ee67f00f247bada185a7661c
SHA1 0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1
SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
SHA512 c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528

C:\Users\Admin\AppData\Local\Temp\_MEI23442\python310.dll

MD5 b93eda8cc111a5bde906505224b717c3
SHA1 5f1ae1ab1a3c4c023ea8138d4b09cbc1cd8e8f9e
SHA256 efa27cd726dbf3bf2448476a993dc0d5ffb0264032bf83a72295ab3fc5bcd983
SHA512 b20195930967b4dc9f60c15d9ceae4d577b00095f07bd93aa4f292b94a2e5601d605659e95d5168c1c2d85dc87a54d27775f8f20ebcacf56904e4aa30f1affba

memory/2080-170-0x000007FEF5CB0000-0x000007FEF6115000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-03 21:05

Reported

2024-11-03 21:08

Platform

win10v2004-20241007-en

Max time kernel

119s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\free hecks.exe"

Signatures

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\free hecks.exe C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\free hecks.exe C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A

Reads user/profile data of web browsers

spyware stealer

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Browser Information Discovery

discovery

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2208 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe C:\Users\Admin\AppData\Local\Temp\free hecks.exe
PID 2208 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe C:\Users\Admin\AppData\Local\Temp\free hecks.exe
PID 1160 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe C:\Windows\system32\cmd.exe
PID 1160 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe C:\Windows\system32\cmd.exe
PID 1160 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe C:\Windows\system32\cmd.exe
PID 1160 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe C:\Windows\system32\cmd.exe
PID 1160 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe C:\Windows\system32\cmd.exe
PID 1160 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe C:\Windows\system32\cmd.exe
PID 760 wrote to memory of 3368 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 760 wrote to memory of 3368 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1232 wrote to memory of 1884 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1232 wrote to memory of 1884 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1232 wrote to memory of 3176 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1232 wrote to memory of 3176 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1232 wrote to memory of 2088 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1232 wrote to memory of 2088 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1232 wrote to memory of 4136 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1232 wrote to memory of 4136 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1160 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe C:\Windows\system32\cmd.exe
PID 1160 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe C:\Windows\system32\cmd.exe
PID 5016 wrote to memory of 3864 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5016 wrote to memory of 3864 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1160 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe C:\Windows\System32\Wbem\wmic.exe
PID 1160 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe C:\Windows\System32\Wbem\wmic.exe
PID 1160 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe C:\Windows\system32\cmd.exe
PID 1160 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe C:\Windows\system32\cmd.exe
PID 1932 wrote to memory of 3284 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1932 wrote to memory of 3284 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1160 wrote to memory of 3132 N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe C:\Windows\system32\cmd.exe
PID 1160 wrote to memory of 3132 N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe C:\Windows\system32\cmd.exe
PID 3132 wrote to memory of 4860 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3132 wrote to memory of 4860 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1160 wrote to memory of 824 N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe C:\Windows\system32\cmd.exe
PID 1160 wrote to memory of 824 N/A C:\Users\Admin\AppData\Local\Temp\free hecks.exe C:\Windows\system32\cmd.exe
PID 824 wrote to memory of 2888 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 824 wrote to memory of 2888 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\free hecks.exe

"C:\Users\Admin\AppData\Local\Temp\free hecks.exe"

C:\Users\Admin\AppData\Local\Temp\free hecks.exe

"C:\Users\Admin\AppData\Local\Temp\free hecks.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\System32\Wbem\wmic.exe

wmic cpu get Name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe csproduct get uuid

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 72.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 133.109.199.185.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.137.232:443 discord.com tcp
US 8.8.8.8:53 232.137.159.162.in-addr.arpa udp
US 8.8.8.8:53 api.ipify.org udp
US 172.67.74.152:443 api.ipify.org tcp
US 162.159.137.232:443 discord.com tcp
US 8.8.8.8:53 152.74.67.172.in-addr.arpa udp
US 162.159.137.232:443 discord.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 150.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 74.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI22082\ucrtbase.dll

MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

C:\Users\Admin\AppData\Local\Temp\_MEI22082\python310.dll

MD5 b93eda8cc111a5bde906505224b717c3
SHA1 5f1ae1ab1a3c4c023ea8138d4b09cbc1cd8e8f9e
SHA256 efa27cd726dbf3bf2448476a993dc0d5ffb0264032bf83a72295ab3fc5bcd983
SHA512 b20195930967b4dc9f60c15d9ceae4d577b00095f07bd93aa4f292b94a2e5601d605659e95d5168c1c2d85dc87a54d27775f8f20ebcacf56904e4aa30f1affba

C:\Users\Admin\AppData\Local\Temp\_MEI22082\VCRUNTIME140.dll

MD5 f34eb034aa4a9735218686590cba2e8b
SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

memory/1160-162-0x00007FFBD2590000-0x00007FFBD29F5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI22082\base_library.zip

MD5 ac4bb7d8dfe25b88ca9b127c1a46f4bc
SHA1 ee788e6de65650055cf05534082d8a6f0ecee30d
SHA256 87bd89db303a3518cae41a545f1ade83fbf2c390bbd119f21cedef398c2f4954
SHA512 63a441b2c1fac671d8eddaebe56d05370a13323f80825d0001d945626e261680beb620ae24207cd9d90d71b1cde7db9cfca699ae6312953a7bed2d5393fd3c92

C:\Users\Admin\AppData\Local\Temp\_MEI22082\_ctypes.pyd

MD5 5c0bda19c6bc2d6d8081b16b2834134e
SHA1 41370acd9cc21165dd1d4aa064588d597a84ebbe
SHA256 5e7192c18ad73daa71efade0149fbcaf734c280a6ee346525ea5d9729036194e
SHA512 b1b45fcbb1e39cb6ba7ac5f6828ee9c54767eabeedca35a79e7ba49fd17ad20588964f28d06a2dcf8b0446e90f1db41d3fca97d1a9612f6cc5eb816bd9dcdf8a

C:\Users\Admin\AppData\Local\Temp\_MEI22082\python3.DLL

MD5 704d647d6921dbd71d27692c5a92a5fa
SHA1 6f0552ce789dc512f183b565d9f6bf6bf86c229d
SHA256 a1c5c6e4873aa53d75b35c512c1cbadf39315deeec21a3ada72b324551f1f769
SHA512 6b340d64c808388fe95e6d632027715fb5bd801f013debaaa97e5ecb27a6f6ace49bf23648517dd10734daff8f4f44969cff2276010bf7502e79417736a44ec4

C:\Users\Admin\AppData\Local\Temp\_MEI22082\libffi-7.dll

MD5 6f818913fafe8e4df7fedc46131f201f
SHA1 bbb7ba3edbd4783f7f973d97b0b568cc69cadac5
SHA256 3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56
SHA512 5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

memory/1160-172-0x00007FFBEB510000-0x00007FFBEB51F000-memory.dmp

memory/1160-171-0x00007FFBE5E30000-0x00007FFBE5E54000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI22082\_bz2.pyd

MD5 c24b301f99a05305ac06c35f7f50307f
SHA1 0cee6de0ea38a4c8c02bf92644db17e8faa7093b
SHA256 c665f60b1663544facf9a026f5a87c8445558d7794baff56e42e65671d5adc24
SHA512 936d16fea3569a32a9941d58263e951623f4927a853c01ee187364df95cd246b3826e7b8423ac3c265965ee8e491275e908ac9e2d63f3abc5f721add8e20f699

C:\Users\Admin\AppData\Local\Temp\_MEI22082\_lzma.pyd

MD5 215acc93e63fb03742911f785f8de71a
SHA1 d4e3b46db5d4fcdd4f6b6874b060b32a4b676bf9
SHA256 ffdbe11c55010d33867317c0dc2d1bd69f8c07bda0ea0d3841b54d4a04328f63
SHA512 9223a33e8235c566d280a169f52c819a83c3e6fa1f4b8127dde6d4a1b7e940df824ccaf8c0000eac089091fde6ae89f0322fe62e47328f07ea92c7705ace4a72

memory/1160-176-0x00007FFBE1CA0000-0x00007FFBE1CB8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-util-l1-1-0.dll

MD5 8222b0f8bcf884433a55996253963a96
SHA1 35914b003bbe6527e2479d7f897024915821500f
SHA256 7f18dc2971d15434bfe03c4842dced10b466e849d782a1c8e398d96c2e2b12e2
SHA512 5e67b25af8a1f23450cf8807135fea1ec39dfe8ff7cd3858e492ae9e016a23967ed6009da8868cd9dc87d583c3b7e6fb66d00bd48a7bba6b0eea638716514cc6

memory/1160-204-0x00007FFBE1940000-0x00007FFBE196C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-timezone-l1-1-0.dll

MD5 10d466341e7ece8cf75b5d026105741b
SHA1 31d1e9b9a4511156695b5aa33d65b6a36f8139c2
SHA256 5ce391edb33c7055e724a4c3cecc64d16ba2aa4724cb99cd5aed00b0cecfbc82
SHA512 8778fd10c7360bd87db048a2b2ca6603455fd8cb4d0e18709f106b55db7cc92e7d6dc45385ff9def445b368376462e7d253442728d5e759faa97299b67a59e21

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-sysinfo-l1-1-0.dll

MD5 e496d42d228b5e90c7b96350dbb1159c
SHA1 746ba35a931e05aebda957608a6e28c1699237aa
SHA256 1ff617fb9d681551fb456aabaae078c0ac7f96580ac1144ea441826a6d98caef
SHA512 ce555cb7fc0625d7568b002306e203e013f03127aad7383ce26774cb1f1fa820f5fa6145dc9f5930b4d0791631bdbce2ee2e4ee3efa7720b1b2c413ff782e197

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-synch-l1-2-0.dll

MD5 2914ea20c9b8d79b1e98ea6b6dd85450
SHA1 2e25617bb4f3f6391658b5778f5248d9e6762c6b
SHA256 047d09b49dae9a101eb55277aa37c31390ea6c7187379b448122d77bd77bf005
SHA512 c0731aaecbca9b70151e7630e0dbc7d744d534effe56ad703df881f09c7820cb143873dbf95d57357d51be44d53a3b9862d0c6483ca6c70aad01a3f11350abc9

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-synch-l1-1-0.dll

MD5 87c57eddf837c1e7aaaddb451d3d981e
SHA1 5287af84ca9cdfa928355c3c899a43051169a2fd
SHA256 e65305c73e3540491a0c62103764d50d827a13d749f76cb2af593a800c93cf44
SHA512 0900608072d807082087275bd71061f7118534ea20d4cbd9b0e8190f500cd57feabe0bf7f9fac6438a7c4655ac405dd4ec17fd5f1a48b4f5dc70eb25e6f0e8ae

C:\Users\Admin\AppData\Local\Temp\_MEI22082\VCRUNTIME140_1.dll

MD5 135359d350f72ad4bf716b764d39e749
SHA1 2e59d9bbcce356f0fece56c9c4917a5cacec63d7
SHA256 34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32
SHA512 cf23513d63ab2192c78cae98bd3fea67d933212b630be111fa7e03be3e92af38e247eb2d3804437fd0fda70fdc87916cd24cf1d3911e9f3bfb2cc4ab72b459ba

C:\Users\Admin\AppData\Local\Temp\_MEI22082\unicodedata.pyd

MD5 2218b2730b625b1aeee6a67095c101a4
SHA1 aa7f032b9c8b40e5ecf2a0f59fa5ae3f48eff90a
SHA256 5e9add4dd806c2de4d694b9bb038a6716badb7d5f912884d80d593592bcdb8ca
SHA512 77aa10ae645c0ba24e31dcab4726d8fb7aa3cb9708c7c85499e7d82ce46609d43e5dc74da7cd32c170c7ddf50c8db8945baf3452421316c4a46888d745de8da0

C:\Users\Admin\AppData\Local\Temp\_MEI22082\sqlite3.dll

MD5 59ed17799f42cc17d63a20341b93b6f6
SHA1 5f8b7d6202b597e72f8b49f4c33135e35ac76cd1
SHA256 852b38bd2d05dd9f000e540d3f5e4962e64597eb864a68aa8bb28ce7008e91f1
SHA512 3424ad59fd71c68e0af716b7b94c4224b2abfb11b7613f2e565f5d82f630e89c2798e732376a3a0e1266d8d58730b2f76c4e23efe03c47a48cbf5f0fc165d333

C:\Users\Admin\AppData\Local\Temp\_MEI22082\select.pyd

MD5 3cdfdb7d3adf9589910c3dfbe55065c9
SHA1 860ef30a8bc5f28ae9c81706a667f542d527d822
SHA256 92906737eff7ff33b9e2a72d2a86e4bd80a35018c8e40bb79433a8ea8ece3932
SHA512 1fe2c918e9ce524b855d7f38d4c69563f8b8c44291eea1dc98f04e5ebdc39c8f2d658a716429051fb91fed0b912520929a0b980c4f5b4ecb3de1c4eb83749a45

C:\Users\Admin\AppData\Local\Temp\_MEI22082\pyexpat.pyd

MD5 8538fbac3f61a5b042c254adb77c5c86
SHA1 0de293f129476b9c69c2b2ed1d2b7b28a53c653a
SHA256 23fe88f8f17ec20fb9dbcf90fa2b9ed4ca31bab0d69dda1b0feaa561577bdc83
SHA512 84242c1c4aec4a97fe1d5472bd36b4240d7a86f28b4933f46f2b9075521f33e6498944bb95fadcd56ec88a6abe887232fa2d0bfa94a5719e2b1100e90ac9cde1

C:\Users\Admin\AppData\Local\Temp\_MEI22082\libssl-1_1.dll

MD5 7f77a090cb42609f2efc55ddc1ee8fd5
SHA1 ef5a128605654350a5bd17232120253194ad4c71
SHA256 47b63a9370289d2544abc5a479bfb27d707ae7db4f3f7b6cc1a8c8f57fd0cf1f
SHA512 a8a06a1303e76c76d1f06b689e163ba80c1a8137adac80fab0d5c1c6072a69d506e0360d8b44315ef1d88cbd0c9ac95c94d001fad5bc40727f1070734bbbbe63

C:\Users\Admin\AppData\Local\Temp\_MEI22082\libcrypto-1_1.dll

MD5 3cc020baceac3b73366002445731705a
SHA1 6d332ab68dca5c4094ed2ee3c91f8503d9522ac1
SHA256 d1aa265861d23a9b76f16906940d30f3a65c5d0597107ecb3d2e6d470b401bb8
SHA512 1d9b46d0331ed5b95dda8734abe3c0bd6f7fb1ec9a3269feab618d661a1644a0dc3bf8ac91778d5e45406d185965898fe87abd3261a6f7f2968c43515a48562c

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-crt-utility-l1-1-0.dll

MD5 b5c0e86861a795b607b3dddf29ceab01
SHA1 4ece72b0a9d8f42da935f9affe3280b48805d9c1
SHA256 837167faa319cab764615fcfdb375008aed60c399b139dc0b3b0338a106f3b18
SHA512 6ec88fbbbdd3377650bc575da6f1d1a8f94b445bceb6d96894a511b690cd3af63be5df448bc6bcac0e3200086f90cd1707c5b281bacfbbdf7a02f984f3ddf32b

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-crt-time-l1-1-0.dll

MD5 c4af0dc7d97105deac352f569beb603d
SHA1 f52d7ee9ae432dbf5b42d5fb2a816411138d7e03
SHA256 b66ae7e1d0da45a758b2ec9d2727f8f59a2d0a59bf43be347369381338c6afb3
SHA512 8961b1acab372511d45b4cb08f6672bebc436f19c854f73058bb28e56ddd57dfd18aab785b39e0b1254ce9e2989e6db744e1de503429932fce2b0f53f000d91f

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-crt-string-l1-1-0.dll

MD5 03f1e99c4258416b4c6800081b3701e2
SHA1 502d6654cc0a331b8c45eb760db39edbc3ee93c9
SHA256 abf8a6ad52f6c71458dc2c159eb8ce7a297494177f8e05fd52a1e7bceb493426
SHA512 7a1fc6488c4eee4a32963b1e78b76ac1c4d4c196c8b2743ae4cc89805fa02f554210d0fe5a87afa258abe3c24c710315facdea997e7aa2effcf8664b8531c459

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-crt-stdio-l1-1-0.dll

MD5 ce04551e4a578993207eed8f49e045dc
SHA1 f2ea2b8901458263879e76f67c4154559252aa5b
SHA256 f6ba90e21a1e31ff2be7292c2a03d20570788fd829e075ab4a6d37a9ca2ba194
SHA512 872af73065241877679e96dd6c5e8458417436241262829a378768aa47cb290f45aab67ddf205bccd6846a2189a0bd26a31fb01f1d7886fe93067687055f4fe5

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-crt-runtime-l1-1-0.dll

MD5 be6d51793bc63716fb45cb49958b0f6a
SHA1 e2563b2c324b58bad602c46bc4d6148ce5319c10
SHA256 edd8206ef8caf25e955e9fba2c9c8ebf73d8ec3fd0f562372f7ed8b8f7004c2f
SHA512 31fa876b8dc54d882db0d8a3c7e6784b893b6c8b4a04688261720d75402cb4229f07c70df4dabb032b63940d8e3ba95978d439b5f0f9a21c62a8adbcc92bcabe

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-crt-process-l1-1-0.dll

MD5 fa9b5cec8eed4fef73ec60d7f4c1eb1e
SHA1 03f19b2886688de1fb2016d614fe514f8b508250
SHA256 09f19b41a8d71cd5174efdae2a7649022780434d7c4416d6121153359aa85918
SHA512 744288d8903fdceed87cc5b7e0e286fab59584b57acdd943b04c5f6a39391a1662961a686344c1fdce36aea039adf8b1fcfc883e06011dd592077931716cdff7

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-crt-math-l1-1-0.dll

MD5 e6184d65799033dbee51667790130016
SHA1 b00461d14ffa2beab0887bcb716f331090cce8c9
SHA256 eecac10f830ad0dcbdf0f0dc1422ef5cfed490a877429a4674aecc560869a5e5
SHA512 987c14f8c22ae0d6c1005cc7b0d9a240283c2120e8ded030a407f25fb7786f7283980850ca243859f0148dbeb7bfaec01c8208865b81046999252d07e5f42d53

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-crt-locale-l1-1-0.dll

MD5 3cca955cde8362605fc268e4b12accaa
SHA1 6f3c214ef223f35495c0cb0ee359b9d975c14e72
SHA256 34c6e58abcce5bccace50df3bd6c3e2d3f4e8413b14aae8e707ddfddccdeba6d
SHA512 5b7fe7deb6066c53bd41479172eac2736301f5cf32921f13d2ce6ad2811925e7bc1c436627698050be86ddf18852eeac927be4efc2182d857b31f637adc6c206

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-crt-heap-l1-1-0.dll

MD5 e3ede68927c68aa73ac95722d24334ce
SHA1 dbe71e1a56f9b7569b4a568bb67e37c38011b879
SHA256 5dd42e524920f4cb467031eb9e0e440bbe73de0fb39f71e65736a2ab2f6fcfe8
SHA512 d935058d8409b518d82336dc0b1521bf411ef77ef49485ede15baf5d1ac527f46ad813ebdb889c0f9999d553a879150d5ba41ce3a0b11d5ca08907e378fc9b8d

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 3491700e847fb9e9c4413fc82a0ad285
SHA1 03694cd43a06bb2fff6a1d85f73bd7b87198e07e
SHA256 ed969fae3cf64f46b5f4d2447980befd6f0a7fd05802529dbc793f3c014bc46c
SHA512 07e81eabcef621ec6a84e1932e299e0b865c06e6f9907017bbed0121771712b007a18771099131f24da134f3cbff0a7af30ca4e1c262b117e8bacf055cd54002

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-crt-environment-l1-1-0.dll

MD5 16a97489dab15db9b9713c53726f3411
SHA1 c15ad01807955374283805104233bd56760b25c9
SHA256 9c06541d13c7088f313aab0be5af20b72e583f34e442df3d2fc29953640d4812
SHA512 54ffa278e4d0975830c1a8eff9b7fc41d487cd9e8390d0e14f58cff62efadfc5816bcda3ca11e2b1cbaeecb20546839593f7c6ea9500eef433f299861d205822

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-crt-convert-l1-1-0.dll

MD5 4bb011d3e58e958e94ca23ae05a8e958
SHA1 741af22136c1d6dce03c75c68e977c05d76ac027
SHA256 06b0fd7e6d7cbe35177af8fc17863f247bd5caee64543e3a9a125253d51af777
SHA512 07668515aa4099c390ce30ef3415e412113483da792d7cd02bb3ddce561719e808d6be81b90d599f4a7fa50ba27382c8d84ecb45292200bba7094a5204ff7715

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-crt-conio-l1-1-0.dll

MD5 5bc2660d94760af50f96b1999de6cfab
SHA1 75dec9b15bf9181f0e8015992b678bac718d8c0b
SHA256 03bebf73df97beed5da608cae73324df2aaec092277d53ce8c119031cf8e21fd
SHA512 7e9c67b5e46b35ba3f733110cf7fe35ac9dc1b41a4f7633180cd69631d1b82bcac99f8b94b6f36a373f72bc4fd7eeaac21a8fb51830914a32e19d738208ca636

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-string-l1-1-0.dll

MD5 2ebacbbda70b888b1bcc5e816d14f3a2
SHA1 ebf1763b0cee267040312deccb3dad61af1b9cf4
SHA256 96b11fa8aca734f4b1ddee377c84427d384f8e06affd99c63128797289fc9304
SHA512 af15fc2b1ff31a3550ae4e9ae45f7bbe728d839b288d6dc5f04859e27463ed946d5b2619736223ae401cee504e683b9fe9dffb65754280644dda91527eb46c5e

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-rtlsupport-l1-1-0.dll

MD5 8aad6a3a2fe9052ef218d5c8ce1995e1
SHA1 33748750e57cdc165fcdd186ae53003649607221
SHA256 e44d56d10ee14d4c4767a25839c2ef6826adbea3e15c2705b1d79676a63905b4
SHA512 841c70c63b243dea68c2ac9cd886731b6171dcf76a60932191fb29402585d6bbfcc98d11868fc6032f08c29d8e0040a2b896c32c2fb4697bd54dea2a52589ae6

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-profile-l1-1-0.dll

MD5 fb731a1f96c9e34347cba5bb18e54581
SHA1 88a62edfbbd806b1043b4a1266c4708e1d47be1d
SHA256 c4c1d381f419731c848e4a20aef02a4436758935c9a274896228b9451956cc8e
SHA512 be6c94d6015edae41fa0d6464c7dc5976adbc3617e02b293b9a39e645ec173071f1f282959ddf264a133ce3b3bb9c434eb2e65fc607136f11d8eb07538168ffc

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-processthreads-l1-1-1.dll

MD5 a6776c201baae1dd6f88048d7747d14c
SHA1 646119d2e440e6dad0ffb0fe449ab4fc27f09fbe
SHA256 ee99af71c347ff53c4e15109cb597759e657a3e859d9530680eeea8bb0540112
SHA512 a9137af8529fd96dbba22c5179a16d112ec0bfab9792babe0a9f1cca27408eff73ba89f498cb5f941a5aa44555529ee10484e6ca4a3fbf1627523acfde622b45

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-processthreads-l1-1-0.dll

MD5 abaabc1df36c7a0674f20fb83247fd71
SHA1 345db0ffea0cb2531b79d464ad69347ac71ee2b9
SHA256 ba55f8481d8a9d225b8c430eb010f675250c5afa64d9eeb15ff31dc159a19f5a
SHA512 7c01b8f46e9fbe08784066a9df03723b3485fa714f22f4ab7e1cbe719b0a91ab1a5d597ef9d567836375de929ea9397ce0685f00b908f3d0aa4d0288eb59f7ba

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-processenvironment-l1-1-0.dll

MD5 6d0762a2ba4263d0901ca7aaa0725c0c
SHA1 e36d2d049116bd2d84121cdfa179098ac03650b4
SHA256 2ee9434cc5f40f4514c7284e14b90db5c7a33000afda834d7c1dc063baa3d805
SHA512 94616b2bfc0497ca2dbbc23c1aa4ecb04113a53d75fa570f6bb5e2561e5cdb940792e2cb290562133d226400c78d91377fdd312ba2858679084c66ff1ae9031d

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-namedpipe-l1-1-0.dll

MD5 7e751952f122f4e8be1317087dc9dc71
SHA1 f65884c8cfbb8ad565b3df3a51af11b1617c7092
SHA256 d078a9a9958a7c816dea989bef24f32befc6651aea5e07f97a7b5d50df73f799
SHA512 960922ac1309bdcf42d6900a0bea30d4096d1411ec6a97f328520d4a59f71fc04e6f4a7b8d2b346012530329f76897607369c8e1ed1fe9c589d7f7682987c043

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-memory-l1-1-0.dll

MD5 41e0b7cb0eecba317cf321b1ada084d7
SHA1 4ce1f13188fc00eb29c726717eae489c524c1c8a
SHA256 db978830b1fbcc0521582a6a79864b0fd83179248fa374926c8097bc02cd6383
SHA512 f0961cde8dc83b845b2b91e42436ed8b42d2fb19caaabf49b300fa9cbbae9fab84009b4714c3899ab4a703315a135a61e508db29239d823a1cc11462ce6ffab7

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-localization-l1-2-0.dll

MD5 4c26932f8f1f490017add31f5ec0a533
SHA1 0da01a7c89b506fe3fd939344bb51b976efb3207
SHA256 dd3843c2e46b4e926c36150d614efe02ca0ebc1f767f64f471568adc35c2ef23
SHA512 eb2b87d187991fdc8e3a6577f20622d2d4a2a994dd375d8c27e1434ce786596533eacfbde8714db9959d88d6bcb91fdc8079c60c23f0eb920ba45c546a44e523

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-libraryloader-l1-1-0.dll

MD5 259b4186004bb41e706dd781e29f5c5b
SHA1 85751d31fe233ed51c46466f214f497d01be8d87
SHA256 b3ba83880986f2522d05a88c52fe69eda9c9fadbc5192a063e36bba777cc877f
SHA512 f8a06252e96f40965668c978c4808305d424de698f47f420643d713751926636f2049dd34c8156ba5bbbf5a5b2f4d5c19a978cf27d3aaebd728d7a3de8f0afa2

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-interlocked-l1-1-0.dll

MD5 0b65672b91c6a12d769dd777f810b149
SHA1 2d527b45dcbe653a91e10365891c7e589f5e51e0
SHA256 c09eb307b2eb747b73c516267a99a23bb73204452326d41bdeb6f43598f6d62e
SHA512 f090bb0b8f3616cf2d77ff25523bc823918e1452f626a1298c95003def1867c785566a4e85ccd7f5a20f14631caec5dd392777db2d00368c3fdf3597e0f51788

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-heap-l1-1-0.dll

MD5 993b5bc35dac959bed58b77fe42ac77a
SHA1 2abad159cbab86ff423d6446143427daab751366
SHA256 b998ff8d173c34505e1d5984134282866de910b09919cf9a322fce760b75c80b
SHA512 ca19e949dcc8460af53c9dad17995a0cbffd971bb731b7fcb53bb9384d227357926231c9fadfaa5aef09055bebae9d5c23ee73eb6eca04d6a52a3df0847e10ab

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-handle-l1-1-0.dll

MD5 4166d703abc9c6de65d5b269d3a5425e
SHA1 16bcd7191312b94bdf38368d188e5a5cc479a36c
SHA256 0a351c2a2889a42886017e7dbcf75f45e3cb24d2f55e72205624272487e4a056
SHA512 f722dba410cab727c753e9cce0bc47663e22f45828f5df0bac5bd6331497a2f15f6d9330b5203d3ff735f1ce6397e63c1b21d3ea6c5ceab817b5f83ec296882b

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-file-l2-1-0.dll

MD5 50abf0a7ee67f00f247bada185a7661c
SHA1 0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1
SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
SHA512 c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-file-l1-2-0.dll

MD5 4a060eec454c222a5381cd359dc00b81
SHA1 21e1bc115d04a74779e955ea16a16bd71454d9bb
SHA256 e6b2b05e14a6c6f5381e8f4c7f4fd28a499246fb4c8eafe1f08014b9273d70df
SHA512 16fb1f4ccdad05d07feb62e0cd078401f4023f9fab0fb15e52b927ca413e65eb32c2932ba59dbfa7f7ee0e8a8053748e27f2757e82e600db812271aa44a9433c

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-file-l1-1-0.dll

MD5 4b328f140a3ae7fedb21ca50cc23d938
SHA1 9e71b4c2cf030a644d2050188c4b77e638c0ee14
SHA256 e55b200643e8b078e7f5eb0c97de44fead21b11d06590ebedbcb84214d063345
SHA512 4c349f45ca4db4f1247aa405e5627f22b7ccfe66234d8d970475e71471ebb251f7a0f781a33d0e4ec893f86653b0a1c8508adf576e923d0ce86b43f552204614

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-fibers-l1-1-0.dll

MD5 201ff3cd2ffe7d222f46574d4ac40a70
SHA1 b43f19bbb8fd1c8aa05ba67dea38a7785dbe57b6
SHA256 b83a71978215fdba477c4ea61340168947a1021324d118e6b7159054985f2d1a
SHA512 3f99d7b501c1db470a6d91af856ebbede05522acb5763d928f4fb28c74db2339b46df108745ed8ebd8c6c1298d9495358c245d188f055638b0d6dd568fa596d2

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-errorhandling-l1-1-0.dll

MD5 12ea48ce605ebb204a21ae7d86db3417
SHA1 5fb0ff9ba4105cd76ee4470ae4cad0a39ae68c66
SHA256 189bbbd739526a986e53518865e741cde8c5967aacd5ed687408cec3d8781f1c
SHA512 39b486fb72c9dff4e391673a872e957dbf0545d4d26914d0b0a475624e40b4feec3a9a17549e87ba806b1a90bf6f7784a187c506daa1db5201561cef90ff6e81

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-debug-l1-1-0.dll

MD5 7ad2034acd0f296fe9eed320e5ad7591
SHA1 fe1b217e3f4567905968f7a3d48a7611e3cf3f7b
SHA256 0d859a866d1bcefe1a1bc5adb88dcf2765567ecc31dfb4e472b512d033d88bb4
SHA512 06d017b0ef9d081bc627f7f33d51ef2fe64e2cc5023204771032c4ed7bf26c0c6106b69d78f7bdd880fa59e8e4048b2da8848784bc92d7780155df140c952420

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-datetime-l1-1-0.dll

MD5 854458ad55c39a9dfd1e350a51be02b8
SHA1 5013cf58de5a0b55e026ace967e9842b3b131c2a
SHA256 f918b0c45f59b2cb29f1eb3653d2f2679095e85e082a1198c933a76edf1f33ef
SHA512 faa41a5031033f7e86efebc47777f915e95617f4b05d93833066c206d9c092855d8072c7bd142898f5a2bd1f94b646d98933302ddeb5a9ca0d5930c7b2241b98

C:\Users\Admin\AppData\Local\Temp\_MEI22082\api-ms-win-core-console-l1-1-0.dll

MD5 9313c86e7bae859f0174a1c8b6aba58b
SHA1 dce67fd1da5da8dc4ba406c544e55a83d6536cc9
SHA256 af9675ac90bae8a0d8623f6fdaff9d39e1b8810e8e46a5b044baaa3396e745b3
SHA512 2ec64fce4a86bc52dc6c485fd94d203020617df92698ca91ae25c4901984899e21c7dd92881ec52d6850edfa547701aab9b0cd1b8d076e6779b1a13324cdd3a4

memory/1160-225-0x00007FFBE1750000-0x00007FFBE1769000-memory.dmp

memory/1160-226-0x00007FFBE20C0000-0x00007FFBE20CD000-memory.dmp

memory/1160-227-0x00007FFBD2590000-0x00007FFBD29F5000-memory.dmp

memory/1160-228-0x00007FFBDD070000-0x00007FFBDD0A5000-memory.dmp

memory/1160-229-0x00007FFBE1C90000-0x00007FFBE1C9D000-memory.dmp

memory/1160-231-0x00007FFBE12D0000-0x00007FFBE12E5000-memory.dmp

memory/1160-230-0x00007FFBE5E30000-0x00007FFBE5E54000-memory.dmp

memory/1160-232-0x00007FFBD2210000-0x00007FFBD2587000-memory.dmp

memory/1160-233-0x00007FFBD79D0000-0x00007FFBD79FE000-memory.dmp

memory/1160-234-0x00007FFBD2150000-0x00007FFBD2207000-memory.dmp

memory/1160-236-0x00007FFBD1FD0000-0x00007FFBD2141000-memory.dmp

memory/1160-235-0x00007FFBDCCF0000-0x00007FFBDCD0E000-memory.dmp

memory/1160-237-0x00007FFBE1750000-0x00007FFBE1769000-memory.dmp

memory/1160-238-0x00007FFBDCCD0000-0x00007FFBDCCE8000-memory.dmp

memory/1160-240-0x00007FFBD2A00000-0x00007FFBD2A26000-memory.dmp

memory/1160-239-0x00007FFBDF970000-0x00007FFBDF97B000-memory.dmp

memory/1160-241-0x00007FFBD18F0000-0x00007FFBD1A08000-memory.dmp

memory/1160-243-0x00007FFBE1AE0000-0x00007FFBE1B17000-memory.dmp

memory/1160-242-0x00007FFBE12D0000-0x00007FFBE12E5000-memory.dmp

memory/1160-244-0x00007FFBD2210000-0x00007FFBD2587000-memory.dmp

memory/1160-246-0x00007FFBE1AD0000-0x00007FFBE1ADC000-memory.dmp

memory/1160-245-0x00007FFBE9790000-0x00007FFBE979B000-memory.dmp

memory/1160-249-0x00007FFBE1AA0000-0x00007FFBE1AAB000-memory.dmp

memory/1160-255-0x00007FFBDB160000-0x00007FFBDB16B000-memory.dmp

memory/1160-259-0x00007FFBD79D0000-0x00007FFBD79FE000-memory.dmp

memory/1160-258-0x00007FFBE9780000-0x00007FFBE978B000-memory.dmp

memory/1160-257-0x00007FFBD9020000-0x00007FFBD902B000-memory.dmp

memory/1160-256-0x00007FFBD9030000-0x00007FFBD903C000-memory.dmp

memory/1160-254-0x00007FFBDE430000-0x00007FFBDE43B000-memory.dmp

memory/1160-261-0x00007FFBD8FE0000-0x00007FFBD8FEC000-memory.dmp

memory/1160-260-0x00007FFBD9010000-0x00007FFBD901D000-memory.dmp

memory/1160-264-0x00007FFBDCCF0000-0x00007FFBDCD0E000-memory.dmp

memory/1160-263-0x00007FFBD8FF0000-0x00007FFBD9002000-memory.dmp

memory/1160-262-0x00007FFBD2150000-0x00007FFBD2207000-memory.dmp

memory/1160-265-0x00007FFBD1FD0000-0x00007FFBD2141000-memory.dmp

memory/1160-253-0x00007FFBE1A60000-0x00007FFBE1A6C000-memory.dmp

memory/1160-252-0x00007FFBE1A70000-0x00007FFBE1A7E000-memory.dmp

memory/1160-251-0x00007FFBE1A80000-0x00007FFBE1A8D000-memory.dmp

memory/1160-250-0x00007FFBE1A90000-0x00007FFBE1A9C000-memory.dmp

memory/1160-248-0x00007FFBE1AB0000-0x00007FFBE1ABC000-memory.dmp

memory/1160-247-0x00007FFBE1AC0000-0x00007FFBE1ACB000-memory.dmp

memory/1160-266-0x0000000070200000-0x00000000720F8000-memory.dmp

memory/1160-267-0x00007FFBD1630000-0x00007FFBD18EB000-memory.dmp

memory/1160-268-0x00007FFBD3650000-0x00007FFBD3669000-memory.dmp

memory/1160-271-0x00007FFBD2C20000-0x00007FFBD2C43000-memory.dmp

memory/1160-270-0x00007FFBD2C50000-0x00007FFBD2C71000-memory.dmp

memory/1160-269-0x00007FFBD2A00000-0x00007FFBD2A26000-memory.dmp

memory/1160-274-0x00007FFBD2B90000-0x00007FFBD2C1F000-memory.dmp

memory/1160-273-0x00007FFBD18F0000-0x00007FFBD1A08000-memory.dmp

memory/1160-272-0x00007FFBD2B60000-0x00007FFBD2B8B000-memory.dmp

memory/1160-276-0x00007FFBD2B20000-0x00007FFBD2B51000-memory.dmp

memory/1160-275-0x00007FFBE1AE0000-0x00007FFBE1B17000-memory.dmp

memory/1160-287-0x00007FFBD2AE0000-0x00007FFBD2B1E000-memory.dmp

memory/1160-286-0x00007FFBD0F70000-0x00007FFBD0F9E000-memory.dmp

memory/1160-285-0x00007FFBD0FA0000-0x00007FFBD0FC9000-memory.dmp

memory/1160-284-0x00007FFBD88B0000-0x00007FFBD88BA000-memory.dmp

memory/1160-283-0x00007FFBD0FD0000-0x00007FFBD1218000-memory.dmp

memory/1160-282-0x00007FFBD1220000-0x00007FFBD12C6000-memory.dmp

memory/1160-281-0x00007FFBD12D0000-0x00007FFBD12E3000-memory.dmp

memory/1160-280-0x00007FFBD12F0000-0x00007FFBD130A000-memory.dmp

memory/1160-279-0x00007FFBD2AA0000-0x00007FFBD2AB7000-memory.dmp

memory/1160-278-0x00007FFBD2AC0000-0x00007FFBD2AD9000-memory.dmp

memory/1160-277-0x0000000070200000-0x00000000720F8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u4f03kek.syc.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1884-314-0x000002C269E70000-0x000002C269E92000-memory.dmp

memory/1160-340-0x00007FFBD1FD0000-0x00007FFBD2141000-memory.dmp

memory/1160-345-0x00007FFBE1AE0000-0x00007FFBE1B17000-memory.dmp

memory/1160-341-0x00007FFBDCCD0000-0x00007FFBDCCE8000-memory.dmp

memory/1160-339-0x00007FFBDCCF0000-0x00007FFBDCD0E000-memory.dmp

memory/1160-337-0x00007FFBD79D0000-0x00007FFBD79FE000-memory.dmp

memory/1160-326-0x00007FFBD2590000-0x00007FFBD29F5000-memory.dmp

memory/1160-334-0x00007FFBE1C90000-0x00007FFBE1C9D000-memory.dmp

memory/1160-327-0x00007FFBE5E30000-0x00007FFBE5E54000-memory.dmp

memory/1160-369-0x00007FFBD1630000-0x00007FFBD18EB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ElKG7nOikm\Browser\history.txt

MD5 5638715e9aaa8d3f45999ec395e18e77
SHA1 4e3dc4a1123edddf06d92575a033b42a662fe4ad
SHA256 4db7f6559c454d34d9c2d557524603c3f52649c2d69b26b6e8384a3d179aeae6
SHA512 78c96efab1d941e34d3137eae32cef041e2db5b0ebbf883e6a2effa79a323f66e00cfb7c45eb3398b3cbd0469a2be513c3ff63e5622261857eefc1685f77f76b

C:\Users\Admin\AppData\Local\Temp\ElKG7nOikm\Browser\cc's.txt

MD5 5aa796b6950a92a226cc5c98ed1c47e8
SHA1 6706a4082fc2c141272122f1ca424a446506c44d
SHA256 c4c83da3a904a4e7114f9bd46790db502cdd04800e684accb991cd1a08ee151c
SHA512 976f403257671e8f652bf988f4047202e1a0fd368fdb2bab2e79ece1c20c7eb775c4b3a8853c223d4f750f4192cd09455ff024918276dc1dd1442fa3b36623ad

memory/1160-390-0x00007FFBD2B60000-0x00007FFBD2B8B000-memory.dmp

memory/1160-391-0x00007FFBD2B90000-0x00007FFBD2C1F000-memory.dmp

memory/1160-393-0x00007FFBD0820000-0x00007FFBD082F000-memory.dmp

memory/1160-408-0x00007FFBD79D0000-0x00007FFBD79FE000-memory.dmp

memory/1160-416-0x00007FFBE1AE0000-0x00007FFBE1B17000-memory.dmp

memory/1160-418-0x00007FFBE5E30000-0x00007FFBE5E54000-memory.dmp

memory/1160-417-0x00007FFBEB510000-0x00007FFBEB51F000-memory.dmp

memory/1160-431-0x00007FFBD1220000-0x00007FFBD12C6000-memory.dmp

memory/1160-435-0x00007FFBD0F70000-0x00007FFBD0F9E000-memory.dmp

memory/1160-434-0x00007FFBD0FA0000-0x00007FFBD0FC9000-memory.dmp

memory/1160-433-0x00007FFBD88B0000-0x00007FFBD88BA000-memory.dmp

memory/1160-432-0x00007FFBD0FD0000-0x00007FFBD1218000-memory.dmp

memory/1160-430-0x00007FFBD12D0000-0x00007FFBD12E3000-memory.dmp

memory/1160-429-0x00007FFBD12F0000-0x00007FFBD130A000-memory.dmp

memory/1160-428-0x00007FFBD2AA0000-0x00007FFBD2AB7000-memory.dmp

memory/1160-427-0x00007FFBD2AC0000-0x00007FFBD2AD9000-memory.dmp

memory/1160-426-0x00007FFBD2AE0000-0x00007FFBD2B1E000-memory.dmp

memory/1160-425-0x00007FFBD2B20000-0x00007FFBD2B51000-memory.dmp

memory/1160-424-0x00007FFBD2B60000-0x00007FFBD2B8B000-memory.dmp

memory/1160-423-0x00007FFBD2B90000-0x00007FFBD2C1F000-memory.dmp

memory/1160-422-0x00007FFBD2C50000-0x00007FFBD2C71000-memory.dmp

memory/1160-421-0x00007FFBD3650000-0x00007FFBD3669000-memory.dmp

memory/1160-420-0x00007FFBD2C20000-0x00007FFBD2C43000-memory.dmp

memory/1160-419-0x00007FFBD1630000-0x00007FFBD18EB000-memory.dmp

memory/1160-415-0x00007FFBD18F0000-0x00007FFBD1A08000-memory.dmp

memory/1160-414-0x00007FFBD2A00000-0x00007FFBD2A26000-memory.dmp

memory/1160-413-0x00007FFBDF970000-0x00007FFBDF97B000-memory.dmp

memory/1160-412-0x00007FFBDCCD0000-0x00007FFBDCCE8000-memory.dmp

memory/1160-410-0x00007FFBDCCF0000-0x00007FFBDCD0E000-memory.dmp

memory/1160-409-0x00007FFBD2150000-0x00007FFBD2207000-memory.dmp

memory/1160-407-0x00007FFBD2210000-0x00007FFBD2587000-memory.dmp

memory/1160-406-0x00007FFBE12D0000-0x00007FFBE12E5000-memory.dmp

memory/1160-405-0x00007FFBE1C90000-0x00007FFBE1C9D000-memory.dmp

memory/1160-437-0x00007FFBD0820000-0x00007FFBD082F000-memory.dmp

memory/1160-436-0x0000000070200000-0x00000000720F8000-memory.dmp

memory/1160-403-0x00007FFBE20C0000-0x00007FFBE20CD000-memory.dmp

memory/1160-402-0x00007FFBE1750000-0x00007FFBE1769000-memory.dmp

memory/1160-401-0x00007FFBE1940000-0x00007FFBE196C000-memory.dmp

memory/1160-400-0x00007FFBE1CA0000-0x00007FFBE1CB8000-memory.dmp

memory/1160-411-0x00007FFBD1FD0000-0x00007FFBD2141000-memory.dmp

memory/1160-397-0x00007FFBD2590000-0x00007FFBD29F5000-memory.dmp

memory/1160-404-0x00007FFBDD070000-0x00007FFBDD0A5000-memory.dmp