44caliber | daaaff6ff59a8152bfa8ba856907e6aa8225dd6408f42b3c177d77b7dc9271f3

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2023 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe
Size

558KB
MD5

137386ddefaeb0a54c91e3dc71b054a0
SHA1

0bb0cc12b7c85bd01379f8ac67dfbd1860c3ab1c
SHA256

daaaff6ff59a8152bfa8ba856907e6aa8225dd6408f42b3c177d77b7dc9271f3
SHA512

538678622662b910ec2bb7c17a045ff912c2b7e94b0c452ccf6419abd84f7c0bdb655c86a3429c22430aa47f9b1768edfc83f0ed27fbf69878a5c663a0d01a80
SSDEEP

12288:avYTtliLJiaw4D+jrZTc4L9DJCxe5QCB1XeOZofH4aaqlrCEFaIhn8R9:1TtkLJi5q+J40FQgFe2U2EIIK

Score

10^/10

44caliber persistence spyware stealer upx

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/1143278634606547015/JQSs3HkUCW0D0s-LEpqMmqIl4B2aemeRkd50LUDniNcTASKx3TqohfDEIC4WEy7g8rs-

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exeTinkoff.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	Tinkoff.exe

Drops startup file 3 IoCs

Processes:

NVDisplay.Container.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NVDisplay.Container.exe	NVDisplay.Container.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NVDisplay.Container.url	NVDisplay.Container.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NVDisplay.Container.exe	NVDisplay.Container.exe

Executes dropped EXE 4 IoCs

Processes:

pawno.exeTinkoff.exesystem32.exeNVDisplay.Container.exe

pid process

636 pawno.exe
1844 Tinkoff.exe
5064 system32.exe
5068 NVDisplay.Container.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
636	pawno.exe
1844	Tinkoff.exe
5064	system32.exe
5068	NVDisplay.Container.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\pawno.exe	upx
C:\Users\Admin\AppData\Local\Temp\pawno.exe	upx
behavioral2/memory/636-13-0x0000000000400000-0x00000000004D3000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\pawno.exe	upx
behavioral2/memory/636-169-0x0000000000400000-0x00000000004D3000-memory.dmp	upx
behavioral2/memory/636-190-0x0000000000400000-0x00000000004D3000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

NVDisplay.Container.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NVDisplay.Container.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\NVDisplay.Container.exe\" .."	NVDisplay.Container.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NVDisplay.Container.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\NVDisplay.Container.exe\" .."	NVDisplay.Container.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 ip-api.com
15 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
5	ip-api.com
15	ip-api.com

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

system32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	system32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	system32.exe

Creates scheduled task(s) 1 TTPs 26 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2396	schtasks.exe
3892	schtasks.exe
640	schtasks.exe
3640	schtasks.exe
1436	schtasks.exe
4576	schtasks.exe
4856	schtasks.exe
4356	schtasks.exe
1344	schtasks.exe
4148	schtasks.exe
4900	schtasks.exe
2052	schtasks.exe
3724	schtasks.exe
1784	schtasks.exe
4500	schtasks.exe
5112	schtasks.exe
4192	schtasks.exe
4132	schtasks.exe
3652	schtasks.exe
5040	schtasks.exe
1160	schtasks.exe
2700	schtasks.exe
3120	schtasks.exe
4524	schtasks.exe
4904	schtasks.exe
4616	schtasks.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4404 timeout.exe

pid	process
4404	timeout.exe

Kills process with taskkill 30 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exeTASKKILL.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exeTASKKILL.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exeTASKKILL.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exeTASKKILL.exetaskkill.exe

pid	process
2992	taskkill.exe
4020	taskkill.exe
1896	taskkill.exe
3532	taskkill.exe
1936	taskkill.exe
548	taskkill.exe
3460	taskkill.exe
1556	taskkill.exe
1956	taskkill.exe
3292	TASKKILL.exe
3708	taskkill.exe
2104	taskkill.exe
1844	taskkill.exe
3364	taskkill.exe
4784	TASKKILL.exe
4128	taskkill.exe
5080	taskkill.exe
3844	taskkill.exe
2988	taskkill.exe
4340	TASKKILL.exe
848	taskkill.exe
3272	taskkill.exe
4340	taskkill.exe
4024	taskkill.exe
4916	taskkill.exe
4644	taskkill.exe
4272	taskkill.exe
3152	taskkill.exe
4868	TASKKILL.exe
4972	taskkill.exe

Modifies registry class 10 IoCs

Processes:

pawno.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell\Open\command	pawno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\DefaultIcon	pawno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell\ = "Open"	pawno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell	pawno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell\Open	pawno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\shell\Open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pawno.exe \"%1\""	pawno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pwn	pawno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pwn\ = "PAWN.Script"	pawno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script	pawno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PAWN.Script\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pawno.exe,1"	pawno.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

system32.exeTinkoff.exe

pid	process
5064	system32.exe
5064	system32.exe
5064	system32.exe
5064	system32.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe
1844	Tinkoff.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

Processes:

NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exesystem32.exeTinkoff.exeTASKKILL.exeTASKKILL.exeNVDisplay.Container.exeTASKKILL.exeTASKKILL.exe

description	pid	process
Token: SeDebugPrivilege	4448	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe
Token: SeDebugPrivilege	5064	system32.exe
Token: SeDebugPrivilege	1844	Tinkoff.exe
Token: SeDebugPrivilege	3292	TASKKILL.exe
Token: SeDebugPrivilege	4868	TASKKILL.exe
Token: SeDebugPrivilege	5068	NVDisplay.Container.exe
Token: SeDebugPrivilege	4340	TASKKILL.exe
Token: SeDebugPrivilege	4784	TASKKILL.exe
Token: 33	5068	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	5068	NVDisplay.Container.exe
Token: 33	5068	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	5068	NVDisplay.Container.exe
Token: 33	5068	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	5068	NVDisplay.Container.exe
Token: 33	5068	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	5068	NVDisplay.Container.exe
Token: 33	5068	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	5068	NVDisplay.Container.exe
Token: 33	5068	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	5068	NVDisplay.Container.exe
Token: 33	5068	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	5068	NVDisplay.Container.exe
Token: 33	5068	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	5068	NVDisplay.Container.exe
Token: 33	5068	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	5068	NVDisplay.Container.exe
Token: 33	5068	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	5068	NVDisplay.Container.exe
Token: 33	5068	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	5068	NVDisplay.Container.exe
Token: 33	5068	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	5068	NVDisplay.Container.exe
Token: 33	5068	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	5068	NVDisplay.Container.exe
Token: 33	5068	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	5068	NVDisplay.Container.exe
Token: 33	5068	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	5068	NVDisplay.Container.exe
Token: 33	5068	NVDisplay.Container.exe
Token: SeIncBasePriorityPrivilege	5068	NVDisplay.Container.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exeTinkoff.exeNVDisplay.Container.execmd.execmd.exe

description	pid	process	target process
PID 4448 wrote to memory of 636	4448	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe	pawno.exe
PID 4448 wrote to memory of 636	4448	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe	pawno.exe
PID 4448 wrote to memory of 636	4448	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe	pawno.exe
PID 4448 wrote to memory of 1844	4448	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe	Tinkoff.exe
PID 4448 wrote to memory of 1844	4448	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe	Tinkoff.exe
PID 4448 wrote to memory of 1844	4448	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe	Tinkoff.exe
PID 4448 wrote to memory of 5064	4448	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe	system32.exe
PID 4448 wrote to memory of 5064	4448	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe	system32.exe
PID 1844 wrote to memory of 3292	1844	Tinkoff.exe	TASKKILL.exe
PID 1844 wrote to memory of 3292	1844	Tinkoff.exe	TASKKILL.exe
PID 1844 wrote to memory of 3292	1844	Tinkoff.exe	TASKKILL.exe
PID 1844 wrote to memory of 4868	1844	Tinkoff.exe	TASKKILL.exe
PID 1844 wrote to memory of 4868	1844	Tinkoff.exe	TASKKILL.exe
PID 1844 wrote to memory of 4868	1844	Tinkoff.exe	TASKKILL.exe
PID 1844 wrote to memory of 5068	1844	Tinkoff.exe	NVDisplay.Container.exe
PID 1844 wrote to memory of 5068	1844	Tinkoff.exe	NVDisplay.Container.exe
PID 1844 wrote to memory of 5068	1844	Tinkoff.exe	NVDisplay.Container.exe
PID 1844 wrote to memory of 1784	1844	Tinkoff.exe	cmd.exe
PID 1844 wrote to memory of 1784	1844	Tinkoff.exe	cmd.exe
PID 1844 wrote to memory of 1784	1844	Tinkoff.exe	cmd.exe
PID 5068 wrote to memory of 4340	5068	NVDisplay.Container.exe	TASKKILL.exe
PID 5068 wrote to memory of 4340	5068	NVDisplay.Container.exe	TASKKILL.exe
PID 5068 wrote to memory of 4340	5068	NVDisplay.Container.exe	TASKKILL.exe
PID 5068 wrote to memory of 4784	5068	NVDisplay.Container.exe	TASKKILL.exe
PID 5068 wrote to memory of 4784	5068	NVDisplay.Container.exe	TASKKILL.exe
PID 5068 wrote to memory of 4784	5068	NVDisplay.Container.exe	TASKKILL.exe
PID 1784 wrote to memory of 1912	1784	cmd.exe	choice.exe
PID 1784 wrote to memory of 1912	1784	cmd.exe	choice.exe
PID 1784 wrote to memory of 1912	1784	cmd.exe	choice.exe
PID 4448 wrote to memory of 1852	4448	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe	cmd.exe
PID 4448 wrote to memory of 1852	4448	NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe	cmd.exe
PID 1852 wrote to memory of 4404	1852	cmd.exe	timeout.exe
PID 1852 wrote to memory of 4404	1852	cmd.exe	timeout.exe
PID 5068 wrote to memory of 3708	5068	NVDisplay.Container.exe	taskkill.exe
PID 5068 wrote to memory of 3708	5068	NVDisplay.Container.exe	taskkill.exe
PID 5068 wrote to memory of 3708	5068	NVDisplay.Container.exe	taskkill.exe
PID 5068 wrote to memory of 3652	5068	NVDisplay.Container.exe	schtasks.exe
PID 5068 wrote to memory of 3652	5068	NVDisplay.Container.exe	schtasks.exe
PID 5068 wrote to memory of 3652	5068	NVDisplay.Container.exe	schtasks.exe
PID 5068 wrote to memory of 4356	5068	NVDisplay.Container.exe	schtasks.exe
PID 5068 wrote to memory of 4356	5068	NVDisplay.Container.exe	schtasks.exe
PID 5068 wrote to memory of 4356	5068	NVDisplay.Container.exe	schtasks.exe
PID 5068 wrote to memory of 4972	5068	NVDisplay.Container.exe	taskkill.exe
PID 5068 wrote to memory of 4972	5068	NVDisplay.Container.exe	taskkill.exe
PID 5068 wrote to memory of 4972	5068	NVDisplay.Container.exe	taskkill.exe
PID 5068 wrote to memory of 3164	5068	NVDisplay.Container.exe	schtasks.exe
PID 5068 wrote to memory of 3164	5068	NVDisplay.Container.exe	schtasks.exe
PID 5068 wrote to memory of 3164	5068	NVDisplay.Container.exe	schtasks.exe
PID 5068 wrote to memory of 4904	5068	NVDisplay.Container.exe	schtasks.exe
PID 5068 wrote to memory of 4904	5068	NVDisplay.Container.exe	schtasks.exe
PID 5068 wrote to memory of 4904	5068	NVDisplay.Container.exe	schtasks.exe
PID 5068 wrote to memory of 848	5068	NVDisplay.Container.exe	taskkill.exe
PID 5068 wrote to memory of 848	5068	NVDisplay.Container.exe	taskkill.exe
PID 5068 wrote to memory of 848	5068	NVDisplay.Container.exe	taskkill.exe
PID 5068 wrote to memory of 1472	5068	NVDisplay.Container.exe	schtasks.exe
PID 5068 wrote to memory of 1472	5068	NVDisplay.Container.exe	schtasks.exe
PID 5068 wrote to memory of 1472	5068	NVDisplay.Container.exe	schtasks.exe
PID 5068 wrote to memory of 4500	5068	NVDisplay.Container.exe	schtasks.exe
PID 5068 wrote to memory of 4500	5068	NVDisplay.Container.exe	schtasks.exe
PID 5068 wrote to memory of 4500	5068	NVDisplay.Container.exe	schtasks.exe
PID 5068 wrote to memory of 4024	5068	NVDisplay.Container.exe	taskkill.exe
PID 5068 wrote to memory of 4024	5068	NVDisplay.Container.exe	taskkill.exe
PID 5068 wrote to memory of 4024	5068	NVDisplay.Container.exe	taskkill.exe
PID 5068 wrote to memory of 3836	5068	NVDisplay.Container.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.137386ddefaeb0a54c91e3dc71b054a0_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4448

C:\Users\Admin\AppData\Local\Temp\pawno.exe
"C:\Users\Admin\AppData\Local\Temp\pawno.exe"
2⤵
- Executes dropped EXE
- Modifies registry class
PID:636

C:\Users\Admin\AppData\Local\Temp\system32.exe
"C:\Users\Admin\AppData\Local\Temp\system32.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\Users\Admin\AppData\Local\Temp\Tinkoff.exe
"C:\Users\Admin\AppData\Local\Temp\Tinkoff.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\SysWOW64\TASKKILL.exe
TASKKILL /F /IM cmd.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4868

C:\Windows\SysWOW64\TASKKILL.exe
TASKKILL /F /IM wscript.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3292

C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
"C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068

C:\Windows\SysWOW64\TASKKILL.exe
TASKKILL /F /IM wscript.exe
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4340

C:\Windows\SysWOW64\TASKKILL.exe
TASKKILL /F /IM cmd.exe
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4784

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:3708

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:3652

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:4356

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:4972

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:3164

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:4904

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:848

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:1472

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:4500

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:4024

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:3836

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:1344

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:3460

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:4092

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:5112

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:4020

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:3664

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:4616

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:5080

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:864

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:3640

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:1896

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:1852

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:2052

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:4128

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:4912

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:3652

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:3844

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:768

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:1436

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:4916

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:2516

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:5040

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:2104

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:4124

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:4192

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:1556

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:4060

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:2700

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:1844

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:3688

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:2396

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:3272

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:960

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:3724

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:4644

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:216

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:1160

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:1956

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:4944

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:1784

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:3532

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:1876

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:3120

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:1936

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:2388

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:4524

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:4272

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:212

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:3892

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:3364

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:1960

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:4148

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:548

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:3356

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:4900

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:2992

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:4276

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:4576

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:3152

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:3008

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:640

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:4340

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:2908

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:4132

C:\Windows\SysWOW64\taskkill.exe
taskkill /f im regedit.exe
4⤵
- Kills process with taskkill
PID:2988

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
4⤵
PID:1644

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
4⤵
- Creates scheduled task(s)
PID:4856

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\Tinkoff.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 5
4⤵
PID:1912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC64D.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:1852

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:4404

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\44\Процессы.txt
Filesize
1KB

MD5
e5a3c7dd324ae6311b1e0307e465dca0

SHA1
dac02163c4deb3f5c85cb4dd758bf2e4d4168084

SHA256
280660453b8991258b2625ec5087936c45a043f831c6a195da877d51147b1dfa

SHA512
17f7efc3b8ec9f7599b074adb6bd31aae22b190c7b44c91cb19fbbfa4ed9ad0e398db7cb6f41f195a65c07679a9ab777a6e336800626527ce9fde4f1add68500

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tinkoff.exe
Filesize
315KB

MD5
b0c8131c947f3fc6e211353713d41b45

SHA1
c01f124661f5eb43ef11280edf60c6de05239eab

SHA256
f509548a0056294ae31b828b5216edbf2d2b306a9fbe2befc653646a5fa696dd

SHA512
50efdd632ea9833ae89a5a5de4d22b9f61b809e2614490895458df68a7955eb5919f9600ef8ffc50621a133ab7e88922c529920073513024b4d48757f5584d3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tinkoff.exe
Filesize
315KB

MD5
b0c8131c947f3fc6e211353713d41b45

SHA1
c01f124661f5eb43ef11280edf60c6de05239eab

SHA256
f509548a0056294ae31b828b5216edbf2d2b306a9fbe2befc653646a5fa696dd

SHA512
50efdd632ea9833ae89a5a5de4d22b9f61b809e2614490895458df68a7955eb5919f9600ef8ffc50621a133ab7e88922c529920073513024b4d48757f5584d3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tinkoff.exe
Filesize
315KB

MD5
b0c8131c947f3fc6e211353713d41b45

SHA1
c01f124661f5eb43ef11280edf60c6de05239eab

SHA256
f509548a0056294ae31b828b5216edbf2d2b306a9fbe2befc653646a5fa696dd

SHA512
50efdd632ea9833ae89a5a5de4d22b9f61b809e2614490895458df68a7955eb5919f9600ef8ffc50621a133ab7e88922c529920073513024b4d48757f5584d3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\pawno.exe
Filesize
297KB

MD5
325558d389c149c420a2753e0d163d09

SHA1
3d1ac2fafe3ce5f5348a77c891074551a51e8fda

SHA256
796a94ddcdb41b32d32bee020ca85371cf6bbeb968036448d0e3b0b559d7e90b

SHA512
182358763d3565c4d29b51479eafeeee060b876a3884d7636caa47152d0edee1b531db955664f14e5b03e1820d960a2a532444b33702acb1a6b23b1bc450ce8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\pawno.exe
Filesize
297KB

MD5
325558d389c149c420a2753e0d163d09

SHA1
3d1ac2fafe3ce5f5348a77c891074551a51e8fda

SHA256
796a94ddcdb41b32d32bee020ca85371cf6bbeb968036448d0e3b0b559d7e90b

SHA512
182358763d3565c4d29b51479eafeeee060b876a3884d7636caa47152d0edee1b531db955664f14e5b03e1820d960a2a532444b33702acb1a6b23b1bc450ce8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\pawno.exe
Filesize
297KB

MD5
325558d389c149c420a2753e0d163d09

SHA1
3d1ac2fafe3ce5f5348a77c891074551a51e8fda

SHA256
796a94ddcdb41b32d32bee020ca85371cf6bbeb968036448d0e3b0b559d7e90b

SHA512
182358763d3565c4d29b51479eafeeee060b876a3884d7636caa47152d0edee1b531db955664f14e5b03e1820d960a2a532444b33702acb1a6b23b1bc450ce8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\system32.exe
Filesize
274KB

MD5
fee50b354a8993b7283f12b81ef8f855

SHA1
84c44e24e907a4365a506b04d8687582403338c9

SHA256
e3868f4ce019171488de75d019051f9d033a83ef198d77b194169b1592eb3013

SHA512
97922a9f44029fa7ffcf992d7d6fe681a267247f92878715e7804a9514c6df2eec404f2ab1cfdaaa4ffefa7b1a4734ac4d27d4e8791743d64ff4f71862fd08a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\system32.exe
Filesize
274KB

MD5
fee50b354a8993b7283f12b81ef8f855

SHA1
84c44e24e907a4365a506b04d8687582403338c9

SHA256
e3868f4ce019171488de75d019051f9d033a83ef198d77b194169b1592eb3013

SHA512
97922a9f44029fa7ffcf992d7d6fe681a267247f92878715e7804a9514c6df2eec404f2ab1cfdaaa4ffefa7b1a4734ac4d27d4e8791743d64ff4f71862fd08a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\system32.exe
Filesize
274KB

MD5
fee50b354a8993b7283f12b81ef8f855

SHA1
84c44e24e907a4365a506b04d8687582403338c9

SHA256
e3868f4ce019171488de75d019051f9d033a83ef198d77b194169b1592eb3013

SHA512
97922a9f44029fa7ffcf992d7d6fe681a267247f92878715e7804a9514c6df2eec404f2ab1cfdaaa4ffefa7b1a4734ac4d27d4e8791743d64ff4f71862fd08a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC64D.tmp.bat
Filesize
192B

MD5
3ec45aced2300ae1385088dbdc084870

SHA1
769a790903235fc3940489a6f75491922229b6d1

SHA256
17285df9e745284f1e570af7bcfb0426c27ac15a62ed6436cc252ff8d35a282f

SHA512
167b348ec80357704c509e6e45471bc46a42f085ab2c1d8d348bc76eb1aa64b4c70e9714bbc9d5f4843009cfdea411e42908106e7a3665831c08ecbb1571e696

Download Submit
C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
Filesize
315KB

MD5
b0c8131c947f3fc6e211353713d41b45

SHA1
c01f124661f5eb43ef11280edf60c6de05239eab

SHA256
f509548a0056294ae31b828b5216edbf2d2b306a9fbe2befc653646a5fa696dd

SHA512
50efdd632ea9833ae89a5a5de4d22b9f61b809e2614490895458df68a7955eb5919f9600ef8ffc50621a133ab7e88922c529920073513024b4d48757f5584d3e

Download Submit
C:\Users\Admin\AppData\Roaming\NVDisplay.Container.exe
Filesize
315KB

MD5
b0c8131c947f3fc6e211353713d41b45

SHA1
c01f124661f5eb43ef11280edf60c6de05239eab

SHA256
f509548a0056294ae31b828b5216edbf2d2b306a9fbe2befc653646a5fa696dd

SHA512
50efdd632ea9833ae89a5a5de4d22b9f61b809e2614490895458df68a7955eb5919f9600ef8ffc50621a133ab7e88922c529920073513024b4d48757f5584d3e

Download Submit
memory/636-190-0x0000000000400000-0x00000000004D3000-memory.dmp

Filesize
844KB

Download
memory/636-13-0x0000000000400000-0x00000000004D3000-memory.dmp

Filesize
844KB

Download
memory/636-57-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/636-174-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/636-169-0x0000000000400000-0x00000000004D3000-memory.dmp

Filesize
844KB

Download
memory/1844-156-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Filesize
64KB

Download
memory/1844-67-0x0000000004C50000-0x0000000004CEC000-memory.dmp

Filesize
624KB

Download
memory/1844-155-0x0000000005480000-0x0000000005A24000-memory.dmp

Filesize
5.6MB

Download
memory/1844-178-0x0000000074DE0000-0x0000000075590000-memory.dmp

Filesize
7.7MB

Download
memory/1844-65-0x0000000074DE0000-0x0000000075590000-memory.dmp

Filesize
7.7MB

Download
memory/1844-64-0x0000000000390000-0x00000000003E6000-memory.dmp

Filesize
344KB

Download
memory/1844-176-0x0000000074DE0000-0x0000000075590000-memory.dmp

Filesize
7.7MB

Download
memory/4448-0-0x00000000002F0000-0x0000000000382000-memory.dmp

Filesize
584KB

Download
memory/4448-184-0x00007FFCB7B70000-0x00007FFCB8631000-memory.dmp

Filesize
10.8MB

Download
memory/4448-162-0x00007FFCB7B70000-0x00007FFCB8631000-memory.dmp

Filesize
10.8MB

Download
memory/4448-163-0x000000001B390000-0x000000001B3A0000-memory.dmp

Filesize
64KB

Download
memory/4448-2-0x000000001B390000-0x000000001B3A0000-memory.dmp

Filesize
64KB

Download
memory/4448-1-0x00007FFCB7B70000-0x00007FFCB8631000-memory.dmp

Filesize
10.8MB

Download
memory/5064-31-0x0000025B36D50000-0x0000025B36D9A000-memory.dmp

Filesize
296KB

Download
memory/5064-47-0x00007FFCB7B70000-0x00007FFCB8631000-memory.dmp

Filesize
10.8MB

Download
memory/5064-66-0x0000025B51430000-0x0000025B51440000-memory.dmp

Filesize
64KB

Download
memory/5064-161-0x00007FFCB7B70000-0x00007FFCB8631000-memory.dmp

Filesize
10.8MB

Download
memory/5068-179-0x0000000005260000-0x0000000005270000-memory.dmp

Filesize
64KB

Download
memory/5068-188-0x0000000006090000-0x0000000006122000-memory.dmp

Filesize
584KB

Download
memory/5068-189-0x0000000006050000-0x000000000605A000-memory.dmp

Filesize
40KB

Download
memory/5068-177-0x0000000074DE0000-0x0000000075590000-memory.dmp

Filesize
7.7MB

Download
memory/5068-191-0x0000000074DE0000-0x0000000075590000-memory.dmp

Filesize
7.7MB

Download
memory/5068-192-0x0000000005260000-0x0000000005270000-memory.dmp

Filesize
64KB

Download
memory/5068-193-0x0000000006DB0000-0x0000000006E16000-memory.dmp

Filesize
408KB

Download
memory/5068-194-0x0000000008970000-0x0000000008988000-memory.dmp

Filesize
96KB

Download
memory/5068-197-0x0000000005260000-0x0000000005270000-memory.dmp

Filesize
64KB

Download
memory/5068-199-0x0000000005260000-0x0000000005270000-memory.dmp

Filesize
64KB

Download