Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    17-04-2024 02:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2b9b0cb6745cfd72d49fec5f4fd81e1e7ec49987805f063c43ba96cc4a71926d.exe

  • Size

    1.8MB

  • MD5

    15062a2e81b42e1b7fcecac7cf2cf537

  • SHA1

    ef46d51b985674fb192308a706fe1acdfba5c582

  • SHA256

    2b9b0cb6745cfd72d49fec5f4fd81e1e7ec49987805f063c43ba96cc4a71926d

  • SHA512

    da3f8cdfa6aa692755629af61cff9d19246c618859e59de46cf37ecc7a570b6f422e62f851f09f5938058a83b6a541a929adb1d983ded0ac97a52fe0cf7ab2e1

  • SSDEEP

    49152:24xOA2lcco7IUKtLpcWjfa6YFJvPoZTK9kq99:2Ip2wAtWGSfFF1eq

Score
10/10
amadeygluptebaredlineriseprosmokeloaderxmrigzgrat@oleh_psppub1backdoordiscoverydropperevasioninfostealerloaderminerpersistenceratrootkitspywarestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Extracted

Family

redline

Botnet

@OLEH_PSP

C2

185.172.128.33:8970

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

risepro

C2

147.45.47.93:58709

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect ZGRat V1 2 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 5 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    evasion
  • XMRig Miner payload 9 IoCs
    miner
  • Blocklisted process makes network request 2 IoCs
  • Creates new service(s) 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Stops running service(s) 3 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 36 IoCs
  • Identifies Wine through registry keys 2 TTPs 3 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 6 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 11 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 5 IoCs
  • Launches sc.exe 17 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2b9b0cb6745cfd72d49fec5f4fd81e1e7ec49987805f063c43ba96cc4a71926d.exe
    "C:\Users\Admin\AppData\Local\Temp\2b9b0cb6745cfd72d49fec5f4fd81e1e7ec49987805f063c43ba96cc4a71926d.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:3744
  • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
    C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2536
    • C:\Users\Admin\AppData\Local\Temp\1000985001\alexxxxxxxx.exe
      "C:\Users\Admin\AppData\Local\Temp\1000985001\alexxxxxxxx.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3840
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4980
        • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
          "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
          4⤵
          • Executes dropped EXE
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2224
        • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
          "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3324
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
          4⤵
            PID:3000
            • C:\Windows\SysWOW64\choice.exe
              choice /C Y /N /D Y /T 3
              5⤵
                PID:4888
        • C:\Users\Admin\AppData\Local\Temp\1001053001\gold.exe
          "C:\Users\Admin\AppData\Local\Temp\1001053001\gold.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:3808
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
              PID:4196
          • C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
            "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3792
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe" /F
              3⤵
              • Creates scheduled task(s)
              PID:1516
            • C:\Users\Admin\AppData\Local\Temp\1000194001\toolspub1.exe
              "C:\Users\Admin\AppData\Local\Temp\1000194001\toolspub1.exe"
              3⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:5000
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 384
                4⤵
                • Program crash
                PID:3428
            • C:\Users\Admin\AppData\Local\Temp\1000195001\4767d2e713f2021e8fe856e3ea638b58.exe
              "C:\Users\Admin\AppData\Local\Temp\1000195001\4767d2e713f2021e8fe856e3ea638b58.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3912
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4852
              • C:\Users\Admin\AppData\Local\Temp\1000195001\4767d2e713f2021e8fe856e3ea638b58.exe
                "C:\Users\Admin\AppData\Local\Temp\1000195001\4767d2e713f2021e8fe856e3ea638b58.exe"
                4⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Checks for VirtualBox DLLs, possible anti-VM trick
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                PID:3564
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  5⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:972
                • C:\Windows\system32\cmd.exe
                  C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                  5⤵
                    PID:2296
                    • C:\Windows\system32\netsh.exe
                      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                      6⤵
                      • Modifies Windows Firewall
                      PID:4936
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    5⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3604
                    • C:\Windows\System32\Conhost.exe
                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      6⤵
                        PID:4544
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      5⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4972
                    • C:\Windows\rss\csrss.exe
                      C:\Windows\rss\csrss.exe
                      5⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Manipulates WinMonFS driver.
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2700
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        6⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1636
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                        6⤵
                        • Creates scheduled task(s)
                        PID:2252
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /delete /tn ScheduledUpdate /f
                        6⤵
                          PID:2224
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          6⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4440
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          6⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4864
                        • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                          C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                          6⤵
                          • Executes dropped EXE
                          PID:1640
                        • C:\Windows\SYSTEM32\schtasks.exe
                          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                          6⤵
                          • Creates scheduled task(s)
                          PID:4168
                        • C:\Windows\windefender.exe
                          "C:\Windows\windefender.exe"
                          6⤵
                          • Executes dropped EXE
                          PID:1628
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                            7⤵
                              PID:4608
                              • C:\Windows\SysWOW64\sc.exe
                                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                8⤵
                                • Launches sc.exe
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3196
                    • C:\Users\Admin\AppData\Local\Temp\1000196001\FirstZ.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000196001\FirstZ.exe"
                      3⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3572
                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                        4⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2888
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                        4⤵
                          PID:1428
                          • C:\Windows\system32\wusa.exe
                            wusa /uninstall /kb:890830 /quiet /norestart
                            5⤵
                              PID:4608
                          • C:\Windows\system32\sc.exe
                            C:\Windows\system32\sc.exe stop UsoSvc
                            4⤵
                            • Launches sc.exe
                            PID:3684
                          • C:\Windows\system32\sc.exe
                            C:\Windows\system32\sc.exe stop WaaSMedicSvc
                            4⤵
                            • Launches sc.exe
                            PID:3920
                          • C:\Windows\system32\sc.exe
                            C:\Windows\system32\sc.exe stop wuauserv
                            4⤵
                            • Launches sc.exe
                            PID:4060
                          • C:\Windows\system32\sc.exe
                            C:\Windows\system32\sc.exe stop bits
                            4⤵
                            • Launches sc.exe
                            PID:1372
                          • C:\Windows\system32\sc.exe
                            C:\Windows\system32\sc.exe stop dosvc
                            4⤵
                            • Launches sc.exe
                            PID:972
                          • C:\Windows\system32\powercfg.exe
                            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                            4⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3004
                          • C:\Windows\system32\powercfg.exe
                            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                            4⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3368
                          • C:\Windows\system32\powercfg.exe
                            C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                            4⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1532
                          • C:\Windows\system32\powercfg.exe
                            C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                            4⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4396
                          • C:\Windows\system32\sc.exe
                            C:\Windows\system32\sc.exe delete "WSNKISKT"
                            4⤵
                            • Launches sc.exe
                            PID:4936
                          • C:\Windows\system32\sc.exe
                            C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
                            4⤵
                            • Launches sc.exe
                            PID:1672
                          • C:\Windows\system32\sc.exe
                            C:\Windows\system32\sc.exe stop eventlog
                            4⤵
                            • Launches sc.exe
                            PID:4384
                          • C:\Windows\system32\sc.exe
                            C:\Windows\system32\sc.exe start "WSNKISKT"
                            4⤵
                            • Launches sc.exe
                            PID:4048
                      • C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe
                        "C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious use of WriteProcessMemory
                        PID:4544
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          3⤵
                            PID:2100
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            3⤵
                              PID:464
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 896
                              3⤵
                              • Program crash
                              PID:240
                          • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
                            "C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"
                            2⤵
                              PID:336
                            • C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe
                              "C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe"
                              2⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1276
                            • C:\Windows\SysWOW64\rundll32.exe
                              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
                              2⤵
                              • Loads dropped DLL
                              PID:3064
                              • C:\Windows\system32\rundll32.exe
                                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
                                3⤵
                                • Blocklisted process makes network request
                                • Loads dropped DLL
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1472
                                • C:\Windows\system32\netsh.exe
                                  netsh wlan show profiles
                                  4⤵
                                    PID:3332
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\718508534211_Desktop.zip' -CompressionLevel Optimal
                                    4⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2936
                              • C:\Windows\SysWOW64\rundll32.exe
                                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                                2⤵
                                • Blocklisted process makes network request
                                • Loads dropped DLL
                                PID:4024
                              • C:\Users\Admin\AppData\Local\Temp\1001107001\jok.exe
                                "C:\Users\Admin\AppData\Local\Temp\1001107001\jok.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:4724
                              • C:\Users\Admin\AppData\Local\Temp\1001108001\swiiii.exe
                                "C:\Users\Admin\AppData\Local\Temp\1001108001\swiiii.exe"
                                2⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                PID:4628
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  3⤵
                                  • Loads dropped DLL
                                  • Checks processor information in registry
                                  PID:3664
                              • C:\Users\Admin\AppData\Local\Temp\1001153001\install_new.exe
                                "C:\Users\Admin\AppData\Local\Temp\1001153001\install_new.exe"
                                2⤵
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                PID:1396
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\install.bat" "
                                  3⤵
                                    PID:4536
                                    • C:\Windows\SysWOW64\sc.exe
                                      Sc delete GameServerClient
                                      4⤵
                                      • Launches sc.exe
                                      PID:4352
                                    • C:\Program Files (x86)\GameServerClient\GameService.exe
                                      GameService remove GameServerClient confirm
                                      4⤵
                                      • Executes dropped EXE
                                      PID:4048
                                    • C:\Program Files (x86)\GameServerClient\GameService.exe
                                      GameService install GameServerClient "C:\Program Files (x86)\GameServerClient\GameClient.exe"
                                      4⤵
                                      • Executes dropped EXE
                                      PID:340
                                    • C:\Program Files (x86)\GameServerClient\GameService.exe
                                      GameService start GameServerClient
                                      4⤵
                                      • Executes dropped EXE
                                      PID:1100
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installc.bat" "
                                    3⤵
                                      PID:3524
                                      • C:\Windows\SysWOW64\sc.exe
                                        Sc delete GameServerClientC
                                        4⤵
                                        • Launches sc.exe
                                        PID:1432
                                      • C:\Program Files (x86)\GameServerClient\GameService.exe
                                        GameService remove GameServerClientC confirm
                                        4⤵
                                        • Executes dropped EXE
                                        PID:3916
                                      • C:\Program Files (x86)\GameServerClient\GameService.exe
                                        GameService install GameServerClientC "C:\Program Files (x86)\GameServerClient\GameClientC.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        PID:4580
                                      • C:\Program Files (x86)\GameServerClient\GameService.exe
                                        GameService start GameServerClientC
                                        4⤵
                                        • Executes dropped EXE
                                        PID:3080
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
                                      3⤵
                                        PID:2832
                                    • C:\Users\Admin\AppData\Local\Temp\1001154001\lie1234.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1001154001\lie1234.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:4388
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                        3⤵
                                          PID:4712
                                      • C:\Users\Admin\AppData\Local\Temp\1001162001\Startup.exe
                                        "C:\Users\Admin\AppData\Local\Temp\1001162001\Startup.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        PID:4732
                                      • C:\Users\Admin\AppData\Local\Temp\1001165001\Dvvkv.exe
                                        "C:\Users\Admin\AppData\Local\Temp\1001165001\Dvvkv.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4328
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4544 -ip 4544
                                      1⤵
                                        PID:964
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5000 -ip 5000
                                        1⤵
                                          PID:1540
                                        • C:\ProgramData\wikombernizc\reakuqnanrkn.exe
                                          C:\ProgramData\wikombernizc\reakuqnanrkn.exe
                                          1⤵
                                          • Executes dropped EXE
                                          • Drops file in System32 directory
                                          • Suspicious use of SetThreadContext
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:2124
                                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                            C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                            2⤵
                                            • Drops file in System32 directory
                                            • Modifies data under HKEY_USERS
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1396
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                            2⤵
                                              PID:2216
                                              • C:\Windows\system32\wusa.exe
                                                wusa /uninstall /kb:890830 /quiet /norestart
                                                3⤵
                                                  PID:1572
                                              • C:\Windows\system32\sc.exe
                                                C:\Windows\system32\sc.exe stop UsoSvc
                                                2⤵
                                                • Launches sc.exe
                                                PID:2064
                                              • C:\Windows\system32\sc.exe
                                                C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                2⤵
                                                • Launches sc.exe
                                                PID:2572
                                              • C:\Windows\system32\sc.exe
                                                C:\Windows\system32\sc.exe stop wuauserv
                                                2⤵
                                                • Launches sc.exe
                                                PID:4416
                                              • C:\Windows\system32\sc.exe
                                                C:\Windows\system32\sc.exe stop bits
                                                2⤵
                                                • Launches sc.exe
                                                PID:4144
                                              • C:\Windows\system32\sc.exe
                                                C:\Windows\system32\sc.exe stop dosvc
                                                2⤵
                                                • Launches sc.exe
                                                PID:2420
                                              • C:\Windows\system32\powercfg.exe
                                                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                2⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:324
                                              • C:\Windows\system32\powercfg.exe
                                                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                2⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2828
                                              • C:\Windows\system32\powercfg.exe
                                                C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                2⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2720
                                              • C:\Windows\system32\powercfg.exe
                                                C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                2⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4484
                                              • C:\Windows\system32\conhost.exe
                                                C:\Windows\system32\conhost.exe
                                                2⤵
                                                  PID:1940
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  2⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4708
                                              • C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                                C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                                1⤵
                                                • Executes dropped EXE
                                                PID:2144
                                              • C:\Windows\windefender.exe
                                                C:\Windows\windefender.exe
                                                1⤵
                                                • Executes dropped EXE
                                                • Modifies data under HKEY_USERS
                                                PID:4840
                                              • C:\Program Files (x86)\GameServerClient\GameService.exe
                                                "C:\Program Files (x86)\GameServerClient\GameService.exe"
                                                1⤵
                                                • Executes dropped EXE
                                                PID:1744
                                                • C:\Program Files (x86)\GameServerClient\GameClient.exe
                                                  "C:\Program Files (x86)\GameServerClient\GameClient.exe"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  PID:3732
                                                  • C:\Windows\Temp\230420.exe
                                                    "C:\Windows\Temp\230420.exe" --points 512 --out xxx.txt --keyspace 3d12c2fc800000000:3d12c2fd000000000 13zb1hQbWVsc2S7ZTZnP2G4undNNpdh5so 126JXqaW4pcY7QeA8Fm4sMLVWokDPkYs8K
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    PID:3184
                                              • C:\Program Files (x86)\GameServerClient\GameService.exe
                                                "C:\Program Files (x86)\GameServerClient\GameService.exe"
                                                1⤵
                                                • Executes dropped EXE
                                                PID:1224
                                                • C:\Program Files (x86)\GameServerClient\GameClientC.exe
                                                  "C:\Program Files (x86)\GameServerClient\GameClientC.exe"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  PID:3324
                                                  • C:\Windows\Temp\144098.exe
                                                    "C:\Windows\Temp\144098.exe" --coin BTC -m ADDRESSES -t 0 --range 3d12c2fc800000000:3d12c2fd000000000 -o xxx0.txt -i C:\Windows\Temp\curjob.bin
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:4144

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Reconnaissance

                                              Resource Development

                                              Initial Access

                                              Execution

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Persistence

                                              Boot or Logon Autostart Execution

                                              1
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1547.001

                                              Create or Modify System Process

                                              3
                                              T1543

                                              Windows Service

                                              3
                                              T1543.003

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Privilege Escalation

                                              Boot or Logon Autostart Execution

                                              1
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1547.001

                                              Create or Modify System Process

                                              3
                                              T1543

                                              Windows Service

                                              3
                                              T1543.003

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Defense Evasion

                                              Impair Defenses

                                              2
                                              T1562

                                              Disable or Modify System Firewall

                                              1
                                              T1562.004

                                              Modify Registry

                                              2
                                              T1112

                                              Subvert Trust Controls

                                              1
                                              T1553

                                              Install Root Certificate

                                              1
                                              T1553.004

                                              Virtualization/Sandbox Evasion

                                              2
                                              T1497

                                              Credential Access

                                              Unsecured Credentials

                                              5
                                              T1552

                                              Credentials In Files

                                              4
                                              T1552.001

                                              Credentials in Registry

                                              1
                                              T1552.002

                                              Discovery

                                              Peripheral Device Discovery

                                              1
                                              T1120

                                              Query Registry

                                              7
                                              T1012

                                              System Information Discovery

                                              5
                                              T1082

                                              Virtualization/Sandbox Evasion

                                              2
                                              T1497

                                              Lateral Movement

                                              Collection

                                              Data from Local System

                                              5
                                              T1005

                                              Command and Control

                                              Web Service

                                              1
                                              T1102

                                              Exfiltration

                                              Impact

                                              Service Stop

                                              1
                                              T1489

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Program Files (x86)\GameServerClient\GameClient.exe
                                                Filesize

                                                2.5MB

                                                MD5

                                                0fac9d21508e154127a9fd4b90a1ca39

                                                SHA1

                                                cb9df00888a37443e6b4f87daf74e591b4dc373a

                                                SHA256

                                                6fb647a3af04d0bb02d9925cf974c21be48512ee56eb3275be575dadd1a7aec0

                                                SHA512

                                                fdd75a3dceb4dd9083f46ba09a51213779958e440b0f6cf61d63ed9b65964b912bd270f3cc616e795c4d8d36daf19b15ee3f99fbaa827c113ff47477a604480d

                                                Download Submit
                                              • C:\Program Files (x86)\GameServerClient\GameService.exe
                                                Filesize

                                                288KB

                                                MD5

                                                d9ec6f3a3b2ac7cd5eef07bd86e3efbc

                                                SHA1

                                                e1908caab6f938404af85a7df0f80f877a4d9ee6

                                                SHA256

                                                472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c

                                                SHA512

                                                1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

                                                Download Submit
                                              • C:\Program Files (x86)\GameServerClient\install.bat
                                                Filesize

                                                231B

                                                MD5

                                                b9ecefec035b92492661437972d20a33

                                                SHA1

                                                6d694ed7107919baa1da347784b2fb2378f25193

                                                SHA256

                                                5c4b3d2bbfc982378155656046dccd2fac16a5f8d2bbf23f5dbc6a6dc8ebfde8

                                                SHA512

                                                cf22b003bc370e01c7ce64338bb86dc42a4db4d8357924ba85abd07e2293936ca879d64e35a2b4f3679f281ad112867564ca50054f865525ec7f0cb9c274da99

                                                Download Submit
                                              • C:\ProgramData\mozglue.dll
                                                Filesize

                                                593KB

                                                MD5

                                                c8fd9be83bc728cc04beffafc2907fe9

                                                SHA1

                                                95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                SHA256

                                                ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                SHA512

                                                fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                Filesize

                                                3KB

                                                MD5

                                                ae626d9a72417b14570daa8fcd5d34a4

                                                SHA1

                                                c103ebaf4d760df722d620df87e6f07c0486439f

                                                SHA256

                                                52cc3f3028fab0d347a4a3fffef570b42f85748176d81a3344996d42fd1de32a

                                                SHA512

                                                a0690bda318bdf43d6f292f88d4ea2ebeec83b95e9ebca80083dbb08e7ddcdb9735cc58b89d369a34f10acf8a114d4a207ed8d0f070c5baf87c5798e9f35bc14

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                Filesize

                                                1KB

                                                MD5

                                                d3786ef00cda6576286cc80ac6d12626

                                                SHA1

                                                0de8fb7e6c1940396a763731e46d8cab2fa0522b

                                                SHA256

                                                88806739d61b2de835742487f6e7c0c4fda577115574978ab96a4342b7b818d2

                                                SHA512

                                                6c28af9ba4ef0874fac3eb5c80e48344272f3f5c70c9baab01a3055a272ff26900b76da94b41734693707318ee82f092063d929bf088b473835e30bf38bcd6cd

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
                                                Filesize

                                                1.8MB

                                                MD5

                                                15062a2e81b42e1b7fcecac7cf2cf537

                                                SHA1

                                                ef46d51b985674fb192308a706fe1acdfba5c582

                                                SHA256

                                                2b9b0cb6745cfd72d49fec5f4fd81e1e7ec49987805f063c43ba96cc4a71926d

                                                SHA512

                                                da3f8cdfa6aa692755629af61cff9d19246c618859e59de46cf37ecc7a570b6f422e62f851f09f5938058a83b6a541a929adb1d983ded0ac97a52fe0cf7ab2e1

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1000193001\ISetup8.exe
                                                Filesize

                                                16B

                                                MD5

                                                dfa3636699e32131cd27350a1ed6d2d5

                                                SHA1

                                                52921570b0ee3c46ad9d62c7cd5231b37b7323f4

                                                SHA256

                                                f41184a575844987199ca3a8336fab14a10b7451b397f5ea5e3a0c9649fc7b25

                                                SHA512

                                                3bc123d9cb9e3343fc5f8a7615d019cee5065cfc78c0d7e1604ffe748239007e9766a5868c3a43e52ff2f95330a72f27023de5157b9911a10d28331512e34e37

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1000194001\toolspub1.exe
                                                Filesize

                                                240KB

                                                MD5

                                                bfe9ca3a9060f8b106ef1e7448416289

                                                SHA1

                                                aa2e83375485435a6bc81aa59e769b4888dc9ca2

                                                SHA256

                                                7755538e0afd5973ebc9e8766a817b5b562addfdde5fc3950f4bbffba9790ca9

                                                SHA512

                                                b52c1733e3b7c39da85603e1ea8013d1b1e69a4c5d9d91d64e6ab0234408f091cab8ea10a0034d8c0b88d7a21a9317591796d4c6015bf8454dec65f21e642a36

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1000195001\4767d2e713f2021e8fe856e3ea638b58.exe
                                                Filesize

                                                4.2MB

                                                MD5

                                                833cf4b485610329398b1a0065601b9a

                                                SHA1

                                                c8a5a74c18517a0f9f6132f4e5f277c6a7303a92

                                                SHA256

                                                a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a

                                                SHA512

                                                df304d862cbb43eb222d81a23f1d4a179d5cc4e2ef73758ee130019280de97b1b1da5bf2d14d71c8b4128cf6206555f043c15670632b472efe8dd3b5d6156531

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1000196001\FirstZ.exe
                                                Filesize

                                                2.5MB

                                                MD5

                                                ffada57f998ed6a72b6ba2f072d2690a

                                                SHA1

                                                6857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f

                                                SHA256

                                                677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12

                                                SHA512

                                                1de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1000985001\alexxxxxxxx.exe
                                                Filesize

                                                1.7MB

                                                MD5

                                                85a15f080b09acace350ab30460c8996

                                                SHA1

                                                3fc515e60e4cfa5b3321f04a96c7fb463e4b9d02

                                                SHA256

                                                3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b

                                                SHA512

                                                ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1001053001\gold.exe
                                                Filesize

                                                308KB

                                                MD5

                                                818b475b766c54df6d845cb10b6eedcf

                                                SHA1

                                                69ba418b84f5eb0930ba483c8fb1d8416b0b8749

                                                SHA256

                                                8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478

                                                SHA512

                                                93371ece9326b2e88425c01d4f6f7dcc19ae5ee252295d8ddf283bc21ae4f5a72761b0f3ae1204dc85fcd1a11096ccd6c3af4b9e6a85ad9833e8cb06b85c5ca4

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                                Filesize

                                                418KB

                                                MD5

                                                0099a99f5ffb3c3ae78af0084136fab3

                                                SHA1

                                                0205a065728a9ec1133e8a372b1e3864df776e8c

                                                SHA256

                                                919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                SHA512

                                                5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe
                                                Filesize

                                                321KB

                                                MD5

                                                1c7d0f34bb1d85b5d2c01367cc8f62ef

                                                SHA1

                                                33aedadb5361f1646cffd68791d72ba5f1424114

                                                SHA256

                                                e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c

                                                SHA512

                                                53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe
                                                Filesize

                                                2.2MB

                                                MD5

                                                9994b46d6944b777dfe07cc9a6f0d328

                                                SHA1

                                                344edbabe62554fbd83b1a529f795bbd558748a8

                                                SHA256

                                                f40733a32dd3a353133d57e1c90d034ce22e7c1bd93de615bf6f756a194b3abb

                                                SHA512

                                                5449f057fdcdfa68734cdd33212beeff0901f5fbe8da8bc6599a5ab24e406f44e91c0594f8ee36eac1abc79f642a21dae32625fea28d72710463283d5ed26e32

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1001107001\jok.exe
                                                Filesize

                                                304KB

                                                MD5

                                                8510bcf5bc264c70180abe78298e4d5b

                                                SHA1

                                                2c3a2a85d129b0d750ed146d1d4e4d6274623e28

                                                SHA256

                                                096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6

                                                SHA512

                                                5ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1001108001\swiiii.exe
                                                Filesize

                                                158KB

                                                MD5

                                                586f7fecacd49adab650fae36e2db994

                                                SHA1

                                                35d9fb512a8161ce867812633f0a43b042f9a5e6

                                                SHA256

                                                cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e

                                                SHA512

                                                a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1001153001\install_new.exe
                                                Filesize

                                                2.4MB

                                                MD5

                                                ba7445dd6438c2097c1c5b2ce173c064

                                                SHA1

                                                24873c5c09152806caa71b6bb990ef0797e626ae

                                                SHA256

                                                4cd8586d09ba9e97b4e50bb2d9d1e671a50bfe79bcd29ebf851ae6defc8d1768

                                                SHA512

                                                6cf7d18b51d2ec88d9c76470800cf9b8c1fcb30fe02041be3f3694eb7e2a708a9d96ed7b9aafd5e7fdff5b618d6b1796a80c78c74204e7272b58a7b4f7a84ace

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1001154001\lie1234.exe
                                                Filesize

                                                308KB

                                                MD5

                                                d05ddc72d9c4fae1ee83e9ac16275afc

                                                SHA1

                                                852e1078974794aeaa40a74201efce257987be2c

                                                SHA256

                                                7d233935547785aa757807b0a483b8ac5fe9195297f0fc0f53d29931b9dbbfda

                                                SHA512

                                                3b0f662f28fa449146159da4821e0f6004edb57506159f8ac2bedd8a45e771bcfcb696c2f6a59a1df0c80099bb83c6a7d11542280ff411bba2397799a943a587

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1001162001\Startup.exe
                                                Filesize

                                                3.3MB

                                                MD5

                                                76eae6ef736073145d6c06d981615ff9

                                                SHA1

                                                6612a26d5db4a6a745fed7518ec93a1121fffd9c

                                                SHA256

                                                3acdea11112584cd1f78da03f6af5cfc0f883309fc5ec552fa6b9c85a6c483bb

                                                SHA512

                                                e7c118bbe9f62d5834b374e05242636b32daab2c1fe607521d6e78520665c59f78637b74c85d171f8608e255be50731771f0a09dcca69e016b281ee02ab77231

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\1001165001\Dvvkv.exe
                                                Filesize

                                                2.7MB

                                                MD5

                                                d1cc7d267d5f9a288aebe21433875a09

                                                SHA1

                                                9cdfbf1a009a65e5c1e1aa0e4cf1e06302cae735

                                                SHA256

                                                a5c0d4c059432a9c8a129c8f6bd0d27f587cbafb568e866cc8f360d9bd315865

                                                SHA512

                                                5027d404d97f7f154ac15bfe73df06f0bd9bb6ff8aec3c1ac2292c07e621cfd646f27ddd28aaf94149f517e5f10256e1041ec6ba961544572255d86d67de78f0

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\TmpE772.tmp
                                                Filesize

                                                2KB

                                                MD5

                                                1420d30f964eac2c85b2ccfe968eebce

                                                SHA1

                                                bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                SHA256

                                                f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                SHA512

                                                6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_355u43ro.3qy.ps1
                                                Filesize

                                                60B

                                                MD5

                                                d17fe0a3f47be24a6453e9ef58c94641

                                                SHA1

                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                SHA256

                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                SHA512

                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                Download Submit
                                              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                Filesize

                                                281KB

                                                MD5

                                                d98e33b66343e7c96158444127a117f6

                                                SHA1

                                                bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                                SHA256

                                                5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                                SHA512

                                                705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                                Download Submit
                                              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                                                Filesize

                                                109KB

                                                MD5

                                                2afdbe3b99a4736083066a13e4b5d11a

                                                SHA1

                                                4d4856cf02b3123ac16e63d4a448cdbcb1633546

                                                SHA256

                                                8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee

                                                SHA512

                                                d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

                                                Download Submit
                                              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
                                                Filesize

                                                1.2MB

                                                MD5

                                                92fbdfccf6a63acef2743631d16652a7

                                                SHA1

                                                971968b1378dd89d59d7f84bf92f16fc68664506

                                                SHA256

                                                b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72

                                                SHA512

                                                b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

                                                Download Submit
                                              • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                                                Filesize

                                                541KB

                                                MD5

                                                1fc4b9014855e9238a361046cfbf6d66

                                                SHA1

                                                c17f18c8246026c9979ab595392a14fe65cc5e9f

                                                SHA256

                                                f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50

                                                SHA512

                                                2af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12

                                                Download Submit
                                              • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
                                                Filesize

                                                304KB

                                                MD5

                                                cc90e3326d7b20a33f8037b9aab238e4

                                                SHA1

                                                236d173a6ac462d85de4e866439634db3b9eeba3

                                                SHA256

                                                bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7

                                                SHA512

                                                b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521

                                                Download Submit
                                              • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                                Filesize

                                                2KB

                                                MD5

                                                9a95b5c0745795d185b253a1a2a0afea

                                                SHA1

                                                1bd051b225789e177123ba39c3c0df77796bc54b

                                                SHA256

                                                6acbf4695ecdfeb85204aa177784fff7d029ccbe189c39d9bd99f33869d224e1

                                                SHA512

                                                bb0675cb78e4820debcba9a6f72f779ddb729b17e795e56a5a590ea45fbc4bd5d954ef8266b1697ec43a6bd72586c4b63d019f92b18724bd7928a8976fecf3cd

                                                Download Submit
                                              • C:\Users\Public\Desktop\Google Chrome.lnk
                                                MD5

                                                d41d8cd98f00b204e9800998ecf8427e

                                                SHA1

                                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                SHA256

                                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                SHA512

                                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                Download Submit
                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                Filesize

                                                2KB

                                                MD5

                                                ac4917a885cf6050b1a483e4bc4d2ea5

                                                SHA1

                                                b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f

                                                SHA256

                                                e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9

                                                SHA512

                                                092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

                                                Download Submit
                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                Filesize

                                                19KB

                                                MD5

                                                074be8093da0abf3cc680f8612ffdb05

                                                SHA1

                                                25be706c7a19e14608526d9c802395995de642a4

                                                SHA256

                                                0ac49e8edadd5a5852acec6f76563c2ce37a2da216fc364063655b6f4ed57442

                                                SHA512

                                                4d0376e190829e83cc383b4043b643156bdf52606083b1f1029fb7415ab0cb8f128e7a34b91edaf814c234cd11053e055007fc19682851c7291ddd5cf1682204

                                                Download Submit
                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                Filesize

                                                19KB

                                                MD5

                                                1fcbf6d1298fd223ac12d82d0979b2e1

                                                SHA1

                                                f830c04ad73cdcda1dacd090b56f590f717c6dc1

                                                SHA256

                                                e9a52151884b52a9784bd2c28c0839137e6d5d38eb1138060b6cb29e34c4f790

                                                SHA512

                                                1d3a60fda36a60197e1b71bfacf9551f007941cc3ee066692de09797f8ce2a8d4bdd12316a6f0bd24c6148e2c847087da9066cef53f4411faffcfa2e071f19b7

                                                Download Submit
                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                Filesize

                                                19KB

                                                MD5

                                                3cdf917a003f674134f8c387595c3643

                                                SHA1

                                                2b7c679ddd6896d821b57e27b86a7702ade0ec52

                                                SHA256

                                                36dc88e47e42892493a797867d6ab801f5f42ad19b858f9ae794f8f39253876c

                                                SHA512

                                                0bb8bde099bb2f44b77d75f3866f28b8ba6763f12836834eb9b91036ab917dcc3f1ec22ba3237470b698c101012da39519517e20d757fbafdc235567b21f74ad

                                                Download Submit
                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                Filesize

                                                19KB

                                                MD5

                                                ea4dc2f5506eefa34ae1eedb3d02c64a

                                                SHA1

                                                f4258bcbaf1a0952c7dd660d3d8e4905cbae9074

                                                SHA256

                                                e5144509ca19631908fd5743e9337235f9eed3c21faafcbb408dc5aed5796fc3

                                                SHA512

                                                832c4523bd693c8ee9a4bdbe33c56c6e38634b193a7b16a8557f1f78c53935b3a1beeb59bdf1c74611a3ab8ab15d4f9f03e2cf0016c5278958f21b3d865fe060

                                                Download Submit
                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                Filesize

                                                19KB

                                                MD5

                                                9f67c7493fa32414b851179f4307bb00

                                                SHA1

                                                a9252f8a668b4ce2a3a8b769f34a1123e24b4c16

                                                SHA256

                                                6ecf47511f4fdb8d8ea86b64ab31a74ad901e296f93454da036a14edcf1005ef

                                                SHA512

                                                b3590778a4d40087fa9fe6279ce5e11659d7363f4df0304a42f21734f72cfb655a68d950e401b1198666e3e5c168a5613b625aa7e514714063356c162e291aed

                                                Download Submit
                                              • C:\Windows\windefender.exe
                                                Filesize

                                                2.0MB

                                                MD5

                                                8e67f58837092385dcf01e8a2b4f5783

                                                SHA1

                                                012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                                                SHA256

                                                166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                                                SHA512

                                                40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                                                Download Submit
                                              • memory/464-207-0x0000000000400000-0x000000000044C000-memory.dmp
                                                Filesize

                                                304KB

                                                Download
                                              • memory/464-213-0x0000000000A80000-0x0000000000A81000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/464-220-0x0000000000400000-0x000000000044C000-memory.dmp
                                                Filesize

                                                304KB

                                                Download
                                              • memory/464-195-0x0000000000400000-0x000000000044C000-memory.dmp
                                                Filesize

                                                304KB

                                                Download
                                              • memory/1276-525-0x00000000005D0000-0x0000000000B5F000-memory.dmp
                                                Filesize

                                                5.6MB

                                                Download
                                              • memory/1276-616-0x00000000005D0000-0x0000000000B5F000-memory.dmp
                                                Filesize

                                                5.6MB

                                                Download
                                              • memory/1276-698-0x00000000005D0000-0x0000000000B5F000-memory.dmp
                                                Filesize

                                                5.6MB

                                                Download
                                              • memory/1276-415-0x00000000005D0000-0x0000000000B5F000-memory.dmp
                                                Filesize

                                                5.6MB

                                                Download
                                              • memory/1276-710-0x00000000005D0000-0x0000000000B5F000-memory.dmp
                                                Filesize

                                                5.6MB

                                                Download
                                              • memory/1276-444-0x00000000005D0000-0x0000000000B5F000-memory.dmp
                                                Filesize

                                                5.6MB

                                                Download
                                              • memory/1276-714-0x00000000005D0000-0x0000000000B5F000-memory.dmp
                                                Filesize

                                                5.6MB

                                                Download
                                              • memory/1276-739-0x00000000005D0000-0x0000000000B5F000-memory.dmp
                                                Filesize

                                                5.6MB

                                                Download
                                              • memory/1628-709-0x0000000000400000-0x00000000008DF000-memory.dmp
                                                Filesize

                                                4.9MB

                                                Download
                                              • memory/1940-585-0x0000000140000000-0x000000014000E000-memory.dmp
                                                Filesize

                                                56KB

                                                Download
                                              • memory/1940-583-0x0000000140000000-0x000000014000E000-memory.dmp
                                                Filesize

                                                56KB

                                                Download
                                              • memory/1940-581-0x0000000140000000-0x000000014000E000-memory.dmp
                                                Filesize

                                                56KB

                                                Download
                                              • memory/1940-579-0x0000000140000000-0x000000014000E000-memory.dmp
                                                Filesize

                                                56KB

                                                Download
                                              • memory/1940-582-0x0000000140000000-0x000000014000E000-memory.dmp
                                                Filesize

                                                56KB

                                                Download
                                              • memory/1940-580-0x0000000140000000-0x000000014000E000-memory.dmp
                                                Filesize

                                                56KB

                                                Download
                                              • memory/2224-102-0x0000000005980000-0x0000000005F26000-memory.dmp
                                                Filesize

                                                5.6MB

                                                Download
                                              • memory/2224-136-0x0000000006870000-0x000000000688E000-memory.dmp
                                                Filesize

                                                120KB

                                                Download
                                              • memory/2224-144-0x0000000006A80000-0x0000000006A92000-memory.dmp
                                                Filesize

                                                72KB

                                                Download
                                              • memory/2224-145-0x0000000006AE0000-0x0000000006B1C000-memory.dmp
                                                Filesize

                                                240KB

                                                Download
                                              • memory/2224-90-0x0000000073640000-0x0000000073DF1000-memory.dmp
                                                Filesize

                                                7.7MB

                                                Download
                                              • memory/2224-146-0x0000000006C50000-0x0000000006C9C000-memory.dmp
                                                Filesize

                                                304KB

                                                Download
                                              • memory/2224-98-0x0000000000A70000-0x0000000000AC2000-memory.dmp
                                                Filesize

                                                328KB

                                                Download
                                              • memory/2224-105-0x0000000005470000-0x0000000005502000-memory.dmp
                                                Filesize

                                                584KB

                                                Download
                                              • memory/2224-110-0x0000000005450000-0x000000000545A000-memory.dmp
                                                Filesize

                                                40KB

                                                Download
                                              • memory/2224-109-0x00000000055D0000-0x00000000055E0000-memory.dmp
                                                Filesize

                                                64KB

                                                Download
                                              • memory/2224-140-0x0000000006FF0000-0x0000000007608000-memory.dmp
                                                Filesize

                                                6.1MB

                                                Download
                                              • memory/2224-130-0x0000000005FB0000-0x0000000006026000-memory.dmp
                                                Filesize

                                                472KB

                                                Download
                                              • memory/2224-142-0x0000000006B40000-0x0000000006C4A000-memory.dmp
                                                Filesize

                                                1.0MB

                                                Download
                                              • memory/2536-21-0x00000000054C0000-0x00000000054C1000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/2536-675-0x00000000004F0000-0x000000000098C000-memory.dmp
                                                Filesize

                                                4.6MB

                                                Download
                                              • memory/2536-717-0x00000000004F0000-0x000000000098C000-memory.dmp
                                                Filesize

                                                4.6MB

                                                Download
                                              • memory/2536-27-0x0000000005520000-0x0000000005521000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/2536-28-0x0000000005510000-0x0000000005511000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/2536-134-0x00000000004F0000-0x000000000098C000-memory.dmp
                                                Filesize

                                                4.6MB

                                                Download
                                              • memory/2536-26-0x00000000054A0000-0x00000000054A1000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/2536-19-0x00000000004F0000-0x000000000098C000-memory.dmp
                                                Filesize

                                                4.6MB

                                                Download
                                              • memory/2536-523-0x00000000004F0000-0x000000000098C000-memory.dmp
                                                Filesize

                                                4.6MB

                                                Download
                                              • memory/2536-25-0x0000000005490000-0x0000000005491000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/2536-228-0x00000000004F0000-0x000000000098C000-memory.dmp
                                                Filesize

                                                4.6MB

                                                Download
                                              • memory/2536-108-0x00000000004F0000-0x000000000098C000-memory.dmp
                                                Filesize

                                                4.6MB

                                                Download
                                              • memory/2536-711-0x00000000004F0000-0x000000000098C000-memory.dmp
                                                Filesize

                                                4.6MB

                                                Download
                                              • memory/2536-20-0x00000000004F0000-0x000000000098C000-memory.dmp
                                                Filesize

                                                4.6MB

                                                Download
                                              • memory/2536-574-0x00000000004F0000-0x000000000098C000-memory.dmp
                                                Filesize

                                                4.6MB

                                                Download
                                              • memory/2536-22-0x00000000054D0000-0x00000000054D1000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/2536-413-0x00000000004F0000-0x000000000098C000-memory.dmp
                                                Filesize

                                                4.6MB

                                                Download
                                              • memory/2536-23-0x00000000054B0000-0x00000000054B1000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/2536-24-0x00000000054F0000-0x00000000054F1000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/2536-702-0x00000000004F0000-0x000000000098C000-memory.dmp
                                                Filesize

                                                4.6MB

                                                Download
                                              • memory/2536-427-0x00000000004F0000-0x000000000098C000-memory.dmp
                                                Filesize

                                                4.6MB

                                                Download
                                              • memory/2700-678-0x0000000000400000-0x0000000003009000-memory.dmp
                                                Filesize

                                                44.0MB

                                                Download
                                              • memory/2700-712-0x0000000000400000-0x0000000003009000-memory.dmp
                                                Filesize

                                                44.0MB

                                                Download
                                              • memory/2700-704-0x0000000000400000-0x0000000003009000-memory.dmp
                                                Filesize

                                                44.0MB

                                                Download
                                              • memory/2700-719-0x0000000000400000-0x0000000003009000-memory.dmp
                                                Filesize

                                                44.0MB

                                                Download
                                              • memory/3324-143-0x00000000027F0000-0x0000000002800000-memory.dmp
                                                Filesize

                                                64KB

                                                Download
                                              • memory/3324-139-0x00007FFE5E1B0000-0x00007FFE5EC72000-memory.dmp
                                                Filesize

                                                10.8MB

                                                Download
                                              • memory/3324-135-0x0000000000770000-0x00000000007FC000-memory.dmp
                                                Filesize

                                                560KB

                                                Download
                                              • memory/3564-520-0x0000000000400000-0x0000000003009000-memory.dmp
                                                Filesize

                                                44.0MB

                                                Download
                                              • memory/3744-10-0x0000000005830000-0x0000000005831000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/3744-0-0x0000000000D60000-0x00000000011FC000-memory.dmp
                                                Filesize

                                                4.6MB

                                                Download
                                              • memory/3744-6-0x0000000005810000-0x0000000005811000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/3744-3-0x00000000057D0000-0x00000000057D1000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/3744-4-0x00000000057E0000-0x00000000057E1000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/3744-7-0x00000000057A0000-0x00000000057A1000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/3744-8-0x00000000057B0000-0x00000000057B1000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/3744-2-0x0000000000D60000-0x00000000011FC000-memory.dmp
                                                Filesize

                                                4.6MB

                                                Download
                                              • memory/3744-5-0x00000000057C0000-0x00000000057C1000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/3744-9-0x0000000005800000-0x0000000005801000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/3744-11-0x0000000005820000-0x0000000005821000-memory.dmp
                                                Filesize

                                                4KB

                                                Download
                                              • memory/3744-16-0x0000000000D60000-0x00000000011FC000-memory.dmp
                                                Filesize

                                                4.6MB

                                                Download
                                              • memory/3744-1-0x0000000077C86000-0x0000000077C88000-memory.dmp
                                                Filesize

                                                8KB

                                                Download
                                              • memory/3808-103-0x00000000003B0000-0x0000000000404000-memory.dmp
                                                Filesize

                                                336KB

                                                Download
                                              • memory/3808-106-0x0000000073640000-0x0000000073DF1000-memory.dmp
                                                Filesize

                                                7.7MB

                                                Download
                                              • memory/3808-131-0x00000000026C0000-0x00000000046C0000-memory.dmp
                                                Filesize

                                                32.0MB

                                                Download
                                              • memory/3808-133-0x0000000073640000-0x0000000073DF1000-memory.dmp
                                                Filesize

                                                7.7MB

                                                Download
                                              • memory/3840-48-0x0000000000900000-0x0000000000ABC000-memory.dmp
                                                Filesize

                                                1.7MB

                                                Download
                                              • memory/3840-50-0x00000000055B0000-0x00000000055C0000-memory.dmp
                                                Filesize

                                                64KB

                                                Download
                                              • memory/3840-58-0x0000000073640000-0x0000000073DF1000-memory.dmp
                                                Filesize

                                                7.7MB

                                                Download
                                              • memory/3840-59-0x0000000002FD0000-0x0000000004FD0000-memory.dmp
                                                Filesize

                                                32.0MB

                                                Download
                                              • memory/3840-49-0x0000000073640000-0x0000000073DF1000-memory.dmp
                                                Filesize

                                                7.7MB

                                                Download
                                              • memory/3840-217-0x0000000002FD0000-0x0000000004FD0000-memory.dmp
                                                Filesize

                                                32.0MB

                                                Download
                                              • memory/3912-414-0x0000000000400000-0x0000000003009000-memory.dmp
                                                Filesize

                                                44.0MB

                                                Download
                                              • memory/4196-141-0x0000000000400000-0x000000000044F000-memory.dmp
                                                Filesize

                                                316KB

                                                Download
                                              • memory/4196-111-0x0000000000400000-0x000000000044F000-memory.dmp
                                                Filesize

                                                316KB

                                                Download
                                              • memory/4196-128-0x0000000000400000-0x000000000044F000-memory.dmp
                                                Filesize

                                                316KB

                                                Download
                                              • memory/4544-210-0x0000000002F00000-0x0000000004F00000-memory.dmp
                                                Filesize

                                                32.0MB

                                                Download
                                              • memory/4544-221-0x0000000073640000-0x0000000073DF1000-memory.dmp
                                                Filesize

                                                7.7MB

                                                Download
                                              • memory/4544-191-0x0000000000A70000-0x0000000000AC2000-memory.dmp
                                                Filesize

                                                328KB

                                                Download
                                              • memory/4544-192-0x0000000073640000-0x0000000073DF1000-memory.dmp
                                                Filesize

                                                7.7MB

                                                Download
                                              • memory/4708-594-0x0000000000B20000-0x0000000000B40000-memory.dmp
                                                Filesize

                                                128KB

                                                Download
                                              • memory/4708-592-0x0000000140000000-0x0000000140848000-memory.dmp
                                                Filesize

                                                8.3MB

                                                Download
                                              • memory/4708-614-0x0000000140000000-0x0000000140848000-memory.dmp
                                                Filesize

                                                8.3MB

                                                Download
                                              • memory/4708-602-0x0000000140000000-0x0000000140848000-memory.dmp
                                                Filesize

                                                8.3MB

                                                Download
                                              • memory/4708-601-0x0000000140000000-0x0000000140848000-memory.dmp
                                                Filesize

                                                8.3MB

                                                Download
                                              • memory/4708-599-0x0000000140000000-0x0000000140848000-memory.dmp
                                                Filesize

                                                8.3MB

                                                Download
                                              • memory/4708-597-0x0000000140000000-0x0000000140848000-memory.dmp
                                                Filesize

                                                8.3MB

                                                Download
                                              • memory/4708-587-0x0000000140000000-0x0000000140848000-memory.dmp
                                                Filesize

                                                8.3MB

                                                Download
                                              • memory/4708-596-0x0000000140000000-0x0000000140848000-memory.dmp
                                                Filesize

                                                8.3MB

                                                Download
                                              • memory/4708-593-0x0000000140000000-0x0000000140848000-memory.dmp
                                                Filesize

                                                8.3MB

                                                Download
                                              • memory/4708-591-0x0000000140000000-0x0000000140848000-memory.dmp
                                                Filesize

                                                8.3MB

                                                Download
                                              • memory/4708-615-0x0000000140000000-0x0000000140848000-memory.dmp
                                                Filesize

                                                8.3MB

                                                Download
                                              • memory/4708-589-0x0000000140000000-0x0000000140848000-memory.dmp
                                                Filesize

                                                8.3MB

                                                Download
                                              • memory/4708-590-0x0000000140000000-0x0000000140848000-memory.dmp
                                                Filesize

                                                8.3MB

                                                Download
                                              • memory/4708-588-0x0000000140000000-0x0000000140848000-memory.dmp
                                                Filesize

                                                8.3MB

                                                Download
                                              • memory/4840-715-0x0000000000400000-0x00000000008DF000-memory.dmp
                                                Filesize

                                                4.9MB

                                                Download
                                              • memory/4980-222-0x0000000073640000-0x0000000073DF1000-memory.dmp
                                                Filesize

                                                7.7MB

                                                Download
                                              • memory/4980-219-0x00000000055E0000-0x00000000055F0000-memory.dmp
                                                Filesize

                                                64KB

                                                Download
                                              • memory/4980-61-0x0000000073640000-0x0000000073DF1000-memory.dmp
                                                Filesize

                                                7.7MB

                                                Download
                                              • memory/4980-60-0x00000000055E0000-0x00000000055F0000-memory.dmp
                                                Filesize

                                                64KB

                                                Download
                                              • memory/4980-53-0x0000000000400000-0x0000000000592000-memory.dmp
                                                Filesize

                                                1.6MB

                                                Download
                                              • memory/5000-227-0x0000000000400000-0x0000000002C1F000-memory.dmp
                                                Filesize

                                                40.1MB

                                                Download
                                              • memory/5000-224-0x0000000002F80000-0x0000000002F8B000-memory.dmp
                                                Filesize

                                                44KB

                                                Download
                                              • memory/5000-223-0x0000000002FE0000-0x00000000030E0000-memory.dmp
                                                Filesize

                                                1024KB

                                                Download