414155bf11893ec64ba0f4ffb7de92885090845a0761cf8f6743462aa5991d5e

Resubmissions

02/11/2026, 16:18

261102-trxxfsxw6l10

02/11/2026, 16:06

261102-tkatcaxw2j10

Analysis

user interaction
yes
max time kernel
149s
max time network
363s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
02/11/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OInstall.exe
Size 10.9MB
Sample261102-tkatcaxw2j
SHA256 414155bf11893ec64ba0f4ffb7de92885090845a0761cf8f6743462aa5991d5e
MD5 ebc58647462ad9c76395ef451064d115
SHA1 14e470812f13b278b2694a4cec5737a39784e9dd
SHA512 8a9ef093d151957ae3c4c8e572fcdbd2198398c95ff8186d532853856c12c8f9ae7408c4f24518c5903faa517ea4e1d5779e797c5a4d850073fbee3ab801e8cc
SSDEEP 196608:2ZnMGjZsDEsCaYsGEHy61bgUhufRswPU2/V8Gd83/PALDP0PiaQxhwf+9zYul28S:WnjZhsCOU6ZgfPPPuGdnv0fzfoDYtB
TLSH
T111B63376044290B6E0812DB6520EB4F5661E3857189BFC642D4BCDE87BBADC3D7D2A0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution spyware stealer upx

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://officecdn.microsoft.com/pr/1d2d2ea6-1680-4c56-ac58-a441c8c24ff9/Office/Data/v32.cab

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
17	3692	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3718455638-2296795630-1576855121-1000\Control Panel\International\Geo\Nation	cscript.exe

Executes dropped EXE 2 IoCs

pid	Process
2456	files.dat
4904	CleanOSPP.exe

Loads dropped DLL 1 IoCs

pid	Process
4904	CleanOSPP.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3692	powershell.exe
4496	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 15 IoCs

execution

Visual Basic

T1059.005

pid	Process
2976	cscript.exe
1264	cscript.exe
2024	wscript.exe
2216	wscript.exe
1592	wscript.exe
528	wscript.exe
4876	cscript.exe
4240	wscript.exe
4384	wscript.exe
2168	wscript.exe
4216	wscript.exe
888	wscript.exe
1364	wscript.exe
4128	wscript.exe
3280	wscript.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1276-0-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/1276-18-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/1276-19-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/1276-20-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/1276-56-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/1276-57-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/1276-151-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/1276-155-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/1276-160-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/1276-166-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/1276-171-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/1276-172-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/1276-179-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/1276-182-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/1276-183-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/1276-190-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/1276-191-0x0000000000400000-0x000000000199D000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3500	cmd.exe
2532	cmd.exe
4784	cmd.exe
4260	cmd.exe
3248	cmd.exe
2468	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	files.dat

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1400	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1844	WMIC.exe
1844	WMIC.exe
1844	WMIC.exe
1844	WMIC.exe
2856	WMIC.exe
2856	WMIC.exe
2856	WMIC.exe
2856	WMIC.exe
3692	powershell.exe
3692	powershell.exe
4496	powershell.exe
4496	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1844	WMIC.exe
Token: SeSecurityPrivilege	1844	WMIC.exe
Token: SeTakeOwnershipPrivilege	1844	WMIC.exe
Token: SeLoadDriverPrivilege	1844	WMIC.exe
Token: SeSystemProfilePrivilege	1844	WMIC.exe
Token: SeSystemtimePrivilege	1844	WMIC.exe
Token: SeProfSingleProcessPrivilege	1844	WMIC.exe
Token: SeIncBasePriorityPrivilege	1844	WMIC.exe
Token: SeCreatePagefilePrivilege	1844	WMIC.exe
Token: SeBackupPrivilege	1844	WMIC.exe
Token: SeRestorePrivilege	1844	WMIC.exe
Token: SeShutdownPrivilege	1844	WMIC.exe
Token: SeDebugPrivilege	1844	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1844	WMIC.exe
Token: SeRemoteShutdownPrivilege	1844	WMIC.exe
Token: SeUndockPrivilege	1844	WMIC.exe
Token: SeManageVolumePrivilege	1844	WMIC.exe
Token: 33	1844	WMIC.exe
Token: 34	1844	WMIC.exe
Token: 35	1844	WMIC.exe
Token: 36	1844	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1844	WMIC.exe
Token: SeSecurityPrivilege	1844	WMIC.exe
Token: SeTakeOwnershipPrivilege	1844	WMIC.exe
Token: SeLoadDriverPrivilege	1844	WMIC.exe
Token: SeSystemProfilePrivilege	1844	WMIC.exe
Token: SeSystemtimePrivilege	1844	WMIC.exe
Token: SeProfSingleProcessPrivilege	1844	WMIC.exe
Token: SeIncBasePriorityPrivilege	1844	WMIC.exe
Token: SeCreatePagefilePrivilege	1844	WMIC.exe
Token: SeBackupPrivilege	1844	WMIC.exe
Token: SeRestorePrivilege	1844	WMIC.exe
Token: SeShutdownPrivilege	1844	WMIC.exe
Token: SeDebugPrivilege	1844	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1844	WMIC.exe
Token: SeRemoteShutdownPrivilege	1844	WMIC.exe
Token: SeUndockPrivilege	1844	WMIC.exe
Token: SeManageVolumePrivilege	1844	WMIC.exe
Token: 33	1844	WMIC.exe
Token: 34	1844	WMIC.exe
Token: 35	1844	WMIC.exe
Token: 36	1844	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2856	WMIC.exe
Token: SeSecurityPrivilege	2856	WMIC.exe
Token: SeTakeOwnershipPrivilege	2856	WMIC.exe
Token: SeLoadDriverPrivilege	2856	WMIC.exe
Token: SeSystemProfilePrivilege	2856	WMIC.exe
Token: SeSystemtimePrivilege	2856	WMIC.exe
Token: SeProfSingleProcessPrivilege	2856	WMIC.exe
Token: SeIncBasePriorityPrivilege	2856	WMIC.exe
Token: SeCreatePagefilePrivilege	2856	WMIC.exe
Token: SeBackupPrivilege	2856	WMIC.exe
Token: SeRestorePrivilege	2856	WMIC.exe
Token: SeShutdownPrivilege	2856	WMIC.exe
Token: SeDebugPrivilege	2856	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2856	WMIC.exe
Token: SeRemoteShutdownPrivilege	2856	WMIC.exe
Token: SeUndockPrivilege	2856	WMIC.exe
Token: SeManageVolumePrivilege	2856	WMIC.exe
Token: 33	2856	WMIC.exe
Token: 34	2856	WMIC.exe
Token: 35	2856	WMIC.exe
Token: 36	2856	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2856	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1276	OInstall.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
1400	EXCEL.EXE
1400	EXCEL.EXE
1400	EXCEL.EXE
1400	EXCEL.EXE
1400	EXCEL.EXE
1400	EXCEL.EXE
1400	EXCEL.EXE
1400	EXCEL.EXE
1400	EXCEL.EXE
1400	EXCEL.EXE
1400	EXCEL.EXE
1400	EXCEL.EXE
1400	EXCEL.EXE
1400	EXCEL.EXE
1400	EXCEL.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 3500	1276	OInstall.exe	84
PID 3500 wrote to memory of 1844	3500	cmd.exe	86
PID 1276 wrote to memory of 2532	1276	OInstall.exe	88
PID 2532 wrote to memory of 2856	2532	cmd.exe	90
PID 1276 wrote to memory of 4784	1276	OInstall.exe	91
PID 4784 wrote to memory of 2456	4784	cmd.exe	93
PID 1276 wrote to memory of 3692	1276	OInstall.exe	101
PID 1276 wrote to memory of 2308	1276	OInstall.exe	103
PID 1276 wrote to memory of 4496	1276	OInstall.exe	105
PID 1276 wrote to memory of 4260	1276	OInstall.exe	122
PID 4260 wrote to memory of 2976	4260	cmd.exe	124
PID 2976 wrote to memory of 4904	2976	cscript.exe	139
PID 1276 wrote to memory of 3248	1276	OInstall.exe	128
PID 3248 wrote to memory of 1264	3248	cmd.exe	130

C:\Users\Admin\AppData\Local\Temp\OInstall.exe
"C:\Users\Admin\AppData\Local\Temp\OInstall.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OInstall.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OInstall.exe"
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1844
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2856
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /D /c files.dat -y -pkmsauto
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Users\Admin\AppData\Local\Temp\files\files.dat
    files.dat -y -pkmsauto
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/1d2d2ea6-1680-4c56-ac58-a441c8c24ff9/Office/Data/v32.cab', 'C:\Users\Admin\AppData\Local\Temp\over271214\v32.cab') }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3692
- C:\Windows\SYSTEM32\expand.exe
  "expand" v32.cab -F:VersionDescriptor.xml C:\Users\Admin\AppData\Local\Temp\over271214
  2⤵
  - Drops file in Windows directory
  PID:2308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -command "& { Get-Content C:\Users\Admin\AppData\Local\Temp\over271214\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4496
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /D /c "cscript.exe //NoLogo" OffScrub_O15msi.vbs ALL /NoCancel /Force /OSE 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\system32\cscript.exe
    cscript.exe //NoLogo OffScrub_O15msi.vbs ALL /NoCancel /Force /OSE
    3⤵
    - Checks computer location settings
    - Executes a VBScript file via the Windows Script Host.
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\files\x64\CleanOSPP.exe
      "C:\Users\Admin\AppData\Local\Temp\files\x64\CleanOSPP.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4904
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /D /c "cscript.exe //NoLogo" OffScrub_O16msi.vbs ALL /NoCancel /Force /OSE 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\system32\cscript.exe
    cscript.exe //NoLogo OffScrub_O16msi.vbs ALL /NoCancel /Force /OSE
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Reads the TCP/IP host and domain name from the registry
    PID:1264
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /D /c "cscript.exe //NoLogo" OffScrubC2R.vbs ALL /NoCancel /OSE 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2468
- - C:\Windows\system32\cscript.exe
    cscript.exe //NoLogo OffScrubC2R.vbs ALL /NoCancel /OSE
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\files\x64\CleanOSPP.exe
      "C:\Users\Admin\AppData\Local\Temp\files\x64\CleanOSPP.exe"
      4⤵
      PID:1104
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Delete /TN FF_INTEGRATEDstreamSchedule /F
      4⤵
      PID:4904
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Delete /TN FF_INTEGRATEDUPDATEDETECTION /F
      4⤵
      PID:3860
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Delete /TN C2RAppVLoggingStart /F
      4⤵
      PID:5056
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Delete /TN "Office 15 Subscription Heartbeat" /F
      4⤵
      PID:3392
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Delete /TN "Microsoft Office 15 Sync Maintenance for {d068b555-9700-40b8-992c-f866287b06c1}" /F
      4⤵
      PID:3236
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Delete /TN "\Microsoft\Office\OfficeInventoryAgentFallBack" /F
      4⤵
      PID:2284
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Delete /TN "\Microsoft\Office\OfficeTelemetryAgentFallBack" /F
      4⤵
      PID:528
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Delete /TN "\Microsoft\Office\OfficeInventoryAgentLogOn" /F
      4⤵
      PID:2560
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Delete /TN "\Microsoft\Office\OfficeTelemetryAgentLogOn" /F
      4⤵
      PID:1588
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Delete /TN "Office Background Streaming" /F
      4⤵
      PID:1036
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Delete /TN "\Microsoft\Office\Office Automatic Updates" /F
      4⤵
      PID:2580
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Delete /TN "\Microsoft\Office\Office ClickToRun Service Monitor" /F
      4⤵
      PID:1000
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Delete /TN "Office Subscription Maintenance" /F
      4⤵
      PID:4368
  - - C:\Windows\system32\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\files\OffScrubC2R.vbs" "UNPINSC" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Database Compare.lnk"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:1364
  - - C:\Windows\system32\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\files\OffScrubC2R.vbs" "UNPINSC" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Office Language Preferences.lnk"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:4128
  - - C:\Windows\system32\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\files\OffScrubC2R.vbs" "UNPINSC" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Office Upload Center.lnk"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:4240
  - - C:\Windows\system32\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\files\OffScrubC2R.vbs" "UNPINSC" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Spreadsheet Compare.lnk"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:2168
  - - C:\Windows\system32\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\files\OffScrubC2R.vbs" "UNPINSC" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Telemetry Dashboard for Office.lnk"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:2024
  - - C:\Windows\system32\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\files\OffScrubC2R.vbs" "UNPINSC" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Telemetry Log for Office.lnk"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:3280
  - - C:\Windows\system32\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\files\OffScrubC2R.vbs" "UNPINSC" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:4216
  - - C:\Windows\system32\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\files\OffScrubC2R.vbs" "UNPINSC" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:2216
  - - C:\Windows\system32\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\files\OffScrubC2R.vbs" "UNPINSC" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook.lnk"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:888
  - - C:\Windows\system32\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\files\OffScrubC2R.vbs" "UNPINSC" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:1592
  - - C:\Windows\system32\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\files\OffScrubC2R.vbs" "UNPINSC" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word.lnk"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:528
  - - C:\Windows\system32\wscript.exe
      "C:\Windows\system32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\files\OffScrubC2R.vbs" "UNPINSC" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Outlook.lnk"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:4384

C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1400

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2500

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2640

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:1264

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 81fc6cfe81caf86f84e1285cb854082ac5e127335b5946da154a73f7aa9c2122
MD5 ed30ca9187bf5593affb3dc9276309a6
SHA1 c63757897a6c43a44102b221fe8dc36355e99359
SHA512 1df4f44b207bb30fecee119a2f7f7ab7a0a0aed4d58eeabbec5791d5a6d9443cccffa5479ad4da094e6b88c871720d2e4bcf14ebec45a587ee4ec5e572f37810
TLSH
T1C051DA313275A1E4C91A3F47192819C023BF8355FA98AF5CB65C521EE92740B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

1BBFF246-BDE0-4E02-8D27-5F515FA8BAC9

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\odc.officeapps.live.com\1BBFF246-BDE0-4E02-8D27-5F515FA8BAC9
Size 582B
SHA256 19693fd00585902de63888389d3d2f48f18ff0461b7f22ae7f2ef6462f4bbc40
MD5 6a85e5a112dffa179332e368f270f941
SHA1 dc4a809a35e9cd20d897707eee56355e7fc8a96f
SHA512 3f37f8be0fda9edd38747a8cae532cfe9e844345b59a8c694c70d9ce84d8f558483b16fa9119f0efe82a203abfe7fd71333c5cd81b611c46eb15d61912d62cbe
TLSH
T123F041DF6E3269AF4C48017E8123C03389B7022E0E7A306820822F7E240388220EA794
MD5 SHA1 SHA512 TLSH

Submit Download

5EC5EC89-23F5-410D-AE21-809A7937339A

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\odc.officeapps.live.com\5EC5EC89-23F5-410D-AE21-809A7937339A
Size 2KB
SHA256 a1b0b7b33e6818837aa403f7a73af14ae91ec1409cc76e312c712c8786c092f6
MD5 82220d7f99bc22a30d546ce452c133f2
SHA1 e69e26e6f48d93fd93db729e40890fd833604f91
SHA512 8756b541786b92ecd205914dd07e6f34cf57603f134b390e8389451a283fec824c1e2c135cc338e30e9cc7df2486449a7a370179d2daac336d99c69ffca3e1e3
TLSH
T1BA5139D9A925507FC8BF2537C21AAF7DB87844230A60108DB898281548C5AE8B7CBCA3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 41f9420be1706c3570548d6291cbe707e539978acad871c139b02db4422b7ddf
MD5 3f7ca362c307aa01d1dc59840f89cc7a
SHA1 a8ecb7e6795e8ad076caf58edafcf5e01163509f
SHA512 c8bd1f3eb510c6f54d5d383055b63aa75c06721b733ba2eafbc57f9fd5ff4859e88fc0a89ef37d8b38bb4528efcf3073aa64de0f88a37e24328833dfc30ea5af
TLSH
T180115723B79CC961CC85553B409D9D6175B2D7C781AEDE9F6FC8C209A07F598CB211A0
MD5 SHA1 SHA512 TLSH

Submit Download

RegList.txt

Path C:\Users\Admin\AppData\Local\Temp\OffScrub_O16msi\RegList.txt
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_svrl0xc0.q50.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_svrl0xc0.q50.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

OffScrubC2R.vbs

Path C:\Users\Admin\AppData\Local\Temp\files\OffScrubC2R.vbs
Size 292KB
SHA256 2001f018ded30d79bd58f45dc18a9ecdc354aa30bea02451ca297415a65ec1fd
MD5 e5cb0dc373006226ae1102e4eec46811
SHA1 efe109f8725271a88b634d6836d9af54ac09529f
SHA512 ef49beec92ddf79bfe2628ea47e37b8ba6099475175ffe024459e15a7039d61fe67076c2b621f24143254c0781d7f96112dfb82ad57e8c07b40ef4e4aae2bde7
SSDEEP 3072:EsGngCJJLXrTPLOBPhclcpqgVlDRoi0FY0ZM0nr9/p3N5wXYXZXfD7EFTvJP0XKn:/GgCiDy0
TLSH
T13654BC0267FA5508B2B26A586EB64034CB63B9A65D7DCD1D508C654E0BFFA80CD31FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OffScrub_O15msi.vbs

Path C:\Users\Admin\AppData\Local\Temp\files\OffScrub_O15msi.vbs
Size 383KB
SHA256 879660b011dfc96e499bb2d690a0f5b35f2d01ee7023b89295d7422f7574be92
MD5 c6880651a76e929f4182d59d3072294d
SHA1 dc40477aaf7c8cf029f36302b4e8042a0ef10a79
SHA512 14ef61d0475a20f9bbb1f2a9778bd5aae19438b65f23e2a26656c0735570de8e586ed050c78c2b934399bc6fb7065c1492e7054ddc6c2f77a39d7956cb18e7f3
SSDEEP 3072:vP7XiBnOSpvE8Hpvx8+E2iKJZIz6RKWNkx0yazy/IRIHELVMlZKwZ8dV0MdbKtaZ:X5iVT
TLSH
T12184B30067FA5108B2B37E58EEB680258B67B9A65D35C91D518C05CE0FBBA40CDF7B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OffScrub_O16msi.vbs

Path C:\Users\Admin\AppData\Local\Temp\files\OffScrub_O16msi.vbs
Size 383KB
SHA256 a0b090a9d30e62886f401cff39477f9e7215686f06ac29734498f7493b48b3cb
MD5 6a6390c4a276930727142e5501b8c863
SHA1 69a2b75462221dbf5d82e45cb84ff4211c50140d
SHA512 9f963ee46f795cfff071bb35bccd1fbb787445459abe848a23de66eb8d986d29c77f68f2d95e944cf6c58146ca69f8b0ced493ee3fd463410216c212b1e531d2
SSDEEP 3072:7P7XDBVO5pfE8Hpmx8uE2iKJZIz6RKWNkxnyazy/1RIHELVMlZKwKOl1lMdbCtam:LCz1J
TLSH
T14084B30067FA5108B2B37E58EEB680258B67B9A65D35C91D518C05CE0FBBA40CDF7B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files.dat

Path C:\Users\Admin\AppData\Local\Temp\files\files.dat
Size 707KB
SHA256 7a1c82e264258470d14ca345ea1a9b6fc34fa19b393a92077a01be5f1ad08f47
MD5 55d21b2c272a5d6b9f54fa9ed82bf9eb
SHA1 32464cba823cd9b7e94e4fa1a32a8f2344b0f33b
SHA512 1b68d0c61367717529be4a3aa347bb69d3e21de7a89b10e8b0aa54d40af988cc0cc8e63298ba595a93c3372aca3770ace1eee2780a59238d0948499dbb4be725
SSDEEP 12288:3XikbkgaISKVHNJhk2X4hGeHJ3ZWpZaw+ovKE88agUZ+Z00KvxHbeQiHhYfNx9nj:3Xi6kgaINVHLhk2XeH2xPHXUZf0IeQs8
TLSH
T16AF402123AF1C13BE1420532CEC9ABF6A1F2E2580F21885773D51B2D3EBD985D635B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\files\setup.exe
Size 7.0MB
SHA256 ee3875abd5d49a1891c8818820f61a1e5d0382df37b5a5b72e175b2b6c70a9c2
MD5 072a2efea576956e465aff2492a1c7f4
SHA1 c7ae89bf444a33d9d92584df62e16e518942b31d
SHA512 5b4f4a4508d042c7554369729ca40cb16ed61f63a41996bf8689a17d0939fc95834a44e54833e50291b26df4d2f0d2877a6272039b3fc0b20dabc885eecc87eb
SSDEEP 98304:4RimgRP8n5KSBHSFDd0t2M69XpiSLMmSCh+kB63QcJ11PaKLkhd2S6amwY2hk4:rmmGmDd0tMXHMmXh+kBuhJ1IDYS6amWT
TLSH
T18F766B23AED741F6E57613F26F29BF5744BDBB740831858F23841A8D3A70981A926733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CleanOSPP.exe

Path C:\Users\Admin\AppData\Local\Temp\files\x64\CleanOSPP.exe
Size 19KB
SHA256 5ce462e5f34065fc878362ba58617fab28c22d631b9d836dddcf43fb1ad4de6e
MD5 162ab955cb2f002a73c1530aa796477f
SHA1 d30a0e4e5911d3ca705617d17225372731c770e2
SHA512 e0288dcf78092449d9cbaef4488041131925387c1aedc9e9512da0f66efe2fb68350ca3937f6715834e62e7c931c5dad0fc8bc3c6c0c3daedeff356d6feaac2e
SSDEEP 384:gQAInWKpEFFzpjq37oIOU6GHq33QPiu431VP:gxWTpOFagUb2qiu43P
TLSH
T1A592C4B40BF601E2E1BAF774CEB50526E872FC122A329F5F069184451F32A51EF76B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr100.dll

Path C:\Users\Admin\AppData\Local\Temp\files\x64\msvcr100.dll
Size 809KB
SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
MD5 df3ca8d16bded6a54977b30e66864d33
SHA1 b7b9349b33230c5b80886f5c1f0a42848661c883
SHA512 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0
SSDEEP 12288:3gzGPEett9Mw9HfBCddjMb2NQVmTW752fmyyKWeHQGokozS:QzJetPMw9HfBCrMb2Kc6ymyyKWewGzUS
TLSH
T13E059D9536A907F6D137D63DC996D606E2B2741513315BEB01A08BAF1F23BE09A3F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VersionDescriptor.xml

Path C:\Users\Admin\AppData\Local\Temp\over271214\VersionDescriptor.xml
Size 6KB
SHA256 69750ab91b09fee9a2789a4ca9ae71ac76c2abccd9faf598dc667d3f97b68c53
MD5 eb99b70971790063e02b00eae94c502a
SHA1 7aafaa74c02964b77b2964fd3b4beb88b122aaac
SHA512 d91aa5e7c63b7671689e1d6b7436be7f91f8d5d76ad27d5690e8c19b3225d038da87811cd42da08d6b6515644620508802a3c4e563e48bdcd7e1259dbaff37f7
SSDEEP 96:oBjDj1O8qwEyFGBo5a9nKacKaL6fgtyqNvwwLVwLqwLtcLUTqNXIXM:YBh
TLSH
T15BE1C46B74D03C2D41306767F9B23AE2EF62D66396050458F00D724B3FB685DB3AB619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v32.cab

Path C:\Users\Admin\AppData\Local\Temp\over271214\v32.cab
Size 11KB
SHA256 e8ecd381955950ebab587ae72a3823cb0fef0ad22e17fc93fb1fb2622a02549c
MD5 59076c1f1ea334248f28dbbc96abec5e
SHA1 c76da2f7caf0d9d44a6d7427b5fb7b38923e0438
SHA512 2d8ab8e6173421db59965d080f1fb39367c76024f5f1a9fd671f465f08b436c7648512913ab500e3932c23928fab638bdd9c7272634ed3f57adc9eee73d4f698
SSDEEP 192:M5GqVCca8Lxyb9jXo9R172JqJqKIxYPVCX01k9z3APPD6PK:M5GWCcaGAb9j4572JqXER9zwD
TLSH
T1C3323BE29F3CA183E95B6D606399ED933C7C43D70D80A0A311D5F99419A77C6EB2902C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v32.txt

Path C:\Users\Admin\AppData\Local\Temp\over271214\v32.txt
Size 6KB
SHA256 8458215e24a3c7d6813564ff23434fea52a08c606e3521b8e157fc7c0008c193
MD5 2d2bd626165f1ecfcda45f5ee1e56879
SHA1 99a8561119982d519740d7e1377f7a4f002628d2
SHA512 c0b478f09ca27380b888ffa457c056b35506303b1ca7fa1e6995a8479092bf2b54b9590626183f2f3025d35aaceb4be1271c6c8801cbbe478bfc474e878e6716
SSDEEP 96:1BjDj1O8qwEyFGBo5a9nKacKaL6fgtyqNvwwLVwLqwLtcLUTqNXIXB:TBQ
TLSH
T1B9E1C56B74D03C2D41306767F9B23AE2EF62D66396050458F00D724B3FB686DB3AB619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DZ0ZKO8M4VPNYG7JQTRQ.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DZ0ZKO8M4VPNYG7JQTRQ.temp
Size 1KB
SHA256 da8e6893ec3cc7b0bc23f785c5ba9a813ee818769e14087a1710ff03f6d9a986
MD5 fd46031b0e91c820675d28d5ae1609f5
SHA1 4f6adc25313831fc55fd5d932af0369b504a86a1
SHA512 44b8f71803d657475770dfb88a705396f505c4e64da6343518dd3b160a1c7970885e17d85a4f0604f9ec144250e8b14638fd79ff7a920b3eef5faa928426c38f
TLSH
T16B4146030E876F5EDD34437A9535C79BD3707C82BB25524EB9C4721EACB90004D5EAAD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1264-200-0x0000018112E70000-0x0000018112E71000-memory.dmp

Download

memory/1264-199-0x0000018112E70000-0x0000018112E71000-memory.dmp

Download

memory/1264-205-0x0000018112E70000-0x0000018112E71000-memory.dmp

Download

memory/1264-198-0x0000018112E70000-0x0000018112E71000-memory.dmp

Download

memory/1264-210-0x0000018112E70000-0x0000018112E71000-memory.dmp

Download

memory/1264-208-0x0000018112E70000-0x0000018112E71000-memory.dmp

Download

memory/1264-209-0x0000018112E70000-0x0000018112E71000-memory.dmp

Download

memory/1264-204-0x0000018112E70000-0x0000018112E71000-memory.dmp

Download

memory/1264-206-0x0000018112E70000-0x0000018112E71000-memory.dmp

Download

memory/1264-207-0x0000018112E70000-0x0000018112E71000-memory.dmp

Download

memory/1276-179-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/1276-0-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/1276-1-0x000000000199B000-0x000000000199C000-memory.dmp

Download

memory/1276-18-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/1276-151-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/1276-155-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/1276-19-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/1276-20-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/1276-160-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/1276-56-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/1276-166-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/1276-57-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/1276-171-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/1276-172-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/1276-191-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/1276-190-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/1276-182-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/1276-183-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/1400-143-0x00007FFF1BED0000-0x00007FFF1BEE0000-memory.dmp

Download

memory/1400-63-0x00007FFF1BED0000-0x00007FFF1BEE0000-memory.dmp

Download

memory/1400-61-0x00007FFF1BED0000-0x00007FFF1BEE0000-memory.dmp

Download

memory/1400-60-0x00007FFF1BED0000-0x00007FFF1BEE0000-memory.dmp

Download

memory/1400-59-0x00007FFF1BED0000-0x00007FFF1BEE0000-memory.dmp

Download

memory/1400-62-0x00007FFF1BED0000-0x00007FFF1BEE0000-memory.dmp

Download

memory/1400-64-0x00007FFF19D20000-0x00007FFF19D30000-memory.dmp

Download

memory/1400-65-0x00007FFF19D20000-0x00007FFF19D30000-memory.dmp

Download

memory/1400-142-0x00007FFF1BED0000-0x00007FFF1BEE0000-memory.dmp

Download

memory/1400-145-0x00007FFF1BED0000-0x00007FFF1BEE0000-memory.dmp

Download

memory/1400-144-0x00007FFF1BED0000-0x00007FFF1BEE0000-memory.dmp

Download

memory/3692-31-0x000001F6F7950000-0x000001F6F7972000-memory.dmp

Download