44caliber | daaaff6ff59a8152bfa8ba856907e6aa8225dd6408f42b3c177d77b7dc9271f3

Analysis

max time kernel
163s
max time network
181s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19-10-2023 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe
Size

558KB
MD5

137386ddefaeb0a54c91e3dc71b054a0
SHA1

0bb0cc12b7c85bd01379f8ac67dfbd1860c3ab1c
SHA256

daaaff6ff59a8152bfa8ba856907e6aa8225dd6408f42b3c177d77b7dc9271f3
SHA512

538678622662b910ec2bb7c17a045ff912c2b7e94b0c452ccf6419abd84f7c0bdb655c86a3429c22430aa47f9b1768edfc83f0ed27fbf69878a5c663a0d01a80
SSDEEP

12288:avYTtliLJiaw4D+jrZTc4L9DJCxe5QCB1XeOZofH4aaqlrCEFaIhn8R9:1TtkLJi5q+J40FQgFe2U2EIIK

Score

10^/10

44caliber persistence spyware stealer upx

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/1143278634606547015/JQSs3HkUCW0D0s-LEpqMmqIl4B2aemeRkd50LUDniNcTASKx3TqohfDEIC4WEy7g8rs-

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2848 cmd.exe

pid	process
2848	cmd.exe

Drops startup file 3 IoCs

Processes:

NVDisplay.Container.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NVDisplay.Container.exe	NVDisplay.Container.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NVDisplay.Container.exe	NVDisplay.Container.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NVDisplay.Container.url	NVDisplay.Container.exe

Executes dropped EXE 4 IoCs

Processes:

pawno.exeTinkoff.exesystem32.exeNVDisplay.Container.exe

pid process

2716 pawno.exe
2116 Tinkoff.exe
2764 system32.exe
2372 NVDisplay.Container.exe
Loads dropped DLL 1 IoCs

Processes:

Tinkoff.exe

pid process

2116 Tinkoff.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2716	pawno.exe
2116	Tinkoff.exe
2764	system32.exe
2372	NVDisplay.Container.exe

pid	process
2116	Tinkoff.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\pawno.exe	upx
behavioral1/memory/2716-10-0x0000000000400000-0x00000000004D3000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\pawno.exe	upx
C:\Users\Admin\AppData\Local\Temp\pawno.exe	upx
behavioral1/memory/2716-138-0x0000000000400000-0x00000000004D3000-memory.dmp	upx
behavioral1/memory/2716-155-0x0000000000400000-0x00000000004D3000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

NVDisplay.Container.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Windows\CurrentVersion\Run\NVDisplay.Container.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\NVDisplay.Container.exe\" .."	NVDisplay.Container.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NVDisplay.Container.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\NVDisplay.Container.exe\" .."	NVDisplay.Container.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
8 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
4	ip-api.com
8	ip-api.com

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

system32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	system32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	system32.exe

Creates scheduled task(s) 1 TTPs 23 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2816	schtasks.exe
2936	schtasks.exe
2784	schtasks.exe
1952	schtasks.exe
2624	schtasks.exe
3012	schtasks.exe
1280	schtasks.exe
1684	schtasks.exe
2388	schtasks.exe
2268	schtasks.exe
2736	schtasks.exe
672	schtasks.exe
2932	schtasks.exe
2548	schtasks.exe
1548	schtasks.exe
2648	schtasks.exe
2596	schtasks.exe
2788	schtasks.exe
544	schtasks.exe
304	schtasks.exe
1616	schtasks.exe
1832	schtasks.exe
576	schtasks.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2396 timeout.exe

pid	process
2396	timeout.exe

Kills process with taskkill 27 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exeTASKKILL.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exeTASKKILL.exeTASKKILL.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exeTASKKILL.exetaskkill.exetaskkill.exe

pid	process
2772	taskkill.exe
640	taskkill.exe
1968	taskkill.exe
2720	taskkill.exe
1980	taskkill.exe
1384	TASKKILL.exe
1628	taskkill.exe
2776	taskkill.exe
1140	taskkill.exe
2488	taskkill.exe
1520	taskkill.exe
1132	TASKKILL.exe
1812	TASKKILL.exe
552	taskkill.exe
1492	taskkill.exe
2020	taskkill.exe
2952	taskkill.exe
2220	taskkill.exe
1640	taskkill.exe
1592	taskkill.exe
1728	taskkill.exe
2100	taskkill.exe
1568	taskkill.exe
2456	taskkill.exe
948	TASKKILL.exe
2500	taskkill.exe
2696	taskkill.exe

Modifies registry class 10 IoCs

Processes:

pawno.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\DefaultIcon	pawno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell\Open\command	pawno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell\Open	pawno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pwn\ = "PAWN.Script"	pawno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script	pawno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pawno.exe,1"	pawno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell	pawno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell\ = "Open"	pawno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell\Open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pawno.exe \"%1\""	pawno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pwn	pawno.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

system32.exeTinkoff.exe

pid	process
2764	system32.exe
2764	system32.exe
2764	system32.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe
2116	Tinkoff.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

Processes:

NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exesystem32.exeTinkoff.exeTASKKILL.exeTASKKILL.exeNVDisplay.Container.exeTASKKILL.exeTASKKILL.exe

description	pid	process
Token: SeDebugPrivilege	2232	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe
Token: SeDebugPrivilege	2764	system32.exe
Token: SeDebugPrivilege	2116	Tinkoff.exe
Token: SeDebugPrivilege	1812	TASKKILL.exe
Token: SeDebugPrivilege	1132	TASKKILL.exe
Token: SeDebugPrivilege	2372	NVDisplay.Container.exe
Token: SeDebugPrivilege	948	TASKKILL.exe
Token: SeDebugPrivilege	1384	TASKKILL.exe
Token: 33	2372	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	2372	NVDisplay.Container.exe
Token: 33	2372	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	2372	NVDisplay.Container.exe
Token: 33	2372	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	2372	NVDisplay.Container.exe
Token: 33	2372	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	2372	NVDisplay.Container.exe
Token: 33	2372	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	2372	NVDisplay.Container.exe
Token: 33	2372	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	2372	NVDisplay.Container.exe
Token: 33	2372	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	2372	NVDisplay.Container.exe
Token: 33	2372	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	2372	NVDisplay.Container.exe
Token: 33	2372	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	2372	NVDisplay.Container.exe
Token: 33	2372	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	2372	NVDisplay.Container.exe
Token: 33	2372	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	2372	NVDisplay.Container.exe
Token: 33	2372	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	2372	NVDisplay.Container.exe
Token: 33	2372	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	2372	NVDisplay.Container.exe
Token: 33	2372	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	2372	NVDisplay.Container.exe
Token: 33	2372	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	2372	NVDisplay.Container.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exeTinkoff.execmd.execmd.exeNVDisplay.Container.exe

description	pid	process	target process
PID 2232 wrote to memory of 2716	2232	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe	pawno.exe
PID 2232 wrote to memory of 2716	2232	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe	pawno.exe
PID 2232 wrote to memory of 2716	2232	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe	pawno.exe
PID 2232 wrote to memory of 2716	2232	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe	pawno.exe
PID 2232 wrote to memory of 2116	2232	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe	Tinkoff.exe
PID 2232 wrote to memory of 2116	2232	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe	Tinkoff.exe
PID 2232 wrote to memory of 2116	2232	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe	Tinkoff.exe
PID 2232 wrote to memory of 2116	2232	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe	Tinkoff.exe
PID 2232 wrote to memory of 2764	2232	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe	system32.exe
PID 2232 wrote to memory of 2764	2232	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe	system32.exe
PID 2232 wrote to memory of 2764	2232	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe	system32.exe
PID 2116 wrote to memory of 1132	2116	Tinkoff.exe	TASKKILL.exe
PID 2116 wrote to memory of 1132	2116	Tinkoff.exe	TASKKILL.exe
PID 2116 wrote to memory of 1132	2116	Tinkoff.exe	TASKKILL.exe
PID 2116 wrote to memory of 1132	2116	Tinkoff.exe	TASKKILL.exe
PID 2116 wrote to memory of 1812	2116	Tinkoff.exe	TASKKILL.exe
PID 2116 wrote to memory of 1812	2116	Tinkoff.exe	TASKKILL.exe
PID 2116 wrote to memory of 1812	2116	Tinkoff.exe	TASKKILL.exe
PID 2116 wrote to memory of 1812	2116	Tinkoff.exe	TASKKILL.exe
PID 2232 wrote to memory of 2848	2232	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe	cmd.exe
PID 2232 wrote to memory of 2848	2232	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe	cmd.exe
PID 2232 wrote to memory of 2848	2232	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe	cmd.exe
PID 2848 wrote to memory of 2396	2848	cmd.exe	timeout.exe
PID 2848 wrote to memory of 2396	2848	cmd.exe	timeout.exe
PID 2848 wrote to memory of 2396	2848	cmd.exe	timeout.exe
PID 2116 wrote to memory of 2372	2116	Tinkoff.exe	NVDisplay.Container.exe
PID 2116 wrote to memory of 2372	2116	Tinkoff.exe	NVDisplay.Container.exe
PID 2116 wrote to memory of 2372	2116	Tinkoff.exe	NVDisplay.Container.exe
PID 2116 wrote to memory of 2372	2116	Tinkoff.exe	NVDisplay.Container.exe
PID 2116 wrote to memory of 1260	2116	Tinkoff.exe	cmd.exe
PID 2116 wrote to memory of 1260	2116	Tinkoff.exe	cmd.exe
PID 2116 wrote to memory of 1260	2116	Tinkoff.exe	cmd.exe
PID 2116 wrote to memory of 1260	2116	Tinkoff.exe	cmd.exe
PID 1260 wrote to memory of 1972	1260	cmd.exe	choice.exe
PID 1260 wrote to memory of 1972	1260	cmd.exe	choice.exe
PID 1260 wrote to memory of 1972	1260	cmd.exe	choice.exe
PID 1260 wrote to memory of 1972	1260	cmd.exe	choice.exe
PID 2372 wrote to memory of 948	2372	NVDisplay.Container.exe	TASKKILL.exe
PID 2372 wrote to memory of 948	2372	NVDisplay.Container.exe	TASKKILL.exe
PID 2372 wrote to memory of 948	2372	NVDisplay.Container.exe	TASKKILL.exe
PID 2372 wrote to memory of 948	2372	NVDisplay.Container.exe	TASKKILL.exe
PID 2372 wrote to memory of 1384	2372	NVDisplay.Container.exe	TASKKILL.exe
PID 2372 wrote to memory of 1384	2372	NVDisplay.Container.exe	TASKKILL.exe
PID 2372 wrote to memory of 1384	2372	NVDisplay.Container.exe	TASKKILL.exe
PID 2372 wrote to memory of 1384	2372	NVDisplay.Container.exe	TASKKILL.exe
PID 2372 wrote to memory of 2100	2372	NVDisplay.Container.exe	taskkill.exe
PID 2372 wrote to memory of 2100	2372	NVDisplay.Container.exe	taskkill.exe
PID 2372 wrote to memory of 2100	2372	NVDisplay.Container.exe	taskkill.exe
PID 2372 wrote to memory of 2100	2372	NVDisplay.Container.exe	taskkill.exe
PID 2372 wrote to memory of 2732	2372	NVDisplay.Container.exe	schtasks.exe
PID 2372 wrote to memory of 2732	2372	NVDisplay.Container.exe	schtasks.exe
PID 2372 wrote to memory of 2732	2372	NVDisplay.Container.exe	schtasks.exe
PID 2372 wrote to memory of 2732	2372	NVDisplay.Container.exe	schtasks.exe
PID 2372 wrote to memory of 304	2372	NVDisplay.Container.exe	schtasks.exe
PID 2372 wrote to memory of 304	2372	NVDisplay.Container.exe	schtasks.exe
PID 2372 wrote to memory of 304	2372	NVDisplay.Container.exe	schtasks.exe
PID 2372 wrote to memory of 304	2372	NVDisplay.Container.exe	schtasks.exe
PID 2372 wrote to memory of 1568	2372	NVDisplay.Container.exe	taskkill.exe
PID 2372 wrote to memory of 1568	2372	NVDisplay.Container.exe	taskkill.exe
PID 2372 wrote to memory of 1568	2372	NVDisplay.Container.exe	taskkill.exe
PID 2372 wrote to memory of 1568	2372	NVDisplay.Container.exe	taskkill.exe
PID 2372 wrote to memory of 2384	2372	NVDisplay.Container.exe	schtasks.exe
PID 2372 wrote to memory of 2384	2372	NVDisplay.Container.exe	schtasks.exe
PID 2372 wrote to memory of 2384	2372	NVDisplay.Container.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232

C:\Users\Admin\AppData\Local\Temp\pawno.exe
"C:\Users\Admin\AppData\Local\Temp\pawno.exe"
2⤵
- Executes dropped EXE
- Modifies registry class
PID:2716

C:\Users\Admin\AppData\Local\Temp\Tinkoff.exe
"C:\Users\Admin\AppData\Local\Temp\Tinkoff.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\TASKKILL.exe
TASKKILL /F /IM wscript.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1132

C:\Windows\SysWOW64\TASKKILL.exe
TASKKILL /F /IM cmd.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1812

C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
"C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372

C:\Windows\SysWOW64\TASKKILL.exe
TASKKILL /F /IM cmd.exe
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1384

C:\Windows\SysWOW64\TASKKILL.exe
TASKKILL /F /IM wscript.exe
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:948

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:2100

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:2732

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:304

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:1568

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:2384

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:1616

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:552

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:1328

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:2736

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:2772

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:2656

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:2816

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:2500

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:1156

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:1952

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:1628

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:320

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:1832

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:2020

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:2804

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:672

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:2776

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:1660

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:2936

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:2952

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:984

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:576

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:1492

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:1340

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:2932

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:2220

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:2104

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:2624

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:2696

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:2556

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:3012

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:1140

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:1944

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:2548

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:1640

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:1888

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:1280

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:640

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:1384

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:1548

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:2488

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:1880

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:1684

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:1520

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:2120

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:2388

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:1592

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:2200

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:2268

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:1968

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:2752

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:2648

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:2720

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:2980

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:2596

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:1728

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:2796

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:2784

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:2456

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:2000

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:2788

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:1980

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:2888

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:544

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\Tinkoff.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 5
4⤵
PID:1972

C:\Users\Admin\AppData\Local\Temp\system32.exe
"C:\Users\Admin\AppData\Local\Temp\system32.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpCE57.tmp.bat""
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2848

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:2396

C:\Windows\system32\taskeng.exe
taskeng.exe {229F7D44-A038-46E1-B146-074C763C69F0} S-1-5-21-2180306848-1874213455-4093218721-1000:XEBBURHY\Admin:Interactive:[1]
1⤵
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\NVDisplay.Container.exe

Filesize
315KB

MD5
b0c8131c947f3fc6e211353713d41b45

SHA1
c01f124661f5eb43ef11280edf60c6de05239eab

SHA256
f509548a0056294ae31b828b5216edbf2d2b306a9fbe2befc653646a5fa696dd

SHA512
50efdd632ea9833ae89a5a5de4d22b9f61b809e2614490895458df68a7955eb5919f9600ef8ffc50621a133ab7e88922c529920073513024b4d48757f5584d3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edd6e86faa03902d4cc30c2a6ded1bd7

SHA1
cf3cd844202da005526f9ea773208b705161de60

SHA256
4bcb1a77921f5cc568a0f1858203ae3bc9acacc8e370d33374af93786e986637

SHA512
a68aaf5cfaf209dee68ea65b16f3289231572d5246f18f43b53a30ecf5d875244719c56d9c2c9300aa5ee6e3c15074bce882ad090e27578e4eaf2f6598050b84

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC9D9.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCA97.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tinkoff.exe

Filesize
315KB

MD5
b0c8131c947f3fc6e211353713d41b45

SHA1
c01f124661f5eb43ef11280edf60c6de05239eab

SHA256
f509548a0056294ae31b828b5216edbf2d2b306a9fbe2befc653646a5fa696dd

SHA512
50efdd632ea9833ae89a5a5de4d22b9f61b809e2614490895458df68a7955eb5919f9600ef8ffc50621a133ab7e88922c529920073513024b4d48757f5584d3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tinkoff.exe

Filesize
315KB

MD5
b0c8131c947f3fc6e211353713d41b45

SHA1
c01f124661f5eb43ef11280edf60c6de05239eab

SHA256
f509548a0056294ae31b828b5216edbf2d2b306a9fbe2befc653646a5fa696dd

SHA512
50efdd632ea9833ae89a5a5de4d22b9f61b809e2614490895458df68a7955eb5919f9600ef8ffc50621a133ab7e88922c529920073513024b4d48757f5584d3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\pawno.exe

Filesize
297KB

MD5
325558d389c149c420a2753e0d163d09

SHA1
3d1ac2fafe3ce5f5348a77c891074551a51e8fda

SHA256
796a94ddcdb41b32d32bee020ca85371cf6bbeb968036448d0e3b0b559d7e90b

SHA512
182358763d3565c4d29b51479eafeeee060b876a3884d7636caa47152d0edee1b531db955664f14e5b03e1820d960a2a532444b33702acb1a6b23b1bc450ce8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\pawno.exe

Filesize
297KB

MD5
325558d389c149c420a2753e0d163d09

SHA1
3d1ac2fafe3ce5f5348a77c891074551a51e8fda

SHA256
796a94ddcdb41b32d32bee020ca85371cf6bbeb968036448d0e3b0b559d7e90b

SHA512
182358763d3565c4d29b51479eafeeee060b876a3884d7636caa47152d0edee1b531db955664f14e5b03e1820d960a2a532444b33702acb1a6b23b1bc450ce8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\pawno.exe

Filesize
297KB

MD5
325558d389c149c420a2753e0d163d09

SHA1
3d1ac2fafe3ce5f5348a77c891074551a51e8fda

SHA256
796a94ddcdb41b32d32bee020ca85371cf6bbeb968036448d0e3b0b559d7e90b

SHA512
182358763d3565c4d29b51479eafeeee060b876a3884d7636caa47152d0edee1b531db955664f14e5b03e1820d960a2a532444b33702acb1a6b23b1bc450ce8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\system32.exe

Filesize
274KB

MD5
fee50b354a8993b7283f12b81ef8f855

SHA1
84c44e24e907a4365a506b04d8687582403338c9

SHA256
e3868f4ce019171488de75d019051f9d033a83ef198d77b194169b1592eb3013

SHA512
97922a9f44029fa7ffcf992d7d6fe681a267247f92878715e7804a9514c6df2eec404f2ab1cfdaaa4ffefa7b1a4734ac4d27d4e8791743d64ff4f71862fd08a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\system32.exe

Filesize
274KB

MD5
fee50b354a8993b7283f12b81ef8f855

SHA1
84c44e24e907a4365a506b04d8687582403338c9

SHA256
e3868f4ce019171488de75d019051f9d033a83ef198d77b194169b1592eb3013

SHA512
97922a9f44029fa7ffcf992d7d6fe681a267247f92878715e7804a9514c6df2eec404f2ab1cfdaaa4ffefa7b1a4734ac4d27d4e8791743d64ff4f71862fd08a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCE57.tmp.bat

Filesize
192B

MD5
8b4c1861359b209e058d68c1843d9c70

SHA1
316db671d53049f47f388a36509b05b0601432c9

SHA256
c2110a193408f67b5f89d68f1517d6dd9cda16c116186c956804c9c25896602e

SHA512
ca31314c404ca4ca34f919acbbb50e21e558a6da199640e46703ec8b7cdb6899e912eb70a7fbd394e58cd6f6c7feb17f1d897826c34b49cec3b9b2810f75cb5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCE57.tmp.bat

Filesize
192B

MD5
8b4c1861359b209e058d68c1843d9c70

SHA1
316db671d53049f47f388a36509b05b0601432c9

SHA256
c2110a193408f67b5f89d68f1517d6dd9cda16c116186c956804c9c25896602e

SHA512
ca31314c404ca4ca34f919acbbb50e21e558a6da199640e46703ec8b7cdb6899e912eb70a7fbd394e58cd6f6c7feb17f1d897826c34b49cec3b9b2810f75cb5b

Download Submit
C:\Users\Admin\AppData\Roaming\44\Процессы.txt

Filesize
465B

MD5
584a2502b7962060f9e2587d548e1d23

SHA1
d84c9d521447a2b54a74923af1273f4e314cc8f8

SHA256
8579a47acac4398917524245b96e10e2bc7b0693098665ab01ac399e7d81a23e

SHA512
d58cc87c395945499b83dd59cfeacff5d08c2a731f6ecae3e6d0e1833d3aba6372bb3735b33b9be4f728c7cc637c3c4926b7f8fc2cfec46fa58bc476946ebcf3

Download Submit
C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe

Filesize
315KB

MD5
b0c8131c947f3fc6e211353713d41b45

SHA1
c01f124661f5eb43ef11280edf60c6de05239eab

SHA256
f509548a0056294ae31b828b5216edbf2d2b306a9fbe2befc653646a5fa696dd

SHA512
50efdd632ea9833ae89a5a5de4d22b9f61b809e2614490895458df68a7955eb5919f9600ef8ffc50621a133ab7e88922c529920073513024b4d48757f5584d3e

Download Submit
C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe

Filesize
315KB

MD5
b0c8131c947f3fc6e211353713d41b45

SHA1
c01f124661f5eb43ef11280edf60c6de05239eab

SHA256
f509548a0056294ae31b828b5216edbf2d2b306a9fbe2befc653646a5fa696dd

SHA512
50efdd632ea9833ae89a5a5de4d22b9f61b809e2614490895458df68a7955eb5919f9600ef8ffc50621a133ab7e88922c529920073513024b4d48757f5584d3e

Download Submit
\Users\Admin\AppData\Roaming\NVDisplay.Container.exe

Filesize
315KB

MD5
b0c8131c947f3fc6e211353713d41b45

SHA1
c01f124661f5eb43ef11280edf60c6de05239eab

SHA256
f509548a0056294ae31b828b5216edbf2d2b306a9fbe2befc653646a5fa696dd

SHA512
50efdd632ea9833ae89a5a5de4d22b9f61b809e2614490895458df68a7955eb5919f9600ef8ffc50621a133ab7e88922c529920073513024b4d48757f5584d3e

Download Submit
memory/2116-151-0x0000000074770000-0x0000000074E5E000-memory.dmp

Filesize
6.9MB

Download
memory/2116-46-0x0000000001320000-0x0000000001376000-memory.dmp

Filesize
344KB

Download
memory/2116-47-0x0000000074770000-0x0000000074E5E000-memory.dmp

Filesize
6.9MB

Download
memory/2116-48-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

Filesize
256KB

Download
memory/2116-142-0x0000000074770000-0x0000000074E5E000-memory.dmp

Filesize
6.9MB

Download
memory/2232-135-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

Filesize
9.9MB

Download
memory/2232-26-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

Filesize
9.9MB

Download
memory/2232-2-0x000000001BCA0000-0x000000001BD20000-memory.dmp

Filesize
512KB

Download
memory/2232-1-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

Filesize
9.9MB

Download
memory/2232-0-0x0000000000C60000-0x0000000000CF2000-memory.dmp

Filesize
584KB

Download
memory/2372-163-0x0000000004DC0000-0x0000000004E00000-memory.dmp

Filesize
256KB

Download
memory/2372-160-0x0000000004DC0000-0x0000000004E00000-memory.dmp

Filesize
256KB

Download
memory/2372-157-0x0000000004DC0000-0x0000000004E00000-memory.dmp

Filesize
256KB

Download
memory/2372-156-0x0000000074770000-0x0000000074E5E000-memory.dmp

Filesize
6.9MB

Download
memory/2372-162-0x0000000004DC0000-0x0000000004E00000-memory.dmp

Filesize
256KB

Download
memory/2372-165-0x0000000004DC0000-0x0000000004E00000-memory.dmp

Filesize
256KB

Download
memory/2372-152-0x0000000004DC0000-0x0000000004E00000-memory.dmp

Filesize
256KB

Download
memory/2372-149-0x0000000000220000-0x0000000000276000-memory.dmp

Filesize
344KB

Download
memory/2372-150-0x0000000074770000-0x0000000074E5E000-memory.dmp

Filesize
6.9MB

Download
memory/2716-155-0x0000000000400000-0x00000000004D3000-memory.dmp

Filesize
844KB

Download
memory/2716-18-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2716-139-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2716-138-0x0000000000400000-0x00000000004D3000-memory.dmp

Filesize
844KB

Download
memory/2716-10-0x0000000000400000-0x00000000004D3000-memory.dmp

Filesize
844KB

Download
memory/2764-25-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

Filesize
9.9MB

Download
memory/2764-27-0x000000001B410000-0x000000001B490000-memory.dmp

Filesize
512KB

Download
memory/2764-137-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

Filesize
9.9MB

Download
memory/2764-23-0x0000000001040000-0x000000000108A000-memory.dmp

Filesize
296KB

Download