Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

12/02/2023, 19:58

230212-yp4z7sgb88 7

12/02/2023, 19:55

230212-yndfvsfe8z 6

12/02/2023, 14:26

230212-rr4znadh9y 7

Analysis

  • max time kernel
    147s
  • max time network
    180s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12/02/2023, 14:26

General

  • Target

    https://www.dropbox.com/s/l199fl8tua6jn2n/omega.exe?dl=1

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 41 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Detects Pyinstaller 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of FindShellTrayWindow 45 IoCs
  • Suspicious use of SendNotifyMessage 26 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.dropbox.com/s/l199fl8tua6jn2n/omega.exe?dl=1
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd16304f50,0x7ffd16304f60,0x7ffd16304f70
      2⤵
        PID:3776
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1600,12830916878256997022,10433142793291875158,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1660 /prefetch:8
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4108
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1600,12830916878256997022,10433142793291875158,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1612 /prefetch:2
        2⤵
          PID:2220
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1600,12830916878256997022,10433142793291875158,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2116 /prefetch:8
          2⤵
            PID:3420
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1600,12830916878256997022,10433142793291875158,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2764 /prefetch:1
            2⤵
              PID:2628
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1600,12830916878256997022,10433142793291875158,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2812 /prefetch:1
              2⤵
                PID:3064
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1600,12830916878256997022,10433142793291875158,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3960 /prefetch:8
                2⤵
                  PID:4220
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1600,12830916878256997022,10433142793291875158,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5076 /prefetch:8
                  2⤵
                    PID:4168
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1600,12830916878256997022,10433142793291875158,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5088 /prefetch:8
                    2⤵
                      PID:4460
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1600,12830916878256997022,10433142793291875158,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5072
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1600,12830916878256997022,10433142793291875158,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5328 /prefetch:8
                      2⤵
                        PID:3060
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1600,12830916878256997022,10433142793291875158,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5376 /prefetch:8
                        2⤵
                          PID:4844
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1600,12830916878256997022,10433142793291875158,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4588
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,12830916878256997022,10433142793291875158,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5456 /prefetch:8
                          2⤵
                            PID:3712
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1600,12830916878256997022,10433142793291875158,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5640 /prefetch:8
                            2⤵
                              PID:4816
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1600,12830916878256997022,10433142793291875158,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4748
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,12830916878256997022,10433142793291875158,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5616 /prefetch:8
                              2⤵
                                PID:4712
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1600,12830916878256997022,10433142793291875158,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5788 /prefetch:8
                                2⤵
                                  PID:68
                              • C:\Users\Admin\Desktop\omega.exe
                                "C:\Users\Admin\Desktop\omega.exe"
                                1⤵
                                  PID:1128
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\omega_login.bat" "
                                    2⤵
                                      PID:908
                                      • C:\Users\Admin\AppData\Local\Temp\omega.sfx.exe
                                        omega.sfx.exe -pvape -dC:\Users\Admin\AppData\Local\Temp
                                        3⤵
                                        • Executes dropped EXE
                                        PID:2876
                                        • C:\Users\Admin\AppData\Local\Temp\stealer.exe
                                          "C:\Users\Admin\AppData\Local\Temp\stealer.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          PID:4676
                                          • C:\Users\Admin\AppData\Local\Temp\stealer.exe
                                            "C:\Users\Admin\AppData\Local\Temp\stealer.exe"
                                            5⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            PID:4564
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "ver"
                                              6⤵
                                                PID:4712

                                    Network

                                    MITRE ATT&CK Enterprise v6

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46762\VCRUNTIME140.dll

                                      Filesize

                                      106KB

                                      MD5

                                      870fea4e961e2fbd00110d3783e529be

                                      SHA1

                                      a948e65c6f73d7da4ffde4e8533c098a00cc7311

                                      SHA256

                                      76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

                                      SHA512

                                      0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46762\_asyncio.pyd

                                      Filesize

                                      62KB

                                      MD5

                                      4543813a21958d0764975032b09ded7b

                                      SHA1

                                      c571dea89ab89b6aab6da9b88afe78ace90dd882

                                      SHA256

                                      45c229c3988f30580c79b38fc0c19c81e6f7d5778e64cef6ce04dd188a9ccab5

                                      SHA512

                                      3b007ab252cccda210b473ca6e2d4b7fe92c211fb81ade41a5a69c67adde703a9b0bc97990f31dcbe049794c62ba2b70dadf699e83764893a979e95fd6e89d8f

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46762\_bz2.pyd

                                      Filesize

                                      81KB

                                      MD5

                                      bbe89cf70b64f38c67b7bf23c0ea8a48

                                      SHA1

                                      44577016e9c7b463a79b966b67c3ecc868957470

                                      SHA256

                                      775fbc6e9a4c7e9710205157350f3d6141b5a9e8f44cb07b3eac38f2789c8723

                                      SHA512

                                      3ee72ba60541116bbca1a62db64074276d40ad8ed7d0ca199a9c51d65c3f0762a8ef6d0e1e9ebf04bf4efe1347f120e4bc3d502dd288339b4df646a59aad0ec1

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46762\_ctypes.pyd

                                      Filesize

                                      119KB

                                      MD5

                                      ca4cef051737b0e4e56b7d597238df94

                                      SHA1

                                      583df3f7ecade0252fdff608eb969439956f5c4a

                                      SHA256

                                      e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b

                                      SHA512

                                      17103d6b5fa84156055e60f9e5756ffc31584cdb6274c686a136291c58ba0be00238d501f8acc1f1ca7e1a1fadcb0c7fefddcb98cedb9dd04325314f7e905df3

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46762\_hashlib.pyd

                                      Filesize

                                      60KB

                                      MD5

                                      d856a545a960bf2dca1e2d9be32e5369

                                      SHA1

                                      67a15ecf763cdc2c2aa458a521db8a48d816d91e

                                      SHA256

                                      cd33f823e608d3bda759ad441f583a20fc0198119b5a62a8964f172559acb7d3

                                      SHA512

                                      34a074025c8b28f54c01a7fd44700fdedb391f55be39d578a003edb90732dec793c2b0d16da3da5cdbd8adbaa7b3b83fc8887872e284800e7a8389345a30a6a4

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46762\_lzma.pyd

                                      Filesize

                                      153KB

                                      MD5

                                      0a94c9f3d7728cf96326db3ab3646d40

                                      SHA1

                                      8081df1dca4a8520604e134672c4be79eb202d14

                                      SHA256

                                      0a70e8546fa6038029f2a3764e721ceebea415818e5f0df6b90d6a40788c3b31

                                      SHA512

                                      6f047f3bdaead121018623f52a35f7e8b38c58d3a9cb672e8056a5274d02395188975de08cabae948e2cc2c1ca01c74ca7bc1b82e2c23d652e952f3745491087

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46762\_overlapped.pyd

                                      Filesize

                                      47KB

                                      MD5

                                      02c0f2eff280b9a92003786fded7c440

                                      SHA1

                                      5a7fe7ed605ff1c49036d001ae60305e309c5509

                                      SHA256

                                      f16e595b0a87c32d9abd2035f8ea97b39339548e7c518df16a6cc27ba7733973

                                      SHA512

                                      2b05ddf7bc57e8472e5795e68660d52e843271fd08f2e8002376b056a8c20200d31ffd5e194ce486f8a0928a8486951fdb5670246f1c909f82cf4b0929efedac

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46762\_queue.pyd

                                      Filesize

                                      29KB

                                      MD5

                                      52d0a6009d3de40f4fa6ec61db98c45c

                                      SHA1

                                      5083a2aff5bcce07c80409646347c63d2a87bd25

                                      SHA256

                                      007bcf19d9b036a7e73f5ef31f39bfb1910f72c9c10e4a1b0658352cfe7a8b75

                                      SHA512

                                      cd552a38efaa8720a342b60318f62320ce20c03871d2e50d3fa3a9a730b84dacdbb8eb4d0ab7a1c8a97215b537826c8dc532c9a55213bcd0c1d13d7d8a9ad824

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46762\_socket.pyd

                                      Filesize

                                      75KB

                                      MD5

                                      0f5e64e33f4d328ef11357635707d154

                                      SHA1

                                      8b6dcb4b9952b362f739a3f16ae96c44bea94a0e

                                      SHA256

                                      8af6d70d44bb9398733f88bcfb6d2085dd1a193cd00e52120b96a651f6e35ebe

                                      SHA512

                                      4be9febb583364da75b6fb3a43a8b50ee29ca8fc1dda35b96c0fcc493342372f69b4f27f2604888bca099c8d00f38a16f4c9463c16eff098227d812c29563643

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46762\_sqlite3.pyd

                                      Filesize

                                      95KB

                                      MD5

                                      9f38f603bd8f7559609c4ffa47f23c86

                                      SHA1

                                      8b0136fc2506c1ccef2009db663e4e7006e23c92

                                      SHA256

                                      28090432a18b59eb8cbe8fdcf11a277420b404007f31ca571321488a43b96319

                                      SHA512

                                      273a19f2f609bede9634dae7c47d7b28d369c88420b2b62d42858b1268d6c19b450d83877d2dba241e52755a3f67a87f63fea8e5754831c86d16e2a8f214ad72

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46762\_ssl.pyd

                                      Filesize

                                      155KB

                                      MD5

                                      9ddb64354ef0b91c6999a4b244a0a011

                                      SHA1

                                      86a9dc5ea931638699eb6d8d03355ad7992d2fee

                                      SHA256

                                      e33b7a4aa5cdd5462ee66830636fdd38048575a43d06eb7e2f688358525ddeab

                                      SHA512

                                      4c86478861fa4220680a94699e7d55fbdc90d2785caee10619cecb058f833292ee7c3d6ac2ed1ef34b38fbff628b79d672194a337701727a54bb6bbc5bf9aeca

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46762\base_library.zip

                                      Filesize

                                      1.0MB

                                      MD5

                                      b8b69095629fb834685a30c4548b6c89

                                      SHA1

                                      4ee72c2726234b6f6029760bb92296b61fb2e80d

                                      SHA256

                                      89e70656b0296ad83f36287d112465f12efe85b778b6777eb54efed589ea3e62

                                      SHA512

                                      5053ec44ee662b82dfa36330cd2b1e281883310dbd2fa0d75b3c094b05fb66a51e71d343eab05e5fb80c85b50c8dbbb89390ab6d2db3338cf31db06f87b074bf

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46762\charset_normalizer\md.cp310-win_amd64.pyd

                                      Filesize

                                      10KB

                                      MD5

                                      b8a9e1f06aedeb45123ab9dd97463040

                                      SHA1

                                      587ad1ccd9b1ea877438c2c1e5507918bb8af9ea

                                      SHA256

                                      95366eaf4d86298b56eaa7fed906b10c794fc1b766a9fd16fa5803b804c327d5

                                      SHA512

                                      1905d46e787d6d849984bf431c5dc4027dcd432a665bc24d28541826b59e0a95918739ac1314b857509f970809b1ec58b72cf4a165077163b4fac9fbadda555c

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46762\libcrypto-1_1.dll

                                      Filesize

                                      3.3MB

                                      MD5

                                      6f4b8eb45a965372156086201207c81f

                                      SHA1

                                      8278f9539463f0a45009287f0516098cb7a15406

                                      SHA256

                                      976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541

                                      SHA512

                                      2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46762\libffi-7.dll

                                      Filesize

                                      32KB

                                      MD5

                                      eef7981412be8ea459064d3090f4b3aa

                                      SHA1

                                      c60da4830ce27afc234b3c3014c583f7f0a5a925

                                      SHA256

                                      f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

                                      SHA512

                                      dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46762\libssl-1_1.dll

                                      Filesize

                                      686KB

                                      MD5

                                      8769adafca3a6fc6ef26f01fd31afa84

                                      SHA1

                                      38baef74bdd2e941ccd321f91bfd49dacc6a3cb6

                                      SHA256

                                      2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071

                                      SHA512

                                      fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46762\pyexpat.pyd

                                      Filesize

                                      193KB

                                      MD5

                                      43e5a1470c298ba773ac9fcf5d99e8f9

                                      SHA1

                                      06db03daf3194c9e492b2f406b38ed33a8c87ab3

                                      SHA256

                                      56984d43be27422d31d8ece87d0abda2c0662ea2ff22af755e49e3462a5f8b65

                                      SHA512

                                      a5a1ebb34091ea17c8f0e7748004558d13807fdc16529bc6f8f6c6a3a586ee997bf72333590dc451d78d9812ef8adfa7deabab6c614fce537f56fa38ce669cfc

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46762\python310.dll

                                      Filesize

                                      4.3MB

                                      MD5

                                      deaf0c0cc3369363b800d2e8e756a402

                                      SHA1

                                      3085778735dd8badad4e39df688139f4eed5f954

                                      SHA256

                                      156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

                                      SHA512

                                      5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46762\select.pyd

                                      Filesize

                                      28KB

                                      MD5

                                      c119811a40667dca93dfe6faa418f47a

                                      SHA1

                                      113e792b7dcec4366fc273e80b1fc404c309074c

                                      SHA256

                                      8f27cd8c5071cb740a2191b3c599e99595b121f461988166f07d9f841e7116b7

                                      SHA512

                                      107257dbd8cf2607e4a1c7bef928a6f61ebdfc21be1c4bdc3a649567e067e9bb7ea40c0ac8844d2cedd08682447b963148b52f85adb1837f243df57af94c04b3

                                    • C:\Users\Admin\AppData\Local\Temp\_MEI46762\sqlite3.dll

                                      Filesize

                                      1.4MB

                                      MD5

                                      aaf9fd98bc2161ad7dff996450173a3b

                                      SHA1

                                      ab634c09b60aa18ea165084a042d917b65d1fe85

                                      SHA256

                                      f1e8b6c4d61ac6a320fa2566da9391fbfd65a5ac34ac2e2013bc37c8b7b41592

                                      SHA512

                                      597ffe3c2f0966ab94fbb7ecac27160c691f4a07332311f6a9baf8dec8b16fb16ec64df734c3bdbabf2c0328699e234d14f1b8bd5ac951782d35ea0c78899e5f

                                    • C:\Users\Admin\AppData\Local\Temp\omega.sfx.exe

                                      Filesize

                                      10.4MB

                                      MD5

                                      dd31fbafe4c9c57da0f19c453a09e955

                                      SHA1

                                      96bf35a1cbdafa055e8da8add5e35720ad7c328a

                                      SHA256

                                      e7443e501b6b76fef3137baf8f858b35761579a410485074de7494d6286e5ff7

                                      SHA512

                                      43145e7dcec7b38333553b282b4b7883d4428a5a05971243a46a9c373a1aa4ed232536d3d2f7dbea517bf6d36a8a1a783ac969f19bb66c80c4d48e8adb41be61

                                    • C:\Users\Admin\AppData\Local\Temp\omega.sfx.exe

                                      Filesize

                                      10.4MB

                                      MD5

                                      dd31fbafe4c9c57da0f19c453a09e955

                                      SHA1

                                      96bf35a1cbdafa055e8da8add5e35720ad7c328a

                                      SHA256

                                      e7443e501b6b76fef3137baf8f858b35761579a410485074de7494d6286e5ff7

                                      SHA512

                                      43145e7dcec7b38333553b282b4b7883d4428a5a05971243a46a9c373a1aa4ed232536d3d2f7dbea517bf6d36a8a1a783ac969f19bb66c80c4d48e8adb41be61

                                    • C:\Users\Admin\AppData\Local\Temp\omega_login.bat

                                      Filesize

                                      29B

                                      MD5

                                      59926e1103d12fa7201150bdebbe4f3c

                                      SHA1

                                      d98ce7af2e01239a3752930d81ef81aa47e3906a

                                      SHA256

                                      d3e4cac4ff1254a15d1dd89d28adc58b6399ee6d58f30a4a07abddaa6dd2a764

                                      SHA512

                                      f7b8029d1f8be0031fdc4404b12bc61438a25df0e3600ef5e6e7bfebb1d652af4ad79f57fc9fc5a4a140247ce1f484529294fb5aef351f09a76db87a9b44772e

                                    • C:\Users\Admin\AppData\Local\Temp\stealer.exe

                                      Filesize

                                      10.2MB

                                      MD5

                                      6429ad5b80f89d0967dc69188166f801

                                      SHA1

                                      03963ef3b60d4a2b2dd2b0fb777b62f8d2012d9c

                                      SHA256

                                      6461df81c1f894620f1a7ec288bcbe9995cc27737fa56194b2b59f747e64b9b2

                                      SHA512

                                      291324db290fe431140de1c50b738a82fa9a4112103c79ad5b564fa60422af439f1d6f2d95f40be37b19c84cf8ffc8c138dde8df4e7b5df84be3f7b0d0e5dadf

                                    • C:\Users\Admin\AppData\Local\Temp\stealer.exe

                                      Filesize

                                      10.2MB

                                      MD5

                                      6429ad5b80f89d0967dc69188166f801

                                      SHA1

                                      03963ef3b60d4a2b2dd2b0fb777b62f8d2012d9c

                                      SHA256

                                      6461df81c1f894620f1a7ec288bcbe9995cc27737fa56194b2b59f747e64b9b2

                                      SHA512

                                      291324db290fe431140de1c50b738a82fa9a4112103c79ad5b564fa60422af439f1d6f2d95f40be37b19c84cf8ffc8c138dde8df4e7b5df84be3f7b0d0e5dadf

                                    • C:\Users\Admin\AppData\Local\Temp\stealer.exe

                                      Filesize

                                      10.2MB

                                      MD5

                                      6429ad5b80f89d0967dc69188166f801

                                      SHA1

                                      03963ef3b60d4a2b2dd2b0fb777b62f8d2012d9c

                                      SHA256

                                      6461df81c1f894620f1a7ec288bcbe9995cc27737fa56194b2b59f747e64b9b2

                                      SHA512

                                      291324db290fe431140de1c50b738a82fa9a4112103c79ad5b564fa60422af439f1d6f2d95f40be37b19c84cf8ffc8c138dde8df4e7b5df84be3f7b0d0e5dadf

                                    • \Users\Admin\AppData\Local\Temp\_MEI46762\VCRUNTIME140.dll

                                      Filesize

                                      106KB

                                      MD5

                                      870fea4e961e2fbd00110d3783e529be

                                      SHA1

                                      a948e65c6f73d7da4ffde4e8533c098a00cc7311

                                      SHA256

                                      76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

                                      SHA512

                                      0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

                                    • \Users\Admin\AppData\Local\Temp\_MEI46762\_asyncio.pyd

                                      Filesize

                                      62KB

                                      MD5

                                      4543813a21958d0764975032b09ded7b

                                      SHA1

                                      c571dea89ab89b6aab6da9b88afe78ace90dd882

                                      SHA256

                                      45c229c3988f30580c79b38fc0c19c81e6f7d5778e64cef6ce04dd188a9ccab5

                                      SHA512

                                      3b007ab252cccda210b473ca6e2d4b7fe92c211fb81ade41a5a69c67adde703a9b0bc97990f31dcbe049794c62ba2b70dadf699e83764893a979e95fd6e89d8f

                                    • \Users\Admin\AppData\Local\Temp\_MEI46762\_bz2.pyd

                                      Filesize

                                      81KB

                                      MD5

                                      bbe89cf70b64f38c67b7bf23c0ea8a48

                                      SHA1

                                      44577016e9c7b463a79b966b67c3ecc868957470

                                      SHA256

                                      775fbc6e9a4c7e9710205157350f3d6141b5a9e8f44cb07b3eac38f2789c8723

                                      SHA512

                                      3ee72ba60541116bbca1a62db64074276d40ad8ed7d0ca199a9c51d65c3f0762a8ef6d0e1e9ebf04bf4efe1347f120e4bc3d502dd288339b4df646a59aad0ec1

                                    • \Users\Admin\AppData\Local\Temp\_MEI46762\_ctypes.pyd

                                      Filesize

                                      119KB

                                      MD5

                                      ca4cef051737b0e4e56b7d597238df94

                                      SHA1

                                      583df3f7ecade0252fdff608eb969439956f5c4a

                                      SHA256

                                      e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b

                                      SHA512

                                      17103d6b5fa84156055e60f9e5756ffc31584cdb6274c686a136291c58ba0be00238d501f8acc1f1ca7e1a1fadcb0c7fefddcb98cedb9dd04325314f7e905df3

                                    • \Users\Admin\AppData\Local\Temp\_MEI46762\_hashlib.pyd

                                      Filesize

                                      60KB

                                      MD5

                                      d856a545a960bf2dca1e2d9be32e5369

                                      SHA1

                                      67a15ecf763cdc2c2aa458a521db8a48d816d91e

                                      SHA256

                                      cd33f823e608d3bda759ad441f583a20fc0198119b5a62a8964f172559acb7d3

                                      SHA512

                                      34a074025c8b28f54c01a7fd44700fdedb391f55be39d578a003edb90732dec793c2b0d16da3da5cdbd8adbaa7b3b83fc8887872e284800e7a8389345a30a6a4

                                    • \Users\Admin\AppData\Local\Temp\_MEI46762\_lzma.pyd

                                      Filesize

                                      153KB

                                      MD5

                                      0a94c9f3d7728cf96326db3ab3646d40

                                      SHA1

                                      8081df1dca4a8520604e134672c4be79eb202d14

                                      SHA256

                                      0a70e8546fa6038029f2a3764e721ceebea415818e5f0df6b90d6a40788c3b31

                                      SHA512

                                      6f047f3bdaead121018623f52a35f7e8b38c58d3a9cb672e8056a5274d02395188975de08cabae948e2cc2c1ca01c74ca7bc1b82e2c23d652e952f3745491087

                                    • \Users\Admin\AppData\Local\Temp\_MEI46762\_overlapped.pyd

                                      Filesize

                                      47KB

                                      MD5

                                      02c0f2eff280b9a92003786fded7c440

                                      SHA1

                                      5a7fe7ed605ff1c49036d001ae60305e309c5509

                                      SHA256

                                      f16e595b0a87c32d9abd2035f8ea97b39339548e7c518df16a6cc27ba7733973

                                      SHA512

                                      2b05ddf7bc57e8472e5795e68660d52e843271fd08f2e8002376b056a8c20200d31ffd5e194ce486f8a0928a8486951fdb5670246f1c909f82cf4b0929efedac

                                    • \Users\Admin\AppData\Local\Temp\_MEI46762\_queue.pyd

                                      Filesize

                                      29KB

                                      MD5

                                      52d0a6009d3de40f4fa6ec61db98c45c

                                      SHA1

                                      5083a2aff5bcce07c80409646347c63d2a87bd25

                                      SHA256

                                      007bcf19d9b036a7e73f5ef31f39bfb1910f72c9c10e4a1b0658352cfe7a8b75

                                      SHA512

                                      cd552a38efaa8720a342b60318f62320ce20c03871d2e50d3fa3a9a730b84dacdbb8eb4d0ab7a1c8a97215b537826c8dc532c9a55213bcd0c1d13d7d8a9ad824

                                    • \Users\Admin\AppData\Local\Temp\_MEI46762\_socket.pyd

                                      Filesize

                                      75KB

                                      MD5

                                      0f5e64e33f4d328ef11357635707d154

                                      SHA1

                                      8b6dcb4b9952b362f739a3f16ae96c44bea94a0e

                                      SHA256

                                      8af6d70d44bb9398733f88bcfb6d2085dd1a193cd00e52120b96a651f6e35ebe

                                      SHA512

                                      4be9febb583364da75b6fb3a43a8b50ee29ca8fc1dda35b96c0fcc493342372f69b4f27f2604888bca099c8d00f38a16f4c9463c16eff098227d812c29563643

                                    • \Users\Admin\AppData\Local\Temp\_MEI46762\_sqlite3.pyd

                                      Filesize

                                      95KB

                                      MD5

                                      9f38f603bd8f7559609c4ffa47f23c86

                                      SHA1

                                      8b0136fc2506c1ccef2009db663e4e7006e23c92

                                      SHA256

                                      28090432a18b59eb8cbe8fdcf11a277420b404007f31ca571321488a43b96319

                                      SHA512

                                      273a19f2f609bede9634dae7c47d7b28d369c88420b2b62d42858b1268d6c19b450d83877d2dba241e52755a3f67a87f63fea8e5754831c86d16e2a8f214ad72

                                    • \Users\Admin\AppData\Local\Temp\_MEI46762\_ssl.pyd

                                      Filesize

                                      155KB

                                      MD5

                                      9ddb64354ef0b91c6999a4b244a0a011

                                      SHA1

                                      86a9dc5ea931638699eb6d8d03355ad7992d2fee

                                      SHA256

                                      e33b7a4aa5cdd5462ee66830636fdd38048575a43d06eb7e2f688358525ddeab

                                      SHA512

                                      4c86478861fa4220680a94699e7d55fbdc90d2785caee10619cecb058f833292ee7c3d6ac2ed1ef34b38fbff628b79d672194a337701727a54bb6bbc5bf9aeca

                                    • \Users\Admin\AppData\Local\Temp\_MEI46762\charset_normalizer\md.cp310-win_amd64.pyd

                                      Filesize

                                      10KB

                                      MD5

                                      b8a9e1f06aedeb45123ab9dd97463040

                                      SHA1

                                      587ad1ccd9b1ea877438c2c1e5507918bb8af9ea

                                      SHA256

                                      95366eaf4d86298b56eaa7fed906b10c794fc1b766a9fd16fa5803b804c327d5

                                      SHA512

                                      1905d46e787d6d849984bf431c5dc4027dcd432a665bc24d28541826b59e0a95918739ac1314b857509f970809b1ec58b72cf4a165077163b4fac9fbadda555c

                                    • \Users\Admin\AppData\Local\Temp\_MEI46762\libcrypto-1_1.dll

                                      Filesize

                                      3.3MB

                                      MD5

                                      6f4b8eb45a965372156086201207c81f

                                      SHA1

                                      8278f9539463f0a45009287f0516098cb7a15406

                                      SHA256

                                      976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541

                                      SHA512

                                      2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f

                                    • \Users\Admin\AppData\Local\Temp\_MEI46762\libcrypto-1_1.dll

                                      Filesize

                                      3.3MB

                                      MD5

                                      6f4b8eb45a965372156086201207c81f

                                      SHA1

                                      8278f9539463f0a45009287f0516098cb7a15406

                                      SHA256

                                      976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541

                                      SHA512

                                      2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f

                                    • \Users\Admin\AppData\Local\Temp\_MEI46762\libffi-7.dll

                                      Filesize

                                      32KB

                                      MD5

                                      eef7981412be8ea459064d3090f4b3aa

                                      SHA1

                                      c60da4830ce27afc234b3c3014c583f7f0a5a925

                                      SHA256

                                      f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

                                      SHA512

                                      dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

                                    • \Users\Admin\AppData\Local\Temp\_MEI46762\libssl-1_1.dll

                                      Filesize

                                      686KB

                                      MD5

                                      8769adafca3a6fc6ef26f01fd31afa84

                                      SHA1

                                      38baef74bdd2e941ccd321f91bfd49dacc6a3cb6

                                      SHA256

                                      2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071

                                      SHA512

                                      fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b

                                    • \Users\Admin\AppData\Local\Temp\_MEI46762\pyexpat.pyd

                                      Filesize

                                      193KB

                                      MD5

                                      43e5a1470c298ba773ac9fcf5d99e8f9

                                      SHA1

                                      06db03daf3194c9e492b2f406b38ed33a8c87ab3

                                      SHA256

                                      56984d43be27422d31d8ece87d0abda2c0662ea2ff22af755e49e3462a5f8b65

                                      SHA512

                                      a5a1ebb34091ea17c8f0e7748004558d13807fdc16529bc6f8f6c6a3a586ee997bf72333590dc451d78d9812ef8adfa7deabab6c614fce537f56fa38ce669cfc

                                    • \Users\Admin\AppData\Local\Temp\_MEI46762\python310.dll

                                      Filesize

                                      4.3MB

                                      MD5

                                      deaf0c0cc3369363b800d2e8e756a402

                                      SHA1

                                      3085778735dd8badad4e39df688139f4eed5f954

                                      SHA256

                                      156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

                                      SHA512

                                      5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

                                    • \Users\Admin\AppData\Local\Temp\_MEI46762\select.pyd

                                      Filesize

                                      28KB

                                      MD5

                                      c119811a40667dca93dfe6faa418f47a

                                      SHA1

                                      113e792b7dcec4366fc273e80b1fc404c309074c

                                      SHA256

                                      8f27cd8c5071cb740a2191b3c599e99595b121f461988166f07d9f841e7116b7

                                      SHA512

                                      107257dbd8cf2607e4a1c7bef928a6f61ebdfc21be1c4bdc3a649567e067e9bb7ea40c0ac8844d2cedd08682447b963148b52f85adb1837f243df57af94c04b3

                                    • \Users\Admin\AppData\Local\Temp\_MEI46762\sqlite3.dll

                                      Filesize

                                      1.4MB

                                      MD5

                                      aaf9fd98bc2161ad7dff996450173a3b

                                      SHA1

                                      ab634c09b60aa18ea165084a042d917b65d1fe85

                                      SHA256

                                      f1e8b6c4d61ac6a320fa2566da9391fbfd65a5ac34ac2e2013bc37c8b7b41592

                                      SHA512

                                      597ffe3c2f0966ab94fbb7ecac27160c691f4a07332311f6a9baf8dec8b16fb16ec64df734c3bdbabf2c0328699e234d14f1b8bd5ac951782d35ea0c78899e5f

                                    • memory/1128-147-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-153-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-169-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-167-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-170-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-171-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-172-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-173-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-174-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-175-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-176-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-177-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-178-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-179-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-180-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-181-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-182-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-166-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-165-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-117-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-164-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-163-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-162-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-118-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-161-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-119-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-160-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-159-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-158-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-157-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-156-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-155-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-154-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-168-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-152-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-151-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-150-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-149-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-148-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-146-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-145-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-144-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-143-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-142-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-141-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-140-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-139-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-138-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-120-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-137-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-136-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-135-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-134-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-133-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-132-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-131-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-130-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-129-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-128-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-127-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-126-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-125-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-123-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/1128-122-0x00000000778F0000-0x0000000077A7E000-memory.dmp

                                      Filesize

                                      1.6MB