5621c6846841ecf9616a34d267238283bdf4653f983ced0d31766f6ab89c4155

Analysis

user interaction
yes
max time kernel
900s
max time network
488s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 17:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Agisoft Metashape Professional 2.2.2 Build 20760.rar
Size 191.0MB
Sample261014-vqpp5aws5j
SHA256 5621c6846841ecf9616a34d267238283bdf4653f983ced0d31766f6ab89c4155
MD5 d7c08268da02c887809ce4555ccf0e3e
SHA1 3016bf385ea35a668724c2ffd82f9a305c266e18
SHA512 c93aa349cab8379e20466256718f9b3117fda01d2b1417fca4ce9e7998f1ce1b4cd1d8b17d655e699ec0f37af0a0c3cba6c5efa47d3f44d4e7a4dc99c3642628
SSDEEP 3145728:c3rOT4I47bgfuyshbpC3XL4fzxQwg1UM5CY0NkWW9eFqC2rrWERcXzJrCHBK4d:aOT4I4vgfuRYXsrg1Z5CzW9eFRERcXzo
TLSH
T186A833FE03ACE3E73C3A81504747D982F2614C0260A7D8875FA97D1492A52D9BCBB7D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution ransomware

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
388	metashape.exe
3492	metashape.exe
2080	metashape.exe

Loads dropped DLL 64 IoCs

pid	Process
1524	MsiExec.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
3492	metashape.exe
3492	metashape.exe
3492	metashape.exe
3492	metashape.exe
3492	metashape.exe
3492	metashape.exe
3492	metashape.exe
3492	metashape.exe
3492	metashape.exe
3492	metashape.exe
3492	metashape.exe
3492	metashape.exe
3492	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
58	4988	msiexec.exe
60	4988	msiexec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\F:	metashape.exe
File opened (read-only)	\??\F:	metashape.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 6 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
388	metashape.exe
388	metashape.exe
3492	metashape.exe
3492	metashape.exe
2080	metashape.exe
2080	metashape.exe

Drops file in Windows directory 40 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5c98ec.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140_atomic_wait.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\metashapepsz.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\metashapepsz.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\monitor.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140_atomic_wait.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\vcomp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\metashape.ico	msiexec.exe
File created	C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\viewer.ico	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\metashape.ico	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA7F0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5	msiexec.exe
File created	C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\metashapepsx.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\metashapepsx.ico	msiexec.exe
File created	C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\monitor.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\vcomp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2	msiexec.exe
File created	C:\Windows\Installer\SourceHash{298426DB-4948-4D93-9699-F8A208F6DC5D}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\{298426DB-4948-4D93-9699-F8A208F6DC5D}\viewer.ico	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\BD624892849439D469998F2A806FCDD5\2.2.2\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\e5c98ee.msi	msiexec.exe
File created	C:\Windows\Installer\e5c98ec.msi	msiexec.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 2 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	metashape.exe
File opened (read-only)	\??\PhysicalDrive0	metashape.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
7112	cmd.exe
7888	cmd.exe
7900	cmd.exe
7716	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	metashape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	metashape.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001302849f6a5860da0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001302849f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809001302849f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a1302849f000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1302849f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6428	ipconfig.exe
7940	ipconfig.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 54 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\Version = "33685506"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D2399D4A622365E41A4E9FC7273D49CB\BD624892849439D469998F2A806FCDD5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\shell	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\shell\open\command\command = 28002800330045003100450031003f007800400049003100340048005d0062002e003800320046004d006500740061007300680061007000650046006500610074007500720065003e004700300070007d005f0038004800390045004600310062004f0079002d00760030006800600071002000220025003100220000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\ = "Metashape Project"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BD624892849439D469998F2A806FCDD5\ViewerFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BD624892849439D469998F2A806FCDD5\MonitorFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\agi\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\shell\open\command\command = 28002800330045003100450031003f007800400049003100340048005d0062002e003800320046004d006500740061007300680061007000650046006500610074007500720065003e004700300070007d005f0038004800390045004600310062004f0079002d00760030006800600071002000220025003100220000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\shell\open\ = "&Open"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\ = "Metashape Archive"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BD624892849439D469998F2A806FCDD5\VCRedist	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.psz\ = "Metashape.psz"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.psx\Metashape.psx\ShellNew	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.psx	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\DefaultIcon\ = "C:\\Windows\\Installer\\{298426DB-4948-4D93-9699-F8A208F6DC5D}\\metashapepsz.ico,0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\agi\\metashape.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.psx\ = "Metashape.psx"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\ProductIcon = "C:\\Windows\\Installer\\{298426DB-4948-4D93-9699-F8A208F6DC5D}\\metashape.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\shell\open\ = "&Open"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.psz	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\PackageCode = "F65D5439C74338741B76223E9ADA1C71"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\SourceList\PackageName = "Setup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.psx\Metashape.psx	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BD624892849439D469998F2A806FCDD5\MetashapeFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D2399D4A622365E41A4E9FC7273D49CB	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\agi\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\agi\\metashape.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.psz\Metashape.psz	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\DefaultIcon\ = "C:\\Windows\\Installer\\{298426DB-4948-4D93-9699-F8A208F6DC5D}\\metashapepsx.ico,0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BD624892849439D469998F2A806FCDD5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.psz\Metashape.psz\ShellNew	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psx\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Metashape.psz\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BD624892849439D469998F2A806FCDD5\ProductName = "Agisoft Metashape Professional"	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
388	metashape.exe
2080	metashape.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4584	msiexec.exe
4584	msiexec.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
3492	metashape.exe
3492	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
2080	metashape.exe
2080	metashape.exe
2080	metashape.exe
2080	metashape.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
4004	7zFM.exe
4988	msiexec.exe
388	metashape.exe
2080	metashape.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4004	7zFM.exe
Token: 35	4004	7zFM.exe
Token: SeSecurityPrivilege	4004	7zFM.exe
Token: SeShutdownPrivilege	4988	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4988	msiexec.exe
Token: SeSecurityPrivilege	4584	msiexec.exe
Token: SeCreateTokenPrivilege	4988	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4988	msiexec.exe
Token: SeLockMemoryPrivilege	4988	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4988	msiexec.exe
Token: SeMachineAccountPrivilege	4988	msiexec.exe
Token: SeTcbPrivilege	4988	msiexec.exe
Token: SeSecurityPrivilege	4988	msiexec.exe
Token: SeTakeOwnershipPrivilege	4988	msiexec.exe
Token: SeLoadDriverPrivilege	4988	msiexec.exe
Token: SeSystemProfilePrivilege	4988	msiexec.exe
Token: SeSystemtimePrivilege	4988	msiexec.exe
Token: SeProfSingleProcessPrivilege	4988	msiexec.exe
Token: SeIncBasePriorityPrivilege	4988	msiexec.exe
Token: SeCreatePagefilePrivilege	4988	msiexec.exe
Token: SeCreatePermanentPrivilege	4988	msiexec.exe
Token: SeBackupPrivilege	4988	msiexec.exe
Token: SeRestorePrivilege	4988	msiexec.exe
Token: SeShutdownPrivilege	4988	msiexec.exe
Token: SeDebugPrivilege	4988	msiexec.exe
Token: SeAuditPrivilege	4988	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4988	msiexec.exe
Token: SeChangeNotifyPrivilege	4988	msiexec.exe
Token: SeRemoteShutdownPrivilege	4988	msiexec.exe
Token: SeUndockPrivilege	4988	msiexec.exe
Token: SeSyncAgentPrivilege	4988	msiexec.exe
Token: SeEnableDelegationPrivilege	4988	msiexec.exe
Token: SeManageVolumePrivilege	4988	msiexec.exe
Token: SeImpersonatePrivilege	4988	msiexec.exe
Token: SeCreateGlobalPrivilege	4988	msiexec.exe
Token: SeCreateTokenPrivilege	4988	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4988	msiexec.exe
Token: SeLockMemoryPrivilege	4988	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4988	msiexec.exe
Token: SeMachineAccountPrivilege	4988	msiexec.exe
Token: SeTcbPrivilege	4988	msiexec.exe
Token: SeSecurityPrivilege	4988	msiexec.exe
Token: SeTakeOwnershipPrivilege	4988	msiexec.exe
Token: SeLoadDriverPrivilege	4988	msiexec.exe
Token: SeSystemProfilePrivilege	4988	msiexec.exe
Token: SeSystemtimePrivilege	4988	msiexec.exe
Token: SeProfSingleProcessPrivilege	4988	msiexec.exe
Token: SeIncBasePriorityPrivilege	4988	msiexec.exe
Token: SeCreatePagefilePrivilege	4988	msiexec.exe
Token: SeCreatePermanentPrivilege	4988	msiexec.exe
Token: SeBackupPrivilege	4988	msiexec.exe
Token: SeRestorePrivilege	4988	msiexec.exe
Token: SeShutdownPrivilege	4988	msiexec.exe
Token: SeDebugPrivilege	4988	msiexec.exe
Token: SeAuditPrivilege	4988	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4988	msiexec.exe
Token: SeChangeNotifyPrivilege	4988	msiexec.exe
Token: SeRemoteShutdownPrivilege	4988	msiexec.exe
Token: SeUndockPrivilege	4988	msiexec.exe
Token: SeSyncAgentPrivilege	4988	msiexec.exe
Token: SeEnableDelegationPrivilege	4988	msiexec.exe
Token: SeManageVolumePrivilege	4988	msiexec.exe
Token: SeImpersonatePrivilege	4988	msiexec.exe
Token: SeCreateGlobalPrivilege	4988	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4004	7zFM.exe
4004	7zFM.exe
4004	7zFM.exe
4988	msiexec.exe
4988	msiexec.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
388	metashape.exe
388	metashape.exe
388	metashape.exe
388	metashape.exe
2080	metashape.exe
2080	metashape.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 1524	4584	msiexec.exe	113
PID 4584 wrote to memory of 640	4584	msiexec.exe	117
PID 388 wrote to memory of 7716	388	metashape.exe	131
PID 388 wrote to memory of 7112	388	metashape.exe	132
PID 388 wrote to memory of 6428	388	metashape.exe	133
PID 2080 wrote to memory of 7888	2080	metashape.exe	136
PID 2080 wrote to memory of 7900	2080	metashape.exe	137
PID 2080 wrote to memory of 7940	2080	metashape.exe	138

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Agisoft Metashape Professional 2.2.2 Build 20760.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4004

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3632

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\agi\Setup.msi"
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4988

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 04D3846DFB0407D6AF0AE1D1185CF278 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1524
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:640

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3472

C:\Users\Admin\Downloads\agi\metashape.exe
"C:\Users\Admin\Downloads\agi\metashape.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:7716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:7112
- C:\Windows\SYSTEM32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:6428

C:\Users\Admin\Downloads\agi\metashape.exe
"C:\Users\Admin\Downloads\agi\metashape.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3492

C:\Users\Admin\Downloads\agi\metashape.exe
"C:\Users\Admin\Downloads\agi\metashape.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:7888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:7900
- C:\Windows\SYSTEM32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:7940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Direct Volume Access

T1006

Credential Access

Discovery

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5c98ed.rbs

Path C:\Config.Msi\e5c98ed.rbs
Size 1.6MB
SHA256 491e732d3cc869a6305ca1c64dab5d9ead323b12f89f1cf6cdb55ed696e35152
MD5 32d622a79c1f4b157d1143a33826d9dc
SHA1 3a08effa1fa02651a08a6b51bc0b9c05c5e2e411
SHA512 c6c3a16098d8e8577095f7eb15d64f7e43de825a7ead375241df68600bb62eb7c8b3fefced96bfb521641318351b4d5351dd17b9fb7f96228a1873b7792d4451
SSDEEP 6144:N+y5DT/30mfzpq1GDxQ4ozgAxtftZ9zxH9/fomp99IrPXLX24S1ZX41QJ4R7ZmUe:dNeLZbH9//p99Ir0pvQHRGE0OI0yN
TLSH
T1C775F47B498EDE5A511AB837137933FC90DD3CE27F9139419F778D20692482AAD93A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_A784AE3E993E9BBF7162E8F9F9758D3D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_A784AE3E993E9BBF7162E8F9F9758D3D
Size 1KB
SHA256 499008443dbba54263a4ec01acdafdbd960b13af2a686c0c16205e2bb1357838
MD5 f840971a6bcc48eb08573cd18ae60bad
SHA1 1a351c48d71de4ef2ad42cd374dbab500721302d
SHA512 ce318f62cf0dec3476e3acb17034e9bf622a2c0db8d49968777170a3f087edef13f137ff41c4c921ba47bc7c896a24d044256b871ffbece2ca885dac6e33e306
TLSH
T14B31BA1AEE7435535E90A6E45AE6F1337CAC77D15DDA31406435450670913B33F85C8E
MD5 SHA1 SHA512 TLSH

Submit Download

A1D627669EFC8CD4F21BCF387D97F9B5_0280B1903B52025320CB6FA6404D35EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_0280B1903B52025320CB6FA6404D35EA
Size 1KB
SHA256 5a1f7a1051dd2b5dcdf91a539c3f9d5747f4de20f98333672add64e334dce033
MD5 873219f32627ee43c0b1d5129248484c
SHA1 510d6cc9403baa47edf17b0fcf30405036140ab4
SHA512 a577758d0915461f691ad2b7ed8c88e18edba7c90b605cb3180c48db0140460fda30a2a606911efd4f8a8158a259395047a648b8133607482547175ae76287e9
TLSH
T10F31944A8AB93A03BB09C95555D2AD736CF026ACC5ED26AB24971AC938903B28E17015
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_A784AE3E993E9BBF7162E8F9F9758D3D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_A784AE3E993E9BBF7162E8F9F9758D3D
Size 532B
SHA256 e056fa0b5e6342982b590d44d02b7ee40c01fc130883a84772b3d11c35e4617d
MD5 12617cbecf8cecc9b26b07aefc367ce3
SHA1 8c0ffedeff856f0d1a5397bf9bf15992b87dd17e
SHA512 3b6a3077ba296cdc76c3b579f78cf09f6ec2bdbb2868522680be582525015d72e4233ce189281d328ecafc4a7a8c213a90a6ecfb828c2bcb78dadb718af77f95
TLSH
T1D2F02E3813F9010FF4BAD5B91AC097219966ED1614095277028B475C9E75A405C6612E
MD5 SHA1 SHA512 TLSH

Submit Download

A1D627669EFC8CD4F21BCF387D97F9B5_0280B1903B52025320CB6FA6404D35EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_0280B1903B52025320CB6FA6404D35EA
Size 540B
SHA256 fbad07c86b2871b34cfde8dad4bb995dd8b85b1c33a68cfb0e95f75a1efe6789
MD5 955d857b9adc212d737a3e410dfb2798
SHA1 6c6de00eb239938137c1d56ff1ec31454f98126f
SHA512 46cca2433875351ab112fdc877cd8de143ffbcec9017bf62fcbb42c506f5479d74349df5b43d252a442610d5923843343ea5e595565cda0928a712edf9e49584
TLSH
T191F0972855B6001FF1B2C8B802C4606B4F67FC1728059EA81BA5830C6910E147C91B35
MD5 SHA1 SHA512 TLSH

Submit Download

MSI5BE3.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI5BE3.tmp
Size 61KB
SHA256 1b046ae315f314b86d122fcde918a1334b25ac03d3953073da41a7a6e6d15154
MD5 2883dfbf67c96e80ea7ef4482e9a3719
SHA1 fea590dafb00576d16b2d760b7ed3136e0033985
SHA512 81754334fb04123117db0ebe66cfd7b13e4b93fc7d5ea38c71b37d1d894117b7498e028a8666ff3bac6e75a6c0309851259f5c6ecc18ec4c8f39c4276b89eada
SSDEEP 768:ytwE/7Tpprsq2SLGQKYWSgwM/G8uOUIPnfAq+wTjhFPMnPkUWpmnjEDsUVX3nJJS:EHZGPvwdcNnfJTldaPjVZe3nJBu
TLSH
T1AD535B117350C036E1631A34A8B8D3721E7E7C222BF585CB7F96176E5FB05C2AAB9316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Users\Admin\Downloads\agi\Qt5Core.dll
Size 5.9MB
SHA256 c78f1985da339fdfe1a3327d9ea976d204a2777d2c73f538540b1c4cc6b1aa6b
MD5 495ea262880fb99b35ef55c356246167
SHA1 af76a9ff76fea744cab808f8a8763c82111514ac
SHA512 4a62e4a133b6c4c13a246e2f3040a5a67dc8bb9244b1aac5b7451c94206c370b51306a1937fe12986b7804b6082f38785a55573870714c7aa1221a012c9d831d
SSDEEP 98304:JmQ2K06keKG7FTSJsv6tWKFdu9C9ijtNxqfS5ezr:JmQ2K0XG7AJsv6tWKFdu9C9gxqfSA
TLSH
T1A8568D8772A64265D4B7C23CCA97C11BEA73B8018B219ADF125CA7495E737F1293F318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Users\Admin\Downloads\agi\Qt5Gui.dll
Size 6.3MB
SHA256 a06be784694b327db499f7c31ce1f20f4c286aa3b0d9f12e5102dd2a30a32897
MD5 4139bf62455c29ac987790ad087d6a66
SHA1 4b7ffce0196b3768bfdc58312635d0c32f8f2ee4
SHA512 ddd97924b2da9901d7908509df147392d3706bbf4a4006e8a183d96472409f2a818cc92c8cb9097d75f16658cb1cba930d06bb4a3ff400723c59696f97bc6cc9
SSDEEP 49152:JEu+E915j5l9hzo1r95T5HR1B+AdYezx14lw9qYW6co3ujLmT79ltEOGhs2m6aJK:6u+Oj3CUKgeTu/OEsjEHcnt+CZ3zLDyh
TLSH
T1EE662886725A6251C977E17E874F052EE1F3B85283528BC788158B490F737EA1B7FE02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Network.dll

Path C:\Users\Admin\Downloads\agi\Qt5Network.dll
Size 1.2MB
SHA256 630b5dfbeb7a605e23b6e1ec68aabd97275723e7c10b02709233910cc2a3c2cc
MD5 238742ab3c114a7fd4d145f3e06d4371
SHA1 4ace8c691d488f856a03d3d2498cea81204672ad
SHA512 ebf25c5759dd551265310689c544eaa9560b8ae738a5c3add3cd0b74c8ffa14b3f5a1f9836e522ac52d67fd8f8ba8852ec32c7db3f5d230104fa156631925c47
SSDEEP 24576:2nfCrrHYfP0AD0SLyNMIHr9mCaYf4igms1kXQd+MayFy:nrjYn0lSLTI0TYf6kXQy
TLSH
T1E2556C57B35183A5D16AC138CA8BCA06E672700087269BDF6669CF593F337E2673E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5PrintSupport.dll

Path C:\Users\Admin\Downloads\agi\Qt5PrintSupport.dll
Size 313KB
SHA256 41a38669dc29680b3535022c21a20c727696efca1cf9d38ceba9911b2c075d05
MD5 c3a3ceed36e776d6993662a8064abfea
SHA1 83fbd75c30e1ae14cf9d74b55d7d01316d330c34
SHA512 69b4d335fa7fda71d4b3ccff7356f1cba633bf2d1ee19cd3b1fca633a05144b32a7e235f397c37ff2050386f8af44dfa95f42f968f879ef57c34aaf1d42fd2f9
SSDEEP 6144:X8F0kn/suXgNaQQA2GqWss4OK1gr7pGZHSgbZqXxtUPy/55oTznZ5A5WiJp5FX+L:X8F0E/suJQmuFuL
TLSH
T1B66419C7F3660D82C996D239C98B4112E273B06107A3CBDF511A8A19BE273E1BCBD755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5SerialPort.dll

Path C:\Users\Admin\Downloads\agi\Qt5SerialPort.dll
Size 87KB
SHA256 d0dc98416f903c505fcc52ff4607aa9c6320d27cc5d8a50692eea95c8126e976
MD5 e1aa81d42fe8eb7a5fd82e40476c9768
SHA1 4964255c324344f953ebe4515ff9d55120af9eeb
SHA512 8f5e4409cdcabd5978f80408f7ec3a20f0eae58d06abf4f0c367169f58f9ad817f8b9b3e67f05cdf4e7f8b7e9668f61df62fd0684da8c95c33bbb2a7d2b05b4b
SSDEEP 768:yokb6JdruL9/Ewyw2n63peoMxZa6/rv/B9woD0+b4zYPCwQEevrZU1w99kn2H1SY:hZHb/IMxZ3r3BBDDXD1i5FX3qKki
TLSH
T115933B4A765551E6E0AAD138CC87CA16E3B2B0558B629FCF2255CF2D2FA33D1AF3C105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Svg.dll

Path C:\Users\Admin\Downloads\agi\Qt5Svg.dll
Size 328KB
SHA256 8f2cd50a45d19d2fc6d76192d33ccd0bddd998cab66fb42a44168f82c3ed1e3a
MD5 23c5552de4b68c0ed68ee1d36b0ee3d2
SHA1 464121811ed2c4b1570827dfb936d4b5552d18ba
SHA512 acfb2525641a844550def3c0aefef3786007e8ec1159a8da350042876b8821254b5dbecdd4703852d1dda8afd9f43d7c800f9c2c880e5046c6b70cf92475c271
SSDEEP 6144:eznt6nKOHBmKRyzzEvVDhMXL0hq+SkbpMVImr9YpQehFX4v:YnAuPEvVlAPyFu
TLSH
T13A642847F2120D96D967D27CCA9B8916E6B334000363D6DF026A8A5A3F237E27A7D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Users\Admin\Downloads\agi\Qt5Widgets.dll
Size 5.3MB
SHA256 4840723eaefe6c84498a173eaff8d946a74183dd32fb462cdb1c3044048fc370
MD5 b3c7e5f0d1c384f04daa7b539c1e5bc3
SHA1 fca3feabe1b916f9f39976b17c407c55f419039c
SHA512 d11a2d9bf089276eadec616596ae59a7856197428f967da128f632b3933a7545e71b3b4a94c4dcbe0cd804b00f2066618de8e6b6c64bb9b00fef5d25cc947212
SSDEEP 49152:ObXTcjSZwSXP1qbHrGPmbn1TYYr12vcgEQwdi4KRBtswPZxoRkyeIXY+EgpEJIPZ:6w9yeniYr0RVyeWY+EgpEJIPruDKn
TLSH
T1B7466A5BB3A54185C56BD238CE8B8617D6B270044B238BDF256A8F592F733E12E7E704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ftd2xx.dll

Path C:\Users\Admin\Downloads\agi\ftd2xx.dll
Size 307KB
SHA256 9c282c4580aac9388adadf8c2d9794cca2f953af36331aedf814e936cfed97ad
MD5 7832f9df38bf967e60ee067a780d0201
SHA1 ed7a81137f109d504899c8e4a6b1e9e3ba108fe2
SHA512 a278ff53ca44cbe471bffa38fe00e86c01b776cdb199a3cbf809162716f6f5bd3db143fd92bedcaa48c0c99e56eddcdde93be2ab40e08713ce32f021a5e20ad3
SSDEEP 6144:cKiPPkDbvwp+Oc9WrH5iGPLjzTYJrCkx1qCHuQoIzeJ:f9UUDECHbzU
TLSH
T108647C4672A419F5E467D23CCA934606DBF6BC560370D7CF03A452962F23BE0A63E726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

egm96-15.tif

Path C:\Users\Admin\Downloads\agi\geoids\egm96-15.tif
Size 3.3MB
SHA256 67ba9175a290ba4a7d82498bab182818876e3802c1415907998813ffa51132ab
MD5 f0670b44e87649f77816ec5861e7ad3d
SHA1 28cc7b67f75fdf1dde2453c8a375addb3ef39fc1
SHA512 98c6a199641a89bac8ed34b5c2774ea03dfa6844207bd73babf5dc22d58061b5dece07f2164cc994aaf5de2e65511bac5d4e37d38710cd36c1a2d9bfdbb095a0
SSDEEP 49152:hO0dfb8Nrc4P6UiLjRComtHh4nZa8Bwnr5IkN3Ajh4ZC9oQIdH:k4h4itjRCz9hM7mVM4x5V
TLSH
T10CF53391717FA42EDD6D12E8EB581E7F5BBE0B8CC199418A006CF6E86CC611E7C9D0D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mola_areoid.tif

Path C:\Users\Admin\Downloads\agi\geoids\mola_areoid.tif
Size 321KB
SHA256 6c1e3789f02b88182080297a33ccb4e3b62c815fe94a8caef4553d39771d4394
MD5 3c3dae5d261010cd4e1ec3ef7559f7d6
SHA1 7a2ff30d3cdaeb0a0d1c84015e326ac0a9dcdbbe
SHA512 da34d7eaa4dccc47f3880903fb10f2c22a85de58ed82dccc99a3bf30b6be1c96587e562594f93ca7464a83bd88ec07afd7e42521fc744d969daba25df210ac3a
SSDEEP 6144:x+EnSEooELh2aHqjooEnIxCWMLlfNeC2mCkDTvhUbUQuYAdOvj8GEM:x+Ejjmh2EShEnooDVHCkDThUbUQeOAM
TLSH
T17D64221DA632BD12F9ED1FE31BFE2837D17744E0067328652655F1B98205868CF2CAAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iphlpapi.dll

Path C:\Users\Admin\Downloads\agi\iphlpapi.dll
Size 6.5MB
SHA256 dde19914fe4b569cf182b8b6a3eda485a31d9d0a8e3654d659d3d3baf403d09c
MD5 9e898d21d590bc6f1ffbcf27e48852bf
SHA1 58edf08f8f955890a701261f23bd6824c1a04673
SHA512 96a1dfe9eeaebbe4ad8f7f4c1b203cc3648b551461eec399482c24d1351b2a89222c8fb9ba3b9b7a075874c47e461a57c90891436aa37ccf79acac4180b48c06
SSDEEP 196608:T1DBRDaIerGZ+r/27Hd9N6ARqh1XsdIwQojy:xtZCrq+6J68qh1Xsd6
TLSH
T1656623AE62543368D41AC5389833BD45B2FA504F57E9C57E72CFBAC0272B911E682F07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metashape_en.qm

Path C:\Users\Admin\Downloads\agi\lang\metashape_en.qm
Size 1KB
SHA256 aa99928ce877618e03697a6e13661d2333bb70ce3c226f2c6e1440d967adf824
MD5 355d64360530ac7108ca9e56a5bf745d
SHA1 55dd0555bb282d93fc2fd6a520e43239ace094ca
SHA512 df920efd508e7b9fe7d0cf5055160aa8f5af5fdec684907d14fca3f6e52ad17ebe432151ea14fec295812385f729d101082f24794ae1f56e2ff5d396c69fb490
TLSH
T129110A921FF82D0AFBAB1B39454F461D9B3234426654A20B13266B751151C9E9B1F363
MD5 SHA1 SHA512 TLSH

Submit Download

qt_en.qm

Path C:\Users\Admin\Downloads\agi\lang\qt_en.qm
Size 30B
SHA256 e86d0790440ce5861afb20909b3bc3d0403cdbba021df98dd9895b87137e4e0d
MD5 7dcdb157b906e0b8f237453f39e5fb55
SHA1 d408334a5dab426dc15d5d3f6babfbca8aea6f87
SHA512 6968649919ccb6bed95f6ab1215c48a95d5cc470f281e65315437805bc43e1ae758ed8998745e9a1714494e4e8b81fb0dd0d539443fc9f2e61c1ee1cbf1bb698
MD5 SHA1 SHA512

Submit Download

libgmp-10.dll

Path C:\Users\Admin\Downloads\agi\libgmp-10.dll
Size 540KB
SHA256 264de576bb4ebe63aabac345fca1a4f00700ec0300ea0723c50fafc67ffd87a3
MD5 85524318c7e66d1b8aa7862e7aa42edf
SHA1 d61c51e5caa8a9d38965e17159e9f27afb6092f2
SHA512 e989c0aaee92e87b6657fc97be571c795bb143ef718cbdc421f13dcd64e0041ceee982917d11f6d00ff10e73857a34ec53f0af7d821058df208a0c489d2fecf0
SSDEEP 6144:nS5KjgGnpG7wZAF86y2iLmKiXc2HsvOB/2FV2/vF98G5hSkZqBG1N64vdUFXO:SAgMVwPy25G2j/2FVuvUY0yN64vdUFe
TLSH
T18BC44AB3A1599CD9D42A82B447EA4B336734FBD44782BB1316D0EE321E63FD06E98315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libopenblas.dll

Path C:\Users\Admin\Downloads\agi\libopenblas.dll
Size 27.4MB
SHA256 988aad7db6f4bda45e8fb7875ad60b6cbe3983cd0081eba601b3ee1047cc44ca
MD5 aff9b4c62605c7cdf064f5f0d83ad612
SHA1 123a1c2c929e727ebfbf3931bdd3f03abd18b73c
SHA512 de9f8c87adb2528453afe7a7e220f33be2d1fa00c75cdb9dc9b03549eb1238d723c4e374e50d4a8e1126b0ca0275923a109b468fc76fed72c934bd8a7a43ab11
SSDEEP 98304:0G3P7u3Faw/Yf2rFRj1pMS8YD7HYgk6sdeoR1yD141Xw/wit12KmCk0OLNNVkFvD:1Byo2hXmGVgs66MI+S1EC
TLSH
T1ED572987F4A680DCD97BE0B0436AB833F9213C1D852479765B91CB246B74F40EE6BB19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.txt

Path C:\Users\Admin\Downloads\agi\licenses\alembic\license.txt
Size 5KB
SHA256 6a46df63507716fb0dd905da6883be935653d19172c5a6287e448b7f648ede98
MD5 230cdbd5119d5179ab4671abfc1c3931
SHA1 0f6c501809ccc8140dcbc67f993fc36b058e807e
SHA512 36a0a0dece8ed997458ee63b0b03bc485a7d69a9d6d71adf046c3c8ebaca8004af8fd46fc1a73e5ec663407ce02db81248522b99e93e28906d08d1656e06a8d3
SSDEEP 96:9fPYrYJyrYJNSijN3B53hpYTlQPsorsVzbHnXW37EEXSLCrUjUU25HdWgQHl4SC9:9fPYrsyrsQijN3r3LalabsVzDnm3QEXv
TLSH
T1A7C1C72A3F400B7209E5D7A02A6A6DD5F09E912FBA2B6B48187DF385533742DD2FF450
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.txt

Path C:\Users\Admin\Downloads\agi\licenses\apriltag\license.txt
Size 1KB
SHA256 9b6baf7627d6a4b0f1f79cf72253ddd8ad7ca55a52aa47331c45f2628c910c11
MD5 a1f3be4f2bc2416cc9773098becba4fb
SHA1 32309015ecdb95ec3d30daebbd7a98d084f0daae
SHA512 e5ce3eeda2581ab5488c94e7e622e11d1d0ba6c102743a298bafeefb1bb0cb43d6bc7a74826402e505bd2b22e18fde34bd7f5c7e12372e7695f15982e8f77189
TLSH
T15431986B22404FFB49E2029179A9BAC4F19D802D3E176D011C2EE398377F52EE8FB154
MD5 SHA1 SHA512 TLSH

Submit Download

metashape.lic

Path C:\Users\Admin\Downloads\agi\metashape.lic
Size 93B
SHA256 99a65997712c34e44cf9c5e9ab50f2c7e61daa7ad4ad2a11ddf189de7fd35cdd
MD5 8e13f9ccdd48344b2f6d41cbccd3ac1b
SHA1 5b809da5e876b0d608cd504b9a32be8327f19dd4
SHA512 8c8aa345bbd97d316c9987c70a0519c1de4bf3fef25cca587ef4afb79deed7936b173d76c15991052833282fdf545a1d203614cbdffa4326c19a60e289a6714a
TLSH
T115B01275E03090165A40405183558DC73ED017A323C90C410891E1911C2A118C3180D1
MD5 SHA1 SHA512 TLSH

Submit Download

__init__.py

Path C:\Users\Admin\Downloads\agi\modules\__init__.py
Size 38B
SHA256 5886c1d6eca6cf38e0d890c46da1ff6b8129db6a00e542c425e775e22bd757eb
MD5 80dc1db90cc5dde2f08aef53139aa04b
SHA1 9f9c72795b3109e6908781926ec405e2330aaea5
SHA512 8cb953c71ca3c04f011c889afd2a600b31bf64f2df19e44610a656e3ea136b19f298eb5feb52032f1a3db8fcf3bd6d92bd680310a78c3df5d81b34a647f29b7f
MD5 SHA1 SHA512

Submit Download

onnxruntime.dll

Path C:\Users\Admin\Downloads\agi\onnxruntime.dll
Size 9.6MB
SHA256 9aae138e7e9117f32722fd8def43380ef8a428daeebaef6748f1516c006e1cd2
MD5 083a879ef6b337bf9fc2a0c07c3607aa
SHA1 d6071b05a06a8f583520d11c9621e71680b33b17
SHA512 3e9f28d9a984566c57bf9aca083ab1b88e461ab708935eab4be1b54fa75710b06ab82b95b9d525cbd29dfdf94a812b3acb80db2d790c7b33a0fa82f0449e3a27
SSDEEP 49152:yGD51Fd3eumDUQqzaS9v31eknxA5UC7s8sTkW3R2Sc68ZpmazstOCusdx6Inf28+:v/eGS2kDVUQEQEu/AmDQwn6iV
TLSH
T12CA65C56769901DCD1BFD27C8B4BAA13FBB1740943345AFB02A005A61F57BE0AE7EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qjpeg.dll

Path C:\Users\Admin\Downloads\agi\plugins\imageformats\qjpeg.dll
Size 447KB
SHA256 52c0aebbee792cc70bf10ca5cb2f6557cbe14a92715e4fb4d42116c7955473fb
MD5 8d12492b60b98cd5326c3c8b15bdce89
SHA1 4b9855fa9d130268061e1ac39af590cdb0625c56
SHA512 565fb067b1ee90286c1e442bebae1c9f2b2bf2fb794593632d835c9c309f0bc36406738ee2731dcd26684f61a048b0dd1bf4917688a7acf288415dd0ccb9523a
SSDEEP 12288:hibzQgNM1YicIxRHzpmlpDuaEkvx13aq4cYp5nHQu6GnXjLUCGqIHZ5LyqagvthH:hibzQgN7Fz
TLSH
T121A4A343F2705C87C7E54474EE6AC1A6E794B81CC7FB46F779C5ABD93A226B0B829100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Users\Admin\Downloads\agi\plugins\platforms\qwindows.dll
Size 1.4MB
SHA256 6dce27e84bb722735e336d5ed91b0919221f710dff3e465546bf8fc72ed712d9
MD5 6d349f91fc249507290cb42fbc6eda11
SHA1 1b4d01a004098e8f696628fe3dc33436c6a61c17
SHA512 fda470f8ff9fbf4e9745e8314d15ebfaed2939369736e8ef3e8a11bc50159dac6f6dd5dc41078cd88c6367fbb570b9ada0d381df6bfbc832b83d00a5066b56d1
SSDEEP 24576:6KATmg5VXMmMU18W/LswJGdBp8fLP8CRfSQdEYHxQZ0ZcxSC/FN:6mOVXMg18MgwJG10RACE22tL
TLSH
T12C658C57A3A58298C26BC23DC65B8B1BD7B2700403218BDF11A18E597F63BE3177EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindowsvistastyle.dll

Path C:\Users\Admin\Downloads\agi\plugins\styles\qwindowsvistastyle.dll
Size 144KB
SHA256 10af5696a95fcb3b9077b87806f0c95c7b280cdcedee10bdd11ed67b67dc6336
MD5 67d8c2492050f733cb6e89073f68e5cf
SHA1 348c3b2ec10665fc8b67a551f45858ed817f988c
SHA512 2aa6d42f00652d19a6fdc03f1a1001576664b5c06a2e976165ba67592eb392640a51b9cf743cbada2b46281a5b637e39b798f3b6cdfd245bf610223d9ca236b4
SSDEEP 3072:nKqJOo7oodkDFNwgoO+NeHVMNaHRVWZuXd0S0JADOFXzf:KS5kJlHiNaHRVWZuXd0S0JnFXzf
TLSH
T198E34C13326602DAC463D2B8C55F0917E7B3705453228BDF45A7CEA92F132E2BE3EA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\Downloads\agi\python39.dll
Size 5.2MB
SHA256 a3879c24debe2c94b1710e42073d4b8ff197046718c66b96520f7c3f24203066
MD5 ed10db80bb3ceb5ef9d9ac5d2c0af9e9
SHA1 cace4d30ccbb019df16d88f7f56af48b9e90ca47
SHA512 9f7304711305b2eb9362becd4c38cd4cde20ec6aad2f51644eb71fc4e7d8310c83145f914e592ae86d72d3450ece40e473ea30260524daaedef7c5805824a779
SSDEEP 49152:lhxI7qSRLk1cZ3RvoxrmeVv5QfRW+3zztnJLP9dq/N9BNJ+BT9vxO7Qypx1CIeXY:bBJPEyN9BNJ+BT9vxQejHMM9iIhwj1
TLSH
T164467C66A2A41154DAB3D17989578612DBF2BC142B10E3CB0160FAE52F73FE31AFE315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Users\Admin\Downloads\agi\python\lib\encodings\__init__.py
Size 5KB
SHA256 57ce0008389d686b1363abbf2ebb529435942eda457297b179f2eba7db4e8582
MD5 1e7d22eab91cdd26ad09885dd9c447d7
SHA1 aeaefe6562f4da3ee9928132a1d43fbbe35d1c18
SHA512 47ab12c74054d08e05c0bcbce8aee82a1df78cd8ec11c84d1bfec9fa86853680d9171bf4fe01586b73ba18dbdaf9c948bce9e7f0026daf822257bdc199008aa8
SSDEEP 96:VHIYGspF3e06Q0YoKf9m/6karC+mWkJ4q3m0gByAroIEJYsbHIDB:+YLpFkYowrWn4q3gAAroIEesbHIDB
TLSH
T1EBB11F5AEA30672387E64628349FD158123D386327010EAC7DED83B42F41779C2F2EAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qt.conf

Path C:\Users\Admin\Downloads\agi\qt.conf
Size 28B
SHA256 c0925a148fe29f1ad4197a3250128d7035e8f27cf75c833d7c55890890c8f79d
MD5 861e55c9c4b381d1912877049327baab
SHA1 9943ff60b76eae053e317da40dee9e3105210034
SHA512 6663dc98a5ff2ee80a1c3f2bf029dee2eda9801d83f3f64a36d683edc24e55beb05e04d199ac90b86502a32e172472e3a1f5bfbd60e537f5a928994d9d3364ed
MD5 SHA1 SHA512

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 f9c1f7e685391f14a5dbd656f2ac6b7b2fca505f50eaad9fd74a9b56ba869253
MD5 d796b324359ad791da1ad9a03108abe5
SHA1 944c04bfc1a09ea9d946ad2410e42f83553a9b46
SHA512 130d0b1aa59413ac2198d9414ebfb95347b3a0292e8b1e4d0ea11cf2468e1b66e99ae7cbe1f3222e433c0d1a002c7a836cef0274fdf656faf0c12ab1f26c4b60
SSDEEP 24576:Yu8m+1zFdoO/vvTLr2GejWKyXfkzOFGyqQGNE5H1eUqH+BvbYPlfegthj:W
TLSH
T15A47B52437FD2210E7F7AE3CA8F06A2349397D579C15DE8D45411B4E0922BB1E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9460d563-066f-49b2-820a-dfae6fbd683e}_OnDiskSnapshotProp

Path \??\Volume{9f840213-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{9460d563-066f-49b2-820a-dfae6fbd683e}_OnDiskSnapshotProp
Size 6KB
SHA256 7eb63e487b21c3e4db43ca3c11dfb8e2ccaa92b2960a74a52d0e5fb8af710b5e
MD5 a6570f3101a99bee8c66cfbed37f1b30
SHA1 c72b5e9045cb0925c6b8de944d7f40caaf2fc42a
SHA512 a0899bf668f018eede91bf7bc1ab8dc5f64b112c0ae91f07babd502a741c8cb5db798b910aa194acdfc178355949e98fafea1320e33d6874e8d954e28c2ea27a
SSDEEP 96:F6rjejkqkvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:kHyib++ZVm
TLSH
T1D1D188085AF54711E2B3AB3229F18557A477B911EF33CB8E0298238E6670910F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/388-9294-0x00007FFABF9E0000-0x00007FFABFD35000-memory.dmp

Download

memory/388-11694-0x000001FB03930000-0x000001FB039B3000-memory.dmp

Download

memory/388-8900-0x00007FF7063C0000-0x00007FF7073C0000-memory.dmp

Download

memory/388-8904-0x000000006ACC0000-0x000000006AD33000-memory.dmp

Download

memory/388-8925-0x00007FFAC0D70000-0x00007FFAC17F2000-memory.dmp

Download

memory/388-11745-0x000000006D7C0000-0x000000006F340000-memory.dmp

Download

memory/388-8928-0x000001FB03920000-0x000001FB03921000-memory.dmp

Download

memory/388-11747-0x000001FB148A0000-0x000001FB14A6E000-memory.dmp

Download

memory/388-8924-0x00007FFAE1CC0000-0x00007FFAE1CC2000-memory.dmp

Download

memory/388-8923-0x00007FFAE1CB0000-0x00007FFAE1CB2000-memory.dmp

Download

memory/388-9334-0x00007FFABF3C0000-0x00007FFABF9DA000-memory.dmp

Download

memory/388-8905-0x000000006D7C0000-0x000000006F340000-memory.dmp

Download

memory/388-9293-0x00007FFABFD40000-0x00007FFAC00EC000-memory.dmp

Download

memory/388-11692-0x000000006ACC0000-0x000000006AD33000-memory.dmp

Download

memory/388-11695-0x000001FB148A0000-0x000001FB14A6E000-memory.dmp

Download

memory/388-8901-0x00007FFAC4C50000-0x00007FFAC519D000-memory.dmp

Download

memory/388-11693-0x000000006D7C0000-0x000000006F340000-memory.dmp

Download

memory/388-11741-0x000001FB1EC70000-0x000001FB1F0CC000-memory.dmp

Download

memory/388-11744-0x000000006ACC0000-0x000000006AD33000-memory.dmp

Download

memory/388-11746-0x000001FB03930000-0x000001FB039B3000-memory.dmp

Download

memory/2080-11749-0x00007FFAC4C50000-0x00007FFAC519D000-memory.dmp

Download

memory/2080-11752-0x00007FFAC0D70000-0x00007FFAC17F2000-memory.dmp

Download

memory/2080-11758-0x00007FFABF3C0000-0x00007FFABF9DA000-memory.dmp

Download

memory/2080-11757-0x00007FFABF9E0000-0x00007FFABFD35000-memory.dmp

Download

memory/2080-11756-0x00007FFABFD40000-0x00007FFAC00EC000-memory.dmp

Download

memory/2080-11761-0x000000006ACC0000-0x000000006AD33000-memory.dmp

Download

memory/2080-11764-0x000001FC50820000-0x000001FC509EE000-memory.dmp

Download

memory/2080-11765-0x000001FC59E40000-0x000001FC5A29C000-memory.dmp

Download

memory/2080-11763-0x000001FC3F9E0000-0x000001FC3FA63000-memory.dmp

Download

memory/2080-11762-0x000000006D7C0000-0x000000006F340000-memory.dmp

Download

memory/3492-8922-0x000000006D7C0000-0x000000006F340000-memory.dmp

Download

memory/3492-8920-0x00007FFAC4C50000-0x00007FFAC519D000-memory.dmp

Download