Analysis

  • max time kernel
    56s
  • max time network
    57s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-12-2024 17:42

General

Malware Config

Signatures

  • Exela Stealer

    Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.

  • Exelastealer family
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 32 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

  • Enumerates processes with tasklist 1 TTPs 4 IoCs
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Detects Pyinstaller 1 IoCs
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • System Network Connections Discovery 1 TTPs 1 IoCs

    Attempt to get a listing of network connections.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Collects information from the system 1 TTPs 1 IoCs

    Uses WMIC.exe to find detailed system information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 12 IoCs
  • Modifies registry class 2 IoCs
  • NTFS ADS 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://gofile.io/d/a29i84"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5016
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://gofile.io/d/a29i84
      2⤵
      • Subvert Trust Controls: Mark-of-the-Web Bypass
      • Checks processor information in registry
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3672
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1960 -prefMapHandle 1952 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9cd05895-399e-47b4-a408-b21f227480e8} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" gpu
        3⤵
          PID:3504
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2440 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5446b98-5410-47c7-9a65-f4786315323f} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" socket
          3⤵
            PID:4888
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3136 -childID 1 -isForBrowser -prefsHandle 1788 -prefMapHandle 3132 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1818c070-97f5-4aed-ab8d-a8a713c3efb2} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" tab
            3⤵
              PID:1008
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3756 -childID 2 -isForBrowser -prefsHandle 3672 -prefMapHandle 3664 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e606912b-4b17-4ce0-9e66-ef159ac1cf0f} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" tab
              3⤵
                PID:316
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4620 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4612 -prefMapHandle 4608 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc6c446a-c1d1-42b7-9e3c-18b242efa293} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" utility
                3⤵
                • Checks processor information in registry
                PID:4244
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5352 -childID 3 -isForBrowser -prefsHandle 5324 -prefMapHandle 5340 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {efd252ed-2c69-4cc6-a76d-850bae5e8455} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" tab
                3⤵
                  PID:3952
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5516 -childID 4 -isForBrowser -prefsHandle 5500 -prefMapHandle 5412 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1595d23f-2d30-4f1d-977e-f081df7ce776} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" tab
                  3⤵
                    PID:2204
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5800 -childID 5 -isForBrowser -prefsHandle 5720 -prefMapHandle 5724 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9cfabc08-fc7d-42dc-8183-d521450b97fa} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" tab
                    3⤵
                      PID:4388
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6024 -childID 6 -isForBrowser -prefsHandle 6072 -prefMapHandle 6060 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {894fc949-56d8-41ee-9898-0ef2b160d39a} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" tab
                      3⤵
                        PID:4648
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3592 -childID 7 -isForBrowser -prefsHandle 3792 -prefMapHandle 2776 -prefsLen 30493 -prefMapSize 244658 -jsInitHandle 968 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3ab70a7-cccf-48f7-a928-3f58d01eb23f} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" tab
                        3⤵
                          PID:5364
                    • C:\Windows\System32\rundll32.exe
                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                      1⤵
                        PID:3548
                      • C:\Users\Admin\Downloads\RippleSpoofer.exe
                        "C:\Users\Admin\Downloads\RippleSpoofer.exe"
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Enumerates system info in registry
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4500
                        • C:\Windows\SYSTEM32\taskkill.exe
                          "taskkill" /F /IM explorer.exe
                          2⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:6092
                        • C:\Users\Admin\AppData\Local\Temp\TempAppFiles\mac.exe
                          "C:\Users\Admin\AppData\Local\Temp\TempAppFiles\mac.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:5220
                          • C:\Users\Admin\AppData\Local\Temp\TempAppFiles\mac.exe
                            "C:\Users\Admin\AppData\Local\Temp\TempAppFiles\mac.exe"
                            3⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:5376
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "ver"
                              4⤵
                                PID:4408
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                4⤵
                                  PID:5468
                                  • C:\Windows\System32\Wbem\WMIC.exe
                                    wmic csproduct get uuid
                                    5⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:6116
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "tasklist"
                                  4⤵
                                    PID:4024
                                    • C:\Windows\system32\tasklist.exe
                                      tasklist
                                      5⤵
                                      • Enumerates processes with tasklist
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4292
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
                                    4⤵
                                    • Hide Artifacts: Hidden Files and Directories
                                    PID:3572
                                    • C:\Windows\system32\attrib.exe
                                      attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
                                      5⤵
                                      • Views/modifies file attributes
                                      PID:3724
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "tasklist"
                                    4⤵
                                      PID:3588
                                      • C:\Windows\system32\tasklist.exe
                                        tasklist
                                        5⤵
                                        • Enumerates processes with tasklist
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3536
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3672"
                                      4⤵
                                        PID:4196
                                        • C:\Windows\system32\taskkill.exe
                                          taskkill /F /PID 3672
                                          5⤵
                                          • Kills process with taskkill
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:5268
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3504"
                                        4⤵
                                          PID:5296
                                          • C:\Windows\system32\taskkill.exe
                                            taskkill /F /PID 3504
                                            5⤵
                                            • Kills process with taskkill
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2756
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4888"
                                          4⤵
                                            PID:1700
                                            • C:\Windows\system32\taskkill.exe
                                              taskkill /F /PID 4888
                                              5⤵
                                              • Kills process with taskkill
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3912
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1008"
                                            4⤵
                                              PID:5400
                                              • C:\Windows\system32\taskkill.exe
                                                taskkill /F /PID 1008
                                                5⤵
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:5508
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "taskkill /F /PID 316"
                                              4⤵
                                                PID:5544
                                                • C:\Windows\system32\taskkill.exe
                                                  taskkill /F /PID 316
                                                  5⤵
                                                  • Kills process with taskkill
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:5684
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4244"
                                                4⤵
                                                  PID:5556
                                                  • C:\Windows\system32\taskkill.exe
                                                    taskkill /F /PID 4244
                                                    5⤵
                                                    • Kills process with taskkill
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:5720
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3952"
                                                  4⤵
                                                    PID:5788
                                                    • C:\Windows\system32\taskkill.exe
                                                      taskkill /F /PID 3952
                                                      5⤵
                                                      • Kills process with taskkill
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:5916
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2204"
                                                    4⤵
                                                      PID:4020
                                                      • C:\Windows\system32\taskkill.exe
                                                        taskkill /F /PID 2204
                                                        5⤵
                                                        • Kills process with taskkill
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:5728
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4388"
                                                      4⤵
                                                        PID:5964
                                                        • C:\Windows\system32\taskkill.exe
                                                          taskkill /F /PID 4388
                                                          5⤵
                                                          • Kills process with taskkill
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:6064
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4648"
                                                        4⤵
                                                          PID:6124
                                                          • C:\Windows\system32\taskkill.exe
                                                            taskkill /F /PID 4648
                                                            5⤵
                                                            • Kills process with taskkill
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:6060
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5364"
                                                          4⤵
                                                            PID:5188
                                                            • C:\Windows\system32\taskkill.exe
                                                              taskkill /F /PID 5364
                                                              5⤵
                                                              • Kills process with taskkill
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1712
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
                                                            4⤵
                                                              PID:724
                                                              • C:\Windows\system32\cmd.exe
                                                                cmd.exe /c chcp
                                                                5⤵
                                                                  PID:1772
                                                                  • C:\Windows\system32\chcp.com
                                                                    chcp
                                                                    6⤵
                                                                      PID:4104
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
                                                                  4⤵
                                                                    PID:4276
                                                                    • C:\Windows\system32\cmd.exe
                                                                      cmd.exe /c chcp
                                                                      5⤵
                                                                        PID:3948
                                                                        • C:\Windows\system32\chcp.com
                                                                          chcp
                                                                          6⤵
                                                                            PID:3592
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                        4⤵
                                                                          PID:1144
                                                                          • C:\Windows\system32\tasklist.exe
                                                                            tasklist /FO LIST
                                                                            5⤵
                                                                            • Enumerates processes with tasklist
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:1020
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
                                                                          4⤵
                                                                          • Clipboard Data
                                                                          PID:4612
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell.exe Get-Clipboard
                                                                            5⤵
                                                                            • Clipboard Data
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:4696
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
                                                                          4⤵
                                                                          • Network Service Discovery
                                                                          PID:1496
                                                                          • C:\Windows\system32\systeminfo.exe
                                                                            systeminfo
                                                                            5⤵
                                                                            • Gathers system information
                                                                            PID:5032
                                                                          • C:\Windows\system32\HOSTNAME.EXE
                                                                            hostname
                                                                            5⤵
                                                                              PID:5888
                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                              wmic logicaldisk get caption,description,providername
                                                                              5⤵
                                                                              • Collects information from the system
                                                                              PID:5908
                                                                            • C:\Windows\system32\net.exe
                                                                              net user
                                                                              5⤵
                                                                                PID:1252
                                                                                • C:\Windows\system32\net1.exe
                                                                                  C:\Windows\system32\net1 user
                                                                                  6⤵
                                                                                    PID:3460
                                                                                • C:\Windows\system32\query.exe
                                                                                  query user
                                                                                  5⤵
                                                                                    PID:3844
                                                                                    • C:\Windows\system32\quser.exe
                                                                                      "C:\Windows\system32\quser.exe"
                                                                                      6⤵
                                                                                        PID:1228
                                                                                    • C:\Windows\system32\net.exe
                                                                                      net localgroup
                                                                                      5⤵
                                                                                        PID:5820
                                                                                        • C:\Windows\system32\net1.exe
                                                                                          C:\Windows\system32\net1 localgroup
                                                                                          6⤵
                                                                                            PID:2580
                                                                                        • C:\Windows\system32\net.exe
                                                                                          net localgroup administrators
                                                                                          5⤵
                                                                                            PID:3676
                                                                                            • C:\Windows\system32\net1.exe
                                                                                              C:\Windows\system32\net1 localgroup administrators
                                                                                              6⤵
                                                                                                PID:4172
                                                                                            • C:\Windows\system32\net.exe
                                                                                              net user guest
                                                                                              5⤵
                                                                                                PID:888
                                                                                                • C:\Windows\system32\net1.exe
                                                                                                  C:\Windows\system32\net1 user guest
                                                                                                  6⤵
                                                                                                    PID:2400
                                                                                                • C:\Windows\system32\net.exe
                                                                                                  net user administrator
                                                                                                  5⤵
                                                                                                    PID:3612
                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                      C:\Windows\system32\net1 user administrator
                                                                                                      6⤵
                                                                                                        PID:1612
                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                      wmic startup get caption,command
                                                                                                      5⤵
                                                                                                        PID:4516
                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                        tasklist /svc
                                                                                                        5⤵
                                                                                                        • Enumerates processes with tasklist
                                                                                                        PID:5244
                                                                                                      • C:\Windows\system32\ipconfig.exe
                                                                                                        ipconfig /all
                                                                                                        5⤵
                                                                                                        • Gathers network information
                                                                                                        PID:2540
                                                                                                      • C:\Windows\system32\ROUTE.EXE
                                                                                                        route print
                                                                                                        5⤵
                                                                                                          PID:4336
                                                                                                        • C:\Windows\system32\ARP.EXE
                                                                                                          arp -a
                                                                                                          5⤵
                                                                                                          • Network Service Discovery
                                                                                                          PID:2172
                                                                                                        • C:\Windows\system32\NETSTAT.EXE
                                                                                                          netstat -ano
                                                                                                          5⤵
                                                                                                          • System Network Connections Discovery
                                                                                                          • Gathers network information
                                                                                                          PID:2840
                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                          sc query type= service state= all
                                                                                                          5⤵
                                                                                                          • Launches sc.exe
                                                                                                          PID:2036
                                                                                                        • C:\Windows\system32\netsh.exe
                                                                                                          netsh firewall show state
                                                                                                          5⤵
                                                                                                          • Modifies Windows Firewall
                                                                                                          PID:1016
                                                                                                        • C:\Windows\system32\netsh.exe
                                                                                                          netsh firewall show config
                                                                                                          5⤵
                                                                                                          • Modifies Windows Firewall
                                                                                                          PID:1544
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
                                                                                                        4⤵
                                                                                                        • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                        PID:5576
                                                                                                        • C:\Windows\system32\netsh.exe
                                                                                                          netsh wlan show profiles
                                                                                                          5⤵
                                                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                                                          • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                          PID:5304
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                        4⤵
                                                                                                          PID:2472
                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                            wmic csproduct get uuid
                                                                                                            5⤵
                                                                                                              PID:1748
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                            4⤵
                                                                                                              PID:3356
                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                wmic csproduct get uuid
                                                                                                                5⤵
                                                                                                                  PID:2000
                                                                                                        • C:\Windows\system32\AUDIODG.EXE
                                                                                                          C:\Windows\system32\AUDIODG.EXE 0x528 0x538
                                                                                                          1⤵
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:836

                                                                                                        Network

                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                        Replay Monitor

                                                                                                        Loading Replay Monitor...

                                                                                                        Downloads

                                                                                                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\activity-stream.discovery_stream.json

                                                                                                          Filesize

                                                                                                          19KB

                                                                                                          MD5

                                                                                                          5c1f9701bfe525e1056b43f79d44419a

                                                                                                          SHA1

                                                                                                          5f81138b3b33dc94179a505e93f7e07fe82b5532

                                                                                                          SHA256

                                                                                                          c4bfffbdd48095b903e88cf1b2d2e6963562b6335c58ab3d6e78db64ad7f55f6

                                                                                                          SHA512

                                                                                                          6acedcd0c892f6a89755a8e55364d65331f0ee684d39a37dd1dd43699a248aeffadba4d9f72d17e5642734f8711b3da73638f94dfa87c9d9bb7611d91c4b7d14

                                                                                                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                                                                                                          Filesize

                                                                                                          15KB

                                                                                                          MD5

                                                                                                          96c542dec016d9ec1ecc4dddfcbaac66

                                                                                                          SHA1

                                                                                                          6199f7648bb744efa58acf7b96fee85d938389e4

                                                                                                          SHA256

                                                                                                          7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                                                                                          SHA512

                                                                                                          cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\TempAppFiles\mac.exe

                                                                                                          Filesize

                                                                                                          10.8MB

                                                                                                          MD5

                                                                                                          1351a7c2d66f6c11e7f70c30964e828a

                                                                                                          SHA1

                                                                                                          4f4266f92055bd9771364c7e43a6be5a69fbde52

                                                                                                          SHA256

                                                                                                          490ef6af0563ce738a6c57095d67c7d9db884ad6b93ba2fe0d061283d506b766

                                                                                                          SHA512

                                                                                                          c8b402a82d8b067063f46966edae463ebe3e4449838969389a193c781f2ca5350d200e768bee4eb8f658d9bbb85e712a27a85864c67d98238303bdd329af925e

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\VCRUNTIME140.dll

                                                                                                          Filesize

                                                                                                          96KB

                                                                                                          MD5

                                                                                                          f12681a472b9dd04a812e16096514974

                                                                                                          SHA1

                                                                                                          6fd102eb3e0b0e6eef08118d71f28702d1a9067c

                                                                                                          SHA256

                                                                                                          d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

                                                                                                          SHA512

                                                                                                          7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\_asyncio.pyd

                                                                                                          Filesize

                                                                                                          34KB

                                                                                                          MD5

                                                                                                          1b8ce772a230a5da8cbdccd8914080a5

                                                                                                          SHA1

                                                                                                          40d4faf1308d1af6ef9f3856a4f743046fd0ead5

                                                                                                          SHA256

                                                                                                          fa5a1e7031de5849ab2ab5a177e366b41e1df6bbd90c8d2418033a01c740771f

                                                                                                          SHA512

                                                                                                          d2fc21b9f58b57065b337c3513e7e6c3e2243b73c5a230e81c91dafcb6724b521ad766667848ba8d0a428d530691ffc4020de6ce9ce1eaa2bf5e15338114a603

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\_bz2.pyd

                                                                                                          Filesize

                                                                                                          46KB

                                                                                                          MD5

                                                                                                          80c69a1d87f0c82d6c4268e5a8213b78

                                                                                                          SHA1

                                                                                                          bae059da91d48eaac4f1bb45ca6feee2c89a2c06

                                                                                                          SHA256

                                                                                                          307359f1b2552b60839385eb63d74cbfe75cd5efdb4e7cd0bb7d296fa67d8a87

                                                                                                          SHA512

                                                                                                          542cf4ba19dd6a91690340779873e0cb8864b28159f55917f98a192ff9c449aba2d617e9b2b3932ddfeee13021706577ab164e5394e0513fe4087af6bc39d40d

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\_cffi_backend.cp311-win_amd64.pyd

                                                                                                          Filesize

                                                                                                          71KB

                                                                                                          MD5

                                                                                                          0f0f1c4e1d043f212b00473a81c012a3

                                                                                                          SHA1

                                                                                                          ff9ff3c257dceefc74551e4e2bacde0faaef5aec

                                                                                                          SHA256

                                                                                                          fda255664cbf627cb6a9cd327daf4e3eb06f4f0707ed2615e86e2e99b422ad0b

                                                                                                          SHA512

                                                                                                          fcfa42f417e319bddf721f298587d1b26e6974e5d7589dfe6ddd2b013bc554a53db3725741fbc4941f34079ed8cb96f05934f3c2b933cda6a7e19cda315591a7

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\_ctypes.pyd

                                                                                                          Filesize

                                                                                                          57KB

                                                                                                          MD5

                                                                                                          b4c41a4a46e1d08206c109ce547480c7

                                                                                                          SHA1

                                                                                                          9588387007a49ec2304160f27376aedca5bc854d

                                                                                                          SHA256

                                                                                                          9925ab71a4d74ce0ccc036034d422782395dd496472bd2d7b6d617f4d6ddc1f9

                                                                                                          SHA512

                                                                                                          30debb8e766b430a57f3f6649eeb04eb0aad75ab50423252585db7e28a974d629eb81844a05f5cb94c1702308d3feda7a7a99cb37458e2acb8e87efc486a1d33

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\_decimal.pyd

                                                                                                          Filesize

                                                                                                          104KB

                                                                                                          MD5

                                                                                                          e9501519a447b13dcca19e09140c9e84

                                                                                                          SHA1

                                                                                                          472b1aa072454d065dfe415a05036ffd8804c181

                                                                                                          SHA256

                                                                                                          6b5fe2dea13b84e40b0278d1702aa29e9e2091f9dc09b64bbff5fd419a604c3c

                                                                                                          SHA512

                                                                                                          ef481e0e4f9b277642652cd090634e1c04702df789e2267a87205e0fe12b00f1de6cdd4fafb51da01efa726606c0b57fcb2ea373533c772983fc4777dc0acc63

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\_hashlib.pyd

                                                                                                          Filesize

                                                                                                          33KB

                                                                                                          MD5

                                                                                                          0629bdb5ff24ce5e88a2ddcede608aee

                                                                                                          SHA1

                                                                                                          47323370992b80dafb6f210b0d0229665b063afb

                                                                                                          SHA256

                                                                                                          f404bb8371618bbd782201f092a3bcd7a96d3c143787ebea1d8d86ded1f4b3b8

                                                                                                          SHA512

                                                                                                          3faeff1a19893257c17571b89963af37534c189421585ea03dd6a3017d28803e9d08b0e4daceee01ffeda21da60e68d10083fe7dbdbbde313a6b489a40e70952

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\_lzma.pyd

                                                                                                          Filesize

                                                                                                          84KB

                                                                                                          MD5

                                                                                                          bfca96ed7647b31dd2919bedebb856b8

                                                                                                          SHA1

                                                                                                          7d802d5788784f8b6bfbb8be491c1f06600737ac

                                                                                                          SHA256

                                                                                                          032b1a139adcff84426b6e156f9987b501ad42ecfb18170b10fb54da0157392e

                                                                                                          SHA512

                                                                                                          3a2926b79c90c3153c88046d316a081c8ddfb181d5f7c849ea6ae55cb13c6adba3a0434f800c4a30017d2fbab79d459432a2e88487914b54a897c4301c778551

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\_multiprocessing.pyd

                                                                                                          Filesize

                                                                                                          25KB

                                                                                                          MD5

                                                                                                          849b4203c5f9092db9022732d8247c97

                                                                                                          SHA1

                                                                                                          ed7bd0d6dcdcfa07f754b98acf44a7cfe5dcb353

                                                                                                          SHA256

                                                                                                          45bfbab1d2373cf7a8af19e5887579b8a306b3ad0c4f57e8f666339177f1f807

                                                                                                          SHA512

                                                                                                          cc618b4fc918b423e5dbdcbc45206653133df16bf2125fd53bafef8f7850d2403564cf80f8a5d4abb4a8928ff1262f80f23c633ea109a18556d1871aff81cd39

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\_overlapped.pyd

                                                                                                          Filesize

                                                                                                          30KB

                                                                                                          MD5

                                                                                                          97a40f53a81c39469cc7c8dd00f51b5d

                                                                                                          SHA1

                                                                                                          6c3916fe42e7977d8a6b53bfbc5a579abcf22a83

                                                                                                          SHA256

                                                                                                          11879a429c996fee8be891af2bec7d00f966593f1e01ca0a60bd2005feb4176f

                                                                                                          SHA512

                                                                                                          02af654ab73b6c8bf15a81c0e9071c8faf064c529b1439a2ab476e1026c860cf7d01472945112d4583e5da8e4c57f1df2700331440be80066dbb6a7e89e1c5af

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\_queue.pyd

                                                                                                          Filesize

                                                                                                          24KB

                                                                                                          MD5

                                                                                                          0614691624f99748ef1d971419bdb80d

                                                                                                          SHA1

                                                                                                          39c52450ed7e31e935b5b0e49d03330f2057747d

                                                                                                          SHA256

                                                                                                          ac7972502144e9e01e53001e8eec3fc9ab063564678b784d024da2036ba7384d

                                                                                                          SHA512

                                                                                                          184bc172c7bb8a1fb55c4c23950cbe5e0b5a3c96c1c555ed8476edf79c5c729ed297112ee01b45d771e5c0055d2dc402b566967d1900b5abf683ee8e668c5b26

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\_socket.pyd

                                                                                                          Filesize

                                                                                                          41KB

                                                                                                          MD5

                                                                                                          04e7eb0b6861495233247ac5bb33a89a

                                                                                                          SHA1

                                                                                                          c4d43474e0b378a00845cca044f68e224455612a

                                                                                                          SHA256

                                                                                                          7efe25284a4663df9458603bf0988b0f47c7dcf56119e3e853e6bda80831a383

                                                                                                          SHA512

                                                                                                          d4ea0484363edf284ac08a1c3356cc3112d410dd80fe5010c1777acf88dbd830e9f668b593e252033d657a3431a79f7b68d09eb071d0c2ceb51632dbe9b8ed97

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\_sqlite3.pyd

                                                                                                          Filesize

                                                                                                          54KB

                                                                                                          MD5

                                                                                                          d9eeeeacc3a586cf2dbf6df366f6029e

                                                                                                          SHA1

                                                                                                          4ff9fb2842a13e9371ce7894ec4fe331b6af9219

                                                                                                          SHA256

                                                                                                          67649e1e8acd348834efb2c927ab6a7599cf76b2c0c0a50b137b3be89c482e29

                                                                                                          SHA512

                                                                                                          0b9f1d80fb92c796682dba94a75fbce0e4fbeaedccd50e21d42d4b9366463a830109a8cd4300aa62b41910655f8ca96ecc609ea8a1b84236250b6fd08c965830

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\_ssl.pyd

                                                                                                          Filesize

                                                                                                          60KB

                                                                                                          MD5

                                                                                                          fd0f4aed22736098dc146936cbf0ad1d

                                                                                                          SHA1

                                                                                                          e520def83b8efdbca9dd4b384a15880b036ee0cf

                                                                                                          SHA256

                                                                                                          50404a6a3de89497e9a1a03ff3df65c6028125586dced1a006d2abb9009a9892

                                                                                                          SHA512

                                                                                                          c8f3c04d87da19041f28e1d474c8eb052fe8c03ffd88f0681ef4a2ffe29755cfd5b9c100a1b1d2fdb233cb0f70e367af500cbd3cd4ce77475f441f2b2aa0ab8a

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\_uuid.pyd

                                                                                                          Filesize

                                                                                                          21KB

                                                                                                          MD5

                                                                                                          3377ae26c2987cfee095dff160f2c86c

                                                                                                          SHA1

                                                                                                          0ca6aa60618950e6d91a7dea530a65a1cdf16625

                                                                                                          SHA256

                                                                                                          9534cb9c997a17f0004fb70116e0141bdd516373b37bbd526d91ad080daa3a2b

                                                                                                          SHA512

                                                                                                          8e408b84e2130ff48b8004154d1bdf6a08109d0b40f9fafb6f55e9f215e418e05dca819f411c802792a9d9936a55d6b90460121583e5568579a0fda6935852ee

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\aiohttp\_http_parser.cp311-win_amd64.pyd

                                                                                                          Filesize

                                                                                                          81KB

                                                                                                          MD5

                                                                                                          f8adbed5c24a41c22b36533ab2118533

                                                                                                          SHA1

                                                                                                          42c1c7754c7c77f60f914f6e231b448dc70040fb

                                                                                                          SHA256

                                                                                                          b1c9a831749272e1096fcee9ac8bdfdb87fca0570d064f165d9084157a17084f

                                                                                                          SHA512

                                                                                                          7331de1886e550740756e4fd206f0e4ef09af03a12a480077dc4ff677c2133aed840ffb35507f5a6a1036b7005398b0f4ed9087f36de9e24a6b72332589f3f94

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\aiohttp\_http_writer.cp311-win_amd64.pyd

                                                                                                          Filesize

                                                                                                          24KB

                                                                                                          MD5

                                                                                                          26526c6230e7d263ba60f28adc3779a3

                                                                                                          SHA1

                                                                                                          a5a3d8e4f8519e13bb5121a4ae59a47352622679

                                                                                                          SHA256

                                                                                                          9b12b5138a596d297b54ca9c7c8c1abd8a0ad45590c283716ee9be87fab29a40

                                                                                                          SHA512

                                                                                                          cacf4ce7f84c06fdf8024d505da8ce520223400536c2018d9a815ecabbf41902d23a6d8ee0c5b042edfcbfa626a24bebd5332c11202b7be77453a243e757bc95

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\aiohttp\_websocket\mask.cp311-win_amd64.pyd

                                                                                                          Filesize

                                                                                                          19KB

                                                                                                          MD5

                                                                                                          c5fc3ced9cdba5d8effdace2195aed59

                                                                                                          SHA1

                                                                                                          e7227f99ddffb9cd2e0247115545c9f53010c9f2

                                                                                                          SHA256

                                                                                                          940cae659ed4f106b1385fb4f98baf8700568ad443c37babebac8d1e3eaa39d7

                                                                                                          SHA512

                                                                                                          a1e63058b7689a2ed54c663498783490b1ea3f7dae831f06af5499ced670fbf11b9815406b5d09fbc6a8f66f726726cea420c6ab37e2899be2e24f7177bd7278

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\aiohttp\_websocket\reader_c.cp311-win_amd64.pyd

                                                                                                          Filesize

                                                                                                          61KB

                                                                                                          MD5

                                                                                                          ef07f5c5f429471c30f3571ad9602b53

                                                                                                          SHA1

                                                                                                          69e2e70a8d7106f250c67b8a736d5c6f861703e6

                                                                                                          SHA256

                                                                                                          63ea4a23190c5a7a8fb137e5972c549fe05177f7edfc2735c912d4ec85552ed8

                                                                                                          SHA512

                                                                                                          98bdc5ca86c4aac2aa35bd8b9a4850091078e8174581e0dd062d0e3d3ff20fb1ada19699d6c92703b7062bcd2ea7aa1fa771031229eb97b81a215035a78ca917

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\base_library.zip

                                                                                                          Filesize

                                                                                                          1.4MB

                                                                                                          MD5

                                                                                                          2a138e2ee499d3ba2fc4afaef93b7caa

                                                                                                          SHA1

                                                                                                          508c733341845e94fce7c24b901fc683108df2a8

                                                                                                          SHA256

                                                                                                          130e506ead01b91b60d6d56072c468aeb5457dd0f2ecd6ce17dfcbb7d51a1f8c

                                                                                                          SHA512

                                                                                                          1f61a0fda5676e8ed8d10dfee78267f6d785f9c131f5caf2dd984e18ca9e5866b7658ab7edb2ffd74920a40ffea5cd55c0419f5e9ee57a043105e729e10d820b

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\libcrypto-1_1.dll

                                                                                                          Filesize

                                                                                                          1.1MB

                                                                                                          MD5

                                                                                                          86cfc84f8407ab1be6cc64a9702882ef

                                                                                                          SHA1

                                                                                                          86f3c502ed64df2a5e10b085103c2ffc9e3a4130

                                                                                                          SHA256

                                                                                                          11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307

                                                                                                          SHA512

                                                                                                          b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\libffi-8.dll

                                                                                                          Filesize

                                                                                                          24KB

                                                                                                          MD5

                                                                                                          decbba3add4c2246928ab385fb16a21e

                                                                                                          SHA1

                                                                                                          5f019eff11de3122ffa67a06d52d446a3448b75e

                                                                                                          SHA256

                                                                                                          4b43c1e42f6050ddb8e184c8ec4fb1de4a6001e068ece8e6ad47de0cc9fd4a2d

                                                                                                          SHA512

                                                                                                          760a42a3eb3ca13fa7b95d3bd0f411c270594ae3cf1d3cda349fa4f8b06ebe548b60cd438d68e2da37de0bc6f1c711823f5e917da02ed7047a45779ee08d7012

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\libssl-1_1.dll

                                                                                                          Filesize

                                                                                                          203KB

                                                                                                          MD5

                                                                                                          6cd33578bc5629930329ca3303f0fae1

                                                                                                          SHA1

                                                                                                          f2f8e3248a72f98d27f0cfa0010e32175a18487f

                                                                                                          SHA256

                                                                                                          4150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0

                                                                                                          SHA512

                                                                                                          c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\multidict\_multidict.cp311-win_amd64.pyd

                                                                                                          Filesize

                                                                                                          20KB

                                                                                                          MD5

                                                                                                          5587c32d9bf7f76e1a9565df8b1b649f

                                                                                                          SHA1

                                                                                                          52ae204a65c15a09ecc73e7031e3ac5c3dcb71b2

                                                                                                          SHA256

                                                                                                          7075185db068e3c8f1b7db75e5aa5c500fc76ed8270c6abc6f49681d7119a782

                                                                                                          SHA512

                                                                                                          f21d0530389138457d6fdcdb3487a3c8b030338c569b2742f9e691e43af1d9e779c98426bad81b152f343b324a9375fe1322ef74030b1c8f8ba606d19e562e97

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\propcache\_helpers_c.cp311-win_amd64.pyd

                                                                                                          Filesize

                                                                                                          31KB

                                                                                                          MD5

                                                                                                          51f012d736c71a681948623455617995

                                                                                                          SHA1

                                                                                                          e6b5954870c90a81da9bf274df6ceac62d471ad8

                                                                                                          SHA256

                                                                                                          b495db6bac375f948efa2830073bf1b4496086e2b572b5353ebd07bcd07e200f

                                                                                                          SHA512

                                                                                                          a409f3ef69887761620403ca4bd2ebfbb8f3648139dd654d5da47f4fa61ff6d3e73557b3a19aefe59eb7ab9eb39d59048115c0bc2046bc09b3fdc7108b91dc3f

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\pyexpat.pyd

                                                                                                          Filesize

                                                                                                          86KB

                                                                                                          MD5

                                                                                                          fe0e32bfe3764ed5321454e1a01c81ec

                                                                                                          SHA1

                                                                                                          7690690df0a73bdcc54f0f04b674fc8a9a8f45fb

                                                                                                          SHA256

                                                                                                          b399bff10812e9ea2c9800f74cb0e5002f9d9379baf1a3cef9d438caca35dc92

                                                                                                          SHA512

                                                                                                          d1777f9e684a9e4174e18651e6d921ae11757ecdbeb4ee678c6a28e0903a4b9ab9f6e1419670b4d428ee20f86c7d424177ed9daf4365cf2ee376fcd065c1c92d

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\python3.dll

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                          MD5

                                                                                                          34e49bb1dfddf6037f0001d9aefe7d61

                                                                                                          SHA1

                                                                                                          a25a39dca11cdc195c9ecd49e95657a3e4fe3215

                                                                                                          SHA256

                                                                                                          4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281

                                                                                                          SHA512

                                                                                                          edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\python311.dll

                                                                                                          Filesize

                                                                                                          1.6MB

                                                                                                          MD5

                                                                                                          db09c9bbec6134db1766d369c339a0a1

                                                                                                          SHA1

                                                                                                          c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b

                                                                                                          SHA256

                                                                                                          b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79

                                                                                                          SHA512

                                                                                                          653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\select.pyd

                                                                                                          Filesize

                                                                                                          24KB

                                                                                                          MD5

                                                                                                          c39459806c712b3b3242f8376218c1e1

                                                                                                          SHA1

                                                                                                          85d254fb6cc5d6ed20a04026bff1158c8fd0a530

                                                                                                          SHA256

                                                                                                          7cbd4339285d145b422afa280cee685258bc659806be9cf8b334805bc45b29c9

                                                                                                          SHA512

                                                                                                          b727c6d1cd451d658e174161135d3be48d7efda21c775b8145bc527a54d6592bfc50919276c6498d2e2233ac1524c1699f59f0f467cc6e43e5b5e9558c87f49d

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\sqlite3.dll

                                                                                                          Filesize

                                                                                                          608KB

                                                                                                          MD5

                                                                                                          895f001ae969364432372329caf08b6a

                                                                                                          SHA1

                                                                                                          4567fc6672501648b277fe83e6b468a7a2155ddf

                                                                                                          SHA256

                                                                                                          f5dd29e1e99cf8967f7f81487dc624714dcbec79c1630f929d5507fc95cbfad7

                                                                                                          SHA512

                                                                                                          05b4559d283ea84174da72a6c11b8b93b1586b4e7d8cda8d745c814f8f6dff566e75f9d7890f32bd9dfe43485244973860f83f96ba39296e28127c9396453261

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\unicodedata.pyd

                                                                                                          Filesize

                                                                                                          293KB

                                                                                                          MD5

                                                                                                          06a5e52caf03426218f0c08fc02cc6b8

                                                                                                          SHA1

                                                                                                          ae232c63620546716fbb97452d73948ebfd06b35

                                                                                                          SHA256

                                                                                                          118c31faa930f2849a14c3133df36420a5832114df90d77b09cde0ad5f96f33a

                                                                                                          SHA512

                                                                                                          546b1a01f36d3689b0fdeeda8b1ce55e7d3451731ca70fffe6627d542fff19d7a70e27147cab1920aae8bed88272342908d4e9d671d7aba74abb5db398b90718

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\_MEI52202\yarl\_quoting_c.cp311-win_amd64.pyd

                                                                                                          Filesize

                                                                                                          41KB

                                                                                                          MD5

                                                                                                          99569b47d3a55086013a5760a28ac6af

                                                                                                          SHA1

                                                                                                          9e5017979fb646b00c98f4fe2cf8c8f7d5dd3664

                                                                                                          SHA256

                                                                                                          469f039bfa377890b95c9d3413ece8ca296d156ad4ec194d8ec78d6b81a9d0b6

                                                                                                          SHA512

                                                                                                          8425d38d3b69472e5e41e4ece08ba2dbdd2d871c1bf083d859edec006a4ee9441796d53f1373f030c8ccf32b74bdaee2a9b3a32457cc53024d15322e5920895e

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2uwo3f4e.mma.ps1

                                                                                                          Filesize

                                                                                                          60B

                                                                                                          MD5

                                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                                          SHA1

                                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                          SHA256

                                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                          SHA512

                                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                                                                          Filesize

                                                                                                          479KB

                                                                                                          MD5

                                                                                                          09372174e83dbbf696ee732fd2e875bb

                                                                                                          SHA1

                                                                                                          ba360186ba650a769f9303f48b7200fb5eaccee1

                                                                                                          SHA256

                                                                                                          c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                                                                          SHA512

                                                                                                          b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                                                                          Filesize

                                                                                                          13.8MB

                                                                                                          MD5

                                                                                                          0a8747a2ac9ac08ae9508f36c6d75692

                                                                                                          SHA1

                                                                                                          b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                                                                          SHA256

                                                                                                          32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                                                                          SHA512

                                                                                                          59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin

                                                                                                          Filesize

                                                                                                          6KB

                                                                                                          MD5

                                                                                                          0df61cd6caaf027b9956db69e6f872d6

                                                                                                          SHA1

                                                                                                          ecff4a295113d9af9a4fcae0e7f9ad348b1d49d1

                                                                                                          SHA256

                                                                                                          f2eed2646d66730c93bc0a9e757463fd424bb6da0f9faf8695d5223419cbdeca

                                                                                                          SHA512

                                                                                                          1d30b918d41bfc51caf7eb3f9ecfaec0a1a7c6adda4a4629ce4bde89c05744561b9bbaea65a3898dd90d7cde05d2e8710e024d655d805caf9fab64581f256ed9

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin

                                                                                                          Filesize

                                                                                                          6KB

                                                                                                          MD5

                                                                                                          8322828d5b824e6808055775350970bb

                                                                                                          SHA1

                                                                                                          ec25f3fa1b2bdf5f7a545b5f6bd9d6f373e4efe4

                                                                                                          SHA256

                                                                                                          c1d181d11b760c6709dbe4bda2b68219dc0a640c730306bf11e2a2fefcb53929

                                                                                                          SHA512

                                                                                                          3719003f36d2f42edd15140f1f46d1f97665f988a46fb815584baa6975a567ad4d1f248cd508fde72d4bc6630ecaf592de7fdef7ec13e94c3fb3f17eced5bd0a

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin

                                                                                                          Filesize

                                                                                                          11KB

                                                                                                          MD5

                                                                                                          9b220fc6dc83af0820eddd384d755ad5

                                                                                                          SHA1

                                                                                                          e446430bb2d0241c371a21782348d9ca5c03600d

                                                                                                          SHA256

                                                                                                          7e78fcc46e1c8e4bf798cc33e5df16b77f7b9c799a91468c2e3dbc21bc16d8c8

                                                                                                          SHA512

                                                                                                          a1ad31c491ea9e1d79d30754d8307c481bd4fcc675db1649fae2a89e1ab305dab99964002a46b2a8b758f751e432a5d173263b91ea189cf986e5ca13d231ca2c

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

                                                                                                          Filesize

                                                                                                          5KB

                                                                                                          MD5

                                                                                                          3f6fa00a545f05c3588da02c772597d2

                                                                                                          SHA1

                                                                                                          0908255b6b73a703c54679d53b987717f63d050e

                                                                                                          SHA256

                                                                                                          6dc369940cad1fcc418d1ffbbdcffadbba1e257916657f1994b1ae7ba58a2de2

                                                                                                          SHA512

                                                                                                          c884e243cc1352801dfde0165c904340f7a2b74393a771c078dcb74ad8238c0881386dd55676477be0c2f7a9bc6f7922d448d4ccd3e40d34e36bd33108a6c2a9

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

                                                                                                          Filesize

                                                                                                          6KB

                                                                                                          MD5

                                                                                                          0ca48804804cc8b4652706c4c3ff4e69

                                                                                                          SHA1

                                                                                                          73ce8db188fd871fc48f83bebd1d1b0b00b4f9cc

                                                                                                          SHA256

                                                                                                          1f06c696cc515908f122732a58124e198e750ec751113ce464bb7dfdabacdfa8

                                                                                                          SHA512

                                                                                                          e9012d13cbcb0ff83af5dc6bd5d20111c138b657b3592f963609abb370b114c71f8a25289dd7ca3feaa0a0a0b2ba64060fec44f7a214edf592601d4ffa3daa0e

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

                                                                                                          Filesize

                                                                                                          6KB

                                                                                                          MD5

                                                                                                          741004098ece27fc5b7a1af123dae944

                                                                                                          SHA1

                                                                                                          5f1fc3589cfcfa26c0506af25d99b6d708eafbf5

                                                                                                          SHA256

                                                                                                          445106b8ef21ce54f3f1cd06e08e25860ba118484b19bdcae5342f595ba7c6a3

                                                                                                          SHA512

                                                                                                          4a5542f4c06966d6069c8339fa12b641fb60fafcdfd892d057f0afb64b1b394e0b879cfbcf3605c636d623f06c3f13523cd7f9a4ba9861c11bc7f737f1b21c4b

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\335d907c-9477-4cb0-9d2c-d1b0bd76e23c

                                                                                                          Filesize

                                                                                                          671B

                                                                                                          MD5

                                                                                                          c70a687d74390ca7d7b611d05702b027

                                                                                                          SHA1

                                                                                                          19b729e1ec8e91dcc9dd58c4ffeb9f5990030d4a

                                                                                                          SHA256

                                                                                                          125a3717f26ca3c590ffab32fd8bf69949d4184cbdc7eac7fa9777cc9126a1ea

                                                                                                          SHA512

                                                                                                          c8c8ecca1e3c8063bb6240e5f42131e4cd25ecb23db979bbbc1c1a2b6b4eee425e802b3659365316d0287a86298110914f28522ceb49ec7fa27d288463864dbc

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\c42012e8-e386-4d84-94bd-dd2aaa079274

                                                                                                          Filesize

                                                                                                          25KB

                                                                                                          MD5

                                                                                                          3ce061d9bc51bb0b0e2568d8a63c6ec2

                                                                                                          SHA1

                                                                                                          858902d30bd326c234b6648d748bb5284b533c8b

                                                                                                          SHA256

                                                                                                          0f5253c0b4d679045648cde36dbb62117a530fd07cf4a2b1394a7e9bfe78aaff

                                                                                                          SHA512

                                                                                                          59aef1d7bc9f0b588a6de51037498a5114515e7340056e7f6a9689af9df32a6616ee9536af5bb91f3189c3c2313aa316d6739705526893d96a8416fb36f44f04

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\d4c1fb2b-6475-448c-a310-7615be0e4924

                                                                                                          Filesize

                                                                                                          982B

                                                                                                          MD5

                                                                                                          96b511c7007b1fb6973fccecf9cf8118

                                                                                                          SHA1

                                                                                                          e7a39db4b96086df88310801f9bf69335aa65a6d

                                                                                                          SHA256

                                                                                                          580bafd5d025fc1cf5ae1bb0c40817c265586cd529326bb2124580b4dd550e06

                                                                                                          SHA512

                                                                                                          1325c8029e13b8942d31cddc46475feb5637d548823635b170b7f84088617b7916196c5db4cda803110ac9b0f895e28bb1a6a3f0f95dae3af20a85dd0dc9c5e7

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                                                                          Filesize

                                                                                                          1.1MB

                                                                                                          MD5

                                                                                                          842039753bf41fa5e11b3a1383061a87

                                                                                                          SHA1

                                                                                                          3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                                                                          SHA256

                                                                                                          d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                                                                          SHA512

                                                                                                          d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                                                                          Filesize

                                                                                                          116B

                                                                                                          MD5

                                                                                                          2a461e9eb87fd1955cea740a3444ee7a

                                                                                                          SHA1

                                                                                                          b10755914c713f5a4677494dbe8a686ed458c3c5

                                                                                                          SHA256

                                                                                                          4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                                                                          SHA512

                                                                                                          34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                                                                          Filesize

                                                                                                          372B

                                                                                                          MD5

                                                                                                          bf957ad58b55f64219ab3f793e374316

                                                                                                          SHA1

                                                                                                          a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                                                                          SHA256

                                                                                                          bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                                                                          SHA512

                                                                                                          79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                                                                          Filesize

                                                                                                          17.8MB

                                                                                                          MD5

                                                                                                          daf7ef3acccab478aaa7d6dc1c60f865

                                                                                                          SHA1

                                                                                                          f8246162b97ce4a945feced27b6ea114366ff2ad

                                                                                                          SHA256

                                                                                                          bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                                                                          SHA512

                                                                                                          5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js

                                                                                                          Filesize

                                                                                                          11KB

                                                                                                          MD5

                                                                                                          14377d67b930571611c577750a4f807f

                                                                                                          SHA1

                                                                                                          5a8308b5fcf8ff7111f2e50bb3bdfb4ae7cd8cb4

                                                                                                          SHA256

                                                                                                          d325268d7179f384a072717255519609b6adaf0cb44aea7a0fc730f94061941e

                                                                                                          SHA512

                                                                                                          e30339af628d9c449f7c485738ae0629aa2d3d5ec0e6660b24e75c3a980790c19b0f79dc6178ff4961b6f6ca3e40da54ba14e9df6070354138cbc918de7d46d8

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs.js

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          4f318dc55ceb6426f604ec4a8004e5fb

                                                                                                          SHA1

                                                                                                          f87746d39422ec1cd48df0f3c0315faeb80395ed

                                                                                                          SHA256

                                                                                                          8a1a067057bf5db62dfbc39ed05473b18e83572da31519727b010e8272395def

                                                                                                          SHA512

                                                                                                          fe511988717cb1922a95dbb49b96a2c06b6464f63521eb981664a04a907cca390793af3d766cac3302153fe629435ffa61f62240c877c8ebd100e222f5ff939f

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs.js

                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          475b4d0cadc6ac4e0d0174300b2e45bc

                                                                                                          SHA1

                                                                                                          f93c78d3a815124b1b91c8ef683c5d484e2cacbd

                                                                                                          SHA256

                                                                                                          638a4d8d53e8a8f557e0f3d186ae625fe6e55b27a0800b388b74ede9aa25d393

                                                                                                          SHA512

                                                                                                          011005db30841cf7e1e836063cc954cc168317a2f419579d3b730346acc516440ce386e9cefe3516fd0a5f5745c421d4ea7c5279fbe17695832c74d3d59840d3

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\sessionstore-backups\recovery.baklz4

                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          987f6af7df71b907f24762c8b2f6b065

                                                                                                          SHA1

                                                                                                          cc3d66822826635111b6796d0b5b2f4ee43561b7

                                                                                                          SHA256

                                                                                                          f4631a9834528e0a58c44f5abdc14e276bed1c8c67e01d8f283d2346dd47c52a

                                                                                                          SHA512

                                                                                                          5fd9890200a0a1d6289abc417fe5c0619a484b5cddcff35b3a7059e024edc308e0d51d41b4a2e8d5331ef28e2b5607e2c27df104aab392eabaab5c727c5f15fc

                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\sessionstore-backups\recovery.baklz4

                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          4b1d76fce3d8bcdb71f2dd3b6c7be20b

                                                                                                          SHA1

                                                                                                          0788ce56454938f0a8a1de4f56021ed5314d68ce

                                                                                                          SHA256

                                                                                                          eee812e7726e743fa93d23c6dd0a9d3d9d76bc671ba831b98f92b42a28e0fc6f

                                                                                                          SHA512

                                                                                                          b589b3c5188912ae20b39e461856b3aea6866ef4f4448f09461eea701ac189ed0e211423e700568ffdc6943bf34da8d2df80c2062379b76d1a00147145300cf4

                                                                                                        • C:\Users\Admin\Downloads\RippleSpoofer.Pn92vR5y.exe.part

                                                                                                          Filesize

                                                                                                          15.6MB

                                                                                                          MD5

                                                                                                          76ed914a265f60ff93751afe02cf35a4

                                                                                                          SHA1

                                                                                                          4f8ea583e5999faaec38be4c66ff4849fcf715c6

                                                                                                          SHA256

                                                                                                          51bd245f8cb24c624674cd2bebcad4152d83273dab4d1ee7d982e74a0548890b

                                                                                                          SHA512

                                                                                                          83135f8b040b68cafb896c4624bd66be1ae98857907b9817701d46952d4be9aaf7ad1ab3754995363bb5192fa2c669c26f526cafc6c487b061c2edcceebde6ac

                                                                                                        • memory/4500-435-0x000001BF232B0000-0x000001BF232E2000-memory.dmp

                                                                                                          Filesize

                                                                                                          200KB

                                                                                                        • memory/4500-438-0x00007FFBE1BC0000-0x00007FFBE1C7E000-memory.dmp

                                                                                                          Filesize

                                                                                                          760KB

                                                                                                        • memory/4500-409-0x00000000008B0000-0x0000000002530000-memory.dmp

                                                                                                          Filesize

                                                                                                          28.5MB

                                                                                                        • memory/4500-411-0x00007FFBE1BDB000-0x00007FFBE1BDC000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/4500-412-0x00007FFBE1BC0000-0x00007FFBE1C7E000-memory.dmp

                                                                                                          Filesize

                                                                                                          760KB

                                                                                                        • memory/4500-410-0x00007FFB80000000-0x00007FFB80002000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/4500-414-0x00000000008B0000-0x0000000002530000-memory.dmp

                                                                                                          Filesize

                                                                                                          28.5MB

                                                                                                        • memory/4500-415-0x00000000008B0000-0x0000000002530000-memory.dmp

                                                                                                          Filesize

                                                                                                          28.5MB

                                                                                                        • memory/4500-417-0x000001BF06EC0000-0x000001BF06EC1000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                        • memory/4500-418-0x000001BF226A0000-0x000001BF22752000-memory.dmp

                                                                                                          Filesize

                                                                                                          712KB

                                                                                                        • memory/4500-419-0x00000000008B0000-0x0000000002530000-memory.dmp

                                                                                                          Filesize

                                                                                                          28.5MB

                                                                                                        • memory/4500-420-0x000001BF205D0000-0x000001BF205F2000-memory.dmp

                                                                                                          Filesize

                                                                                                          136KB

                                                                                                        • memory/4500-421-0x000001BF20630000-0x000001BF20844000-memory.dmp

                                                                                                          Filesize

                                                                                                          2.1MB

                                                                                                        • memory/4500-422-0x00007FFB80000000-0x00007FFB80002000-memory.dmp

                                                                                                          Filesize

                                                                                                          8KB

                                                                                                        • memory/4500-429-0x00007FFBE1BC0000-0x00007FFBE1C7E000-memory.dmp

                                                                                                          Filesize

                                                                                                          760KB

                                                                                                        • memory/4500-430-0x000001BF23240000-0x000001BF23274000-memory.dmp

                                                                                                          Filesize

                                                                                                          208KB

                                                                                                        • memory/4500-431-0x000001BF23290000-0x000001BF232AA000-memory.dmp

                                                                                                          Filesize

                                                                                                          104KB

                                                                                                        • memory/4500-433-0x000001BF23270000-0x000001BF23284000-memory.dmp

                                                                                                          Filesize

                                                                                                          80KB

                                                                                                        • memory/4500-432-0x000001BF20950000-0x000001BF20958000-memory.dmp

                                                                                                          Filesize

                                                                                                          32KB

                                                                                                        • memory/5376-702-0x00007FFBD3E50000-0x00007FFBD3E87000-memory.dmp

                                                                                                          Filesize

                                                                                                          220KB

                                                                                                        • memory/5376-696-0x0000023678AE0000-0x0000023678E55000-memory.dmp

                                                                                                          Filesize

                                                                                                          3.5MB

                                                                                                        • memory/5376-635-0x00007FFBDD840000-0x00007FFBDD84D000-memory.dmp

                                                                                                          Filesize

                                                                                                          52KB

                                                                                                        • memory/5376-610-0x00007FFBDD880000-0x00007FFBDD8A4000-memory.dmp

                                                                                                          Filesize

                                                                                                          144KB

                                                                                                        • memory/5376-666-0x00007FFBD78C0000-0x00007FFBD78E2000-memory.dmp

                                                                                                          Filesize

                                                                                                          136KB

                                                                                                        • memory/5376-602-0x00007FFBCBDC0000-0x00007FFBCC3A8000-memory.dmp

                                                                                                          Filesize

                                                                                                          5.9MB

                                                                                                        • memory/5376-662-0x00007FFBD78F0000-0x00007FFBD7904000-memory.dmp

                                                                                                          Filesize

                                                                                                          80KB

                                                                                                        • memory/5376-661-0x00007FFBD7AC0000-0x00007FFBD7AD5000-memory.dmp

                                                                                                          Filesize

                                                                                                          84KB

                                                                                                        • memory/5376-679-0x00007FFBDA6E0000-0x00007FFBDA703000-memory.dmp

                                                                                                          Filesize

                                                                                                          140KB

                                                                                                        • memory/5376-659-0x00007FFBD7910000-0x00007FFBD7924000-memory.dmp

                                                                                                          Filesize

                                                                                                          80KB

                                                                                                        • memory/5376-658-0x00007FFBD7AA0000-0x00007FFBD7AB2000-memory.dmp

                                                                                                          Filesize

                                                                                                          72KB

                                                                                                        • memory/5376-641-0x00007FFBDA6E0000-0x00007FFBDA703000-memory.dmp

                                                                                                          Filesize

                                                                                                          140KB

                                                                                                        • memory/5376-657-0x00007FFBDD880000-0x00007FFBDD8A4000-memory.dmp

                                                                                                          Filesize

                                                                                                          144KB

                                                                                                        • memory/5376-656-0x00007FFBCB800000-0x00007FFBCBB75000-memory.dmp

                                                                                                          Filesize

                                                                                                          3.5MB

                                                                                                        • memory/5376-682-0x00007FFBD4400000-0x00007FFBD444D000-memory.dmp

                                                                                                          Filesize

                                                                                                          308KB

                                                                                                        • memory/5376-673-0x00007FFBD78A0000-0x00007FFBD78BB000-memory.dmp

                                                                                                          Filesize

                                                                                                          108KB

                                                                                                        • memory/5376-651-0x0000023678AE0000-0x0000023678E55000-memory.dmp

                                                                                                          Filesize

                                                                                                          3.5MB

                                                                                                        • memory/5376-650-0x00007FFBD7930000-0x00007FFBD79E8000-memory.dmp

                                                                                                          Filesize

                                                                                                          736KB

                                                                                                        • memory/5376-649-0x00007FFBCBDC0000-0x00007FFBCC3A8000-memory.dmp

                                                                                                          Filesize

                                                                                                          5.9MB

                                                                                                        • memory/5376-645-0x00007FFBDA6B0000-0x00007FFBDA6DE000-memory.dmp

                                                                                                          Filesize

                                                                                                          184KB

                                                                                                        • memory/5376-686-0x00007FFBD43D0000-0x00007FFBD43DA000-memory.dmp

                                                                                                          Filesize

                                                                                                          40KB

                                                                                                        • memory/5376-695-0x00007FFBD7930000-0x00007FFBD79E8000-memory.dmp

                                                                                                          Filesize

                                                                                                          736KB

                                                                                                        • memory/5376-639-0x00007FFBDA710000-0x00007FFBDA73D000-memory.dmp

                                                                                                          Filesize

                                                                                                          180KB

                                                                                                        • memory/5376-643-0x00007FFBCC9A0000-0x00007FFBCCB13000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.4MB

                                                                                                        • memory/5376-637-0x00007FFBDA740000-0x00007FFBDA759000-memory.dmp

                                                                                                          Filesize

                                                                                                          100KB

                                                                                                        • memory/5376-698-0x00007FFBB7500000-0x00007FFBB7CFB000-memory.dmp

                                                                                                          Filesize

                                                                                                          8.0MB

                                                                                                        • memory/5376-697-0x00007FFBCB800000-0x00007FFBCBB75000-memory.dmp

                                                                                                          Filesize

                                                                                                          3.5MB

                                                                                                        • memory/5376-633-0x00007FFBDD850000-0x00007FFBDD869000-memory.dmp

                                                                                                          Filesize

                                                                                                          100KB

                                                                                                        • memory/5376-687-0x00007FFBD43E0000-0x00007FFBD43F1000-memory.dmp

                                                                                                          Filesize

                                                                                                          68KB

                                                                                                        • memory/5376-688-0x00007FFBD3EB0000-0x00007FFBD3EE2000-memory.dmp

                                                                                                          Filesize

                                                                                                          200KB

                                                                                                        • memory/5376-623-0x00007FFBDD870000-0x00007FFBDD87F000-memory.dmp

                                                                                                          Filesize

                                                                                                          60KB

                                                                                                        • memory/5376-689-0x00007FFBDA6B0000-0x00007FFBDA6DE000-memory.dmp

                                                                                                          Filesize

                                                                                                          184KB

                                                                                                        • memory/5376-690-0x00007FFBD3E90000-0x00007FFBD3EAE000-memory.dmp

                                                                                                          Filesize

                                                                                                          120KB

                                                                                                        • memory/5376-685-0x00007FFBCC9A0000-0x00007FFBCCB13000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.4MB

                                                                                                        • memory/5376-680-0x00007FFBD7880000-0x00007FFBD7899000-memory.dmp

                                                                                                          Filesize

                                                                                                          100KB

                                                                                                        • memory/5376-669-0x00007FFBCBCA0000-0x00007FFBCBDBC000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.1MB

                                                                                                        • memory/5376-726-0x00007FFBD78F0000-0x00007FFBD7904000-memory.dmp

                                                                                                          Filesize

                                                                                                          80KB

                                                                                                        • memory/5376-767-0x00007FFBDCD80000-0x00007FFBDCD8D000-memory.dmp

                                                                                                          Filesize

                                                                                                          52KB

                                                                                                        • memory/5376-766-0x00007FFBD78C0000-0x00007FFBD78E2000-memory.dmp

                                                                                                          Filesize

                                                                                                          136KB

                                                                                                        • memory/5376-663-0x00007FFBDD850000-0x00007FFBDD869000-memory.dmp

                                                                                                          Filesize

                                                                                                          100KB

                                                                                                        • memory/5376-783-0x00007FFBCBCA0000-0x00007FFBCBDBC000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.1MB

                                                                                                        • memory/5376-784-0x00007FFBD78A0000-0x00007FFBD78BB000-memory.dmp

                                                                                                          Filesize

                                                                                                          108KB

                                                                                                        • memory/5376-785-0x00007FFBD7880000-0x00007FFBD7899000-memory.dmp

                                                                                                          Filesize

                                                                                                          100KB

                                                                                                        • memory/5376-786-0x00007FFBD4400000-0x00007FFBD444D000-memory.dmp

                                                                                                          Filesize

                                                                                                          308KB

                                                                                                        • memory/5376-795-0x00007FFBD3EB0000-0x00007FFBD3EE2000-memory.dmp

                                                                                                          Filesize

                                                                                                          200KB