stealerium | hxxps://bing[.]com

max time kernel
298s
max time network
302s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
24-04-2024 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bing.com

Score

10^/10

stealerium collection evasion persistence spyware stealer

Malware Config

Extracted

Family

stealerium

https://discord.com/api/webhooks/1222934891348623510/Ub0_FbG3n0ymoXEKwmmY5ar0ton3_3ECZSk0sxZj-lzMJrHgzr3xj2_TYpRvWzGv4yBM

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

CS2Cheat_x64.exe

description ioc process

File created C:\Windows\system32\drivers\etc\hosts CS2Cheat_x64.exe
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

description	ioc	process
File created	C:\Windows\system32\drivers\etc\hosts	CS2Cheat_x64.exe

Executes dropped EXE 8 IoCs

Processes:

LKSAim.exeCS2CheatInstaller.exeCounterStrike2FCx86.exeCS2CheatInstaller.exeCounterStrike2FCx86.exeCS2Cheat_x64.exeAimStar.exeWindowsSystemTool22H2.exe

pid	process
3288	LKSAim.exe
4996	CS2CheatInstaller.exe
3420	CounterStrike2FCx86.exe
4692	CS2CheatInstaller.exe
2420	CounterStrike2FCx86.exe
2104	CS2Cheat_x64.exe
4232	AimStar.exe
352	WindowsSystemTool22H2.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

CounterStrike2FCx86.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CounterStrike2FCx86.exe
Key opened	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CounterStrike2FCx86.exe
Key opened	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CounterStrike2FCx86.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

CS2CheatInstaller.exeCS2CheatInstaller.exeCS2CheatInstaller.exeCS2CheatInstaller.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	CS2CheatInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	CS2CheatInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	CS2CheatInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	CS2CheatInstaller.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

110 discord.com
111 discord.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

113 icanhazip.com
Drops file in System32 directory 1 IoCs

Processes:

CS2Cheat_x64.exe

description ioc process

File opened for modification C:\Windows\system32\MRT.exe CS2Cheat_x64.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

CS2Cheat_x64.exe

description pid process target process

PID 2104 set thread context of 3024 2104 CS2Cheat_x64.exe dialer.exe

flow	ioc
110	discord.com
111	discord.com

flow	ioc
113	icanhazip.com

description	ioc	process
File opened for modification	C:\Windows\system32\MRT.exe	CS2Cheat_x64.exe

description	pid	process	target process
PID 2104 set thread context of 3024	2104	CS2Cheat_x64.exe	dialer.exe

Drops file in Windows directory 2 IoCs

Processes:

taskmgr.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe

Launches sc.exe 9 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

1900 sc.exe
3096 sc.exe
4648 sc.exe
4552 sc.exe
4612 sc.exe
4976 sc.exe
4368 sc.exe
2184 sc.exe
3908 sc.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2264 3420 WerFault.exe CounterStrike2FCx86.exe

pid	process
1900	sc.exe
3096	sc.exe
4648	sc.exe
4552	sc.exe
4612	sc.exe
4976	sc.exe
4368	sc.exe
2184	sc.exe
3908	sc.exe

pid	pid_target	process	target process
2264	3420	WerFault.exe	CounterStrike2FCx86.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 44 IoCs

Processes:

powershell.exechrome.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133584351196206684"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

Processes:

chrome.exetaskmgr.exechrome.exeCounterStrike2FCx86.exeCS2Cheat_x64.exepowershell.exedialer.exeWindowsSystemTool22H2.exepowershell.exe

pid	process
4404	chrome.exe
4404	chrome.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
4624	chrome.exe
4624	chrome.exe
3420	CounterStrike2FCx86.exe
3420	CounterStrike2FCx86.exe
3420	CounterStrike2FCx86.exe
2104	CS2Cheat_x64.exe
4752	powershell.exe
4752	powershell.exe
4752	powershell.exe
4752	powershell.exe
2104	CS2Cheat_x64.exe
2104	CS2Cheat_x64.exe
2104	CS2Cheat_x64.exe
2104	CS2Cheat_x64.exe
2104	CS2Cheat_x64.exe
2104	CS2Cheat_x64.exe
2104	CS2Cheat_x64.exe
2104	CS2Cheat_x64.exe
2104	CS2Cheat_x64.exe
2104	CS2Cheat_x64.exe
2104	CS2Cheat_x64.exe
2104	CS2Cheat_x64.exe
2104	CS2Cheat_x64.exe
3024	dialer.exe
3024	dialer.exe
2104	CS2Cheat_x64.exe
2104	CS2Cheat_x64.exe
352	WindowsSystemTool22H2.exe
3024	dialer.exe
3024	dialer.exe
1716	powershell.exe
1716	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

chrome.exe

pid process

4404 chrome.exe
4404 chrome.exe
4404 chrome.exe
4404 chrome.exe
4404 chrome.exe
4404 chrome.exe
4404 chrome.exe
4404 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe
Token: SeShutdownPrivilege	4404	chrome.exe
Token: SeCreatePagefilePrivilege	4404	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
60	taskmgr.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe
4404	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4404 wrote to memory of 2772	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2772	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 2532	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 760	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 760	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 1616	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 1616	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 1616	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 1616	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 1616	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 1616	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 1616	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 1616	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 1616	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 1616	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 1616	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 1616	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 1616	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 1616	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 1616	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 1616	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 1616	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 1616	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 1616	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 1616	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 1616	4404	chrome.exe	chrome.exe
PID 4404 wrote to memory of 1616	4404	chrome.exe	chrome.exe

outlook_office_path 1 IoCs

Processes:

CounterStrike2FCx86.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CounterStrike2FCx86.exe

outlook_win_path 1 IoCs

Processes:

CounterStrike2FCx86.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CounterStrike2FCx86.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:584

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:980

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:636

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:744

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:904

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:580

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:1032

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:1096

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
PID:1112

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1196

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1216

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1244

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1256

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1368

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1412

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bing.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4404

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc2aca9758,0x7ffc2aca9768,0x7ffc2aca9778
2⤵
PID:2772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1524 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:2
2⤵
PID:2532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2004 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:8
2⤵
PID:760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2044 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:8
2⤵
PID:1616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2968 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:1
2⤵
PID:316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2976 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:1
2⤵
PID:216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4488 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:1
2⤵
PID:4460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4404 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:1
2⤵
PID:4892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4552 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:8
2⤵
PID:4216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4484 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:8
2⤵
PID:4964

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2968 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:1
2⤵
PID:4628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:8
2⤵
PID:4644

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3264 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:8
2⤵
PID:4388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3120 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:1
2⤵
PID:2544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3044 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:8
2⤵
PID:2292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5364 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:8
2⤵
PID:2180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5400 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:8
2⤵
PID:4368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:8
2⤵
PID:2104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3348 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:8
2⤵
PID:2224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3280 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:8
2⤵
PID:1288

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:8
2⤵
PID:3488

C:\Users\Admin\Downloads\LKSAim.exe
"C:\Users\Admin\Downloads\LKSAim.exe"
2⤵
- Executes dropped EXE
PID:3288

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5292 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:1
2⤵
PID:1780

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4528 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:8
2⤵
PID:3488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:8
2⤵
PID:4356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=4644 --field-trial-handle=1756,i,18063702824421331478,16102582474805776539,131072 /prefetch:1
2⤵
PID:4196

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2320

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:60

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x348
1⤵
PID:852

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4148

C:\Users\Admin\Desktop\[2024]-Counter-Strike-2-Free-Cheat-2024\CS2CheatInstaller.exe
"C:\Users\Admin\Desktop\[2024]-Counter-Strike-2-Free-Cheat-2024\CS2CheatInstaller.exe"
1⤵
- Adds Run key to start application
PID:3504

C:\Windows\SYSTEM32\cmd.exe
cmd /c move AimStar.exe %userprofile%\Desktop\AimStar.exe & CS2CheatInstaller.exe & %userprofile%\Desktop\AimStar.exe
2⤵
PID:3436

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CS2CheatInstaller.exe
CS2CheatInstaller.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4996

C:\Windows\SYSTEM32\cmd.exe
cmd /c mkdir %userprofile%\AppData\Local\Temp\275kwb4jogz & move CounterStrike2FCx86.exe %userprofile%\AppData\Local\Temp\275kwb4jogz\CounterStrike2FCx86.exe & %userprofile%\AppData\Local\Temp\275kwb4jogz\CounterStrike2FCx86.exe & CS2Cheat_x64.exe
4⤵
PID:3472

C:\Users\Admin\AppData\Local\Temp\275kwb4jogz\CounterStrike2FCx86.exe
C:\Users\Admin\AppData\Local\Temp\275kwb4jogz\CounterStrike2FCx86.exe
5⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:3420

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
6⤵
PID:4204

C:\Windows\SysWOW64\chcp.com
chcp 65001
7⤵
PID:1548

C:\Windows\SysWOW64\netsh.exe
netsh wlan show profile
7⤵
PID:508

C:\Windows\SysWOW64\findstr.exe
findstr All
7⤵
PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 2252
6⤵
- Program crash
PID:2264

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
6⤵
PID:2688

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CS2Cheat_x64.exe
CS2Cheat_x64.exe
5⤵
PID:316

C:\Users\Admin\Desktop\[2024]-Counter-Strike-2-Free-Cheat-2024\CS2CheatInstaller.exe
"C:\Users\Admin\Desktop\[2024]-Counter-Strike-2-Free-Cheat-2024\CS2CheatInstaller.exe"
1⤵
- Adds Run key to start application
PID:872

C:\Windows\SYSTEM32\cmd.exe
cmd /c move AimStar.exe %userprofile%\Desktop\AimStar.exe & CS2CheatInstaller.exe & %userprofile%\Desktop\AimStar.exe
2⤵
PID:680

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\CS2CheatInstaller.exe
CS2CheatInstaller.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4692

C:\Windows\SYSTEM32\cmd.exe
cmd /c mkdir %userprofile%\AppData\Local\Temp\275kwb4jogz & move CounterStrike2FCx86.exe %userprofile%\AppData\Local\Temp\275kwb4jogz\CounterStrike2FCx86.exe & %userprofile%\AppData\Local\Temp\275kwb4jogz\CounterStrike2FCx86.exe & CS2Cheat_x64.exe
4⤵
PID:2688

C:\Users\Admin\AppData\Local\Temp\275kwb4jogz\CounterStrike2FCx86.exe
C:\Users\Admin\AppData\Local\Temp\275kwb4jogz\CounterStrike2FCx86.exe
5⤵
- Executes dropped EXE
PID:2420

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\CS2Cheat_x64.exe
CS2Cheat_x64.exe
5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2104

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:4752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
6⤵
PID:2936

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
7⤵
PID:3372

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
6⤵
- Launches sc.exe
PID:4612

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
6⤵
- Launches sc.exe
PID:2184

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
6⤵
- Launches sc.exe
PID:4976

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
6⤵
- Launches sc.exe
PID:1900

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
6⤵
- Launches sc.exe
PID:3096

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
6⤵
PID:1708

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
6⤵
PID:2304

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
6⤵
PID:4384

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
6⤵
PID:1424

C:\Windows\system32\dialer.exe
C:\Windows\system32\dialer.exe
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:3024

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "JLEMVPHW"
6⤵
- Launches sc.exe
PID:3908

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "JLEMVPHW" binpath= "C:\ProgramData\WindowsSystemTool22H2.exe" start= "auto"
6⤵
- Launches sc.exe
PID:4368

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
6⤵
- Launches sc.exe
PID:4552

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "JLEMVPHW"
6⤵
- Launches sc.exe
PID:4648

C:\Users\Admin\Desktop\AimStar.exe
C:\Users\Admin\Desktop\AimStar.exe
3⤵
- Executes dropped EXE
PID:4232

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2968

C:\ProgramData\WindowsSystemTool22H2.exe
C:\ProgramData\WindowsSystemTool22H2.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:352

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1716

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Web Service

T1102

Impact

Service Stop

T1489

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Filesize
48KB

MD5
0c2234caae44ab13c90c9d322d937077

SHA1
94b497520fcfb38d9fc900cad88cd636e9476f87

SHA256
d8e6f62282e12c18c930a147325de25aef1633a034eaf7a3ce8de1fb8de09912

SHA512
66709f74b19499df1e06700e1c257e14a82ca4287194e4b177b3f333748d927f413c8c459a35e7e5a2f92d28410b0129f106d94e3dd85bc0dd0b986add83b18f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Filesize
24KB

MD5
e1831f8fadccd3ffa076214089522cea

SHA1
10acd26c218ff1bbbe6ac785eab5485045f61881

SHA256
9b9a4a9191b023df1aa66258eb19fc64ae5356cfc97a9dda258c6cc8ba1059ac

SHA512
372c486ac381358cc301f32cd89b7a05da7380c03fa524147c2ddf3f5e23f9b57c17485aaedc85b413461a879afc42e729547b0c96c26c49bbdb7301cd064298

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Filesize
44KB

MD5
2b312fee4bff7fb9b399aa619ae1811d

SHA1
cf5e3270ef62ea6ce023f9475dbf7ed67e10527c

SHA256
fd5fb41882dfe849ea47547bf38b9abc435683d7473703b4cb37e8c28b1de4cb

SHA512
3a42c3a12da46656d8dca9b54651027873f42d2ec2e6e706a41b4b520d387f0c3c0388e3d117bd49174d7074079f3404c00b6141c8dd22d38ef1a257f52a9791

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Filesize
24KB

MD5
8278023fac368f67d8b83512b48cf0f9

SHA1
cfbb90dea9e8a9df721806c7d49eff44166b2197

SHA256
1e62f0399a3c5a499b3c93622608d15d3948c3c335359bc695bf3522b03fd48d

SHA512
e04ba7a9402379c064bf5707a5fbe3e5ea6de978b1ad50d38f9b30bef47dbb761f0f8461de8cfaf7c33779dbb47fcf4df7fe387d12fbbf899f7530f6f63a340d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011
Filesize
20KB

MD5
8b2813296f6e3577e9ac2eb518ac437e

SHA1
6c8066353b4d463018aa1e4e9bb9bf2e9a7d9a86

SHA256
befb3b0471067ac66b93fcdba75c11d743f70a02bb9f5eef7501fa874686319d

SHA512
a1ed4d23dfbe981bf749c2008ab55a3d76e8f41801a09475e7e0109600f288aa20036273940e8ba70a172dec57eec56fe7c567cb941ba71edae080f2fdcc1e0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012
Filesize
65KB

MD5
c82fbaa7e5113d3ed2902a3500ec8631

SHA1
c9b4889980899c0f2aea9ac8d0bae28b59e6add3

SHA256
4f4e25ef0961b656039ed8628951b5ff6c0a197f8866374b5937e182b12ff278

SHA512
fc3227c51b9bdcf0917b040aeaa925795e153c7a78469b7e1c87717c1664f46208e5fc3e413f93724ef0fa94aea655db55f04c5a61dda0df737c25b75393136d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
Filesize
59KB

MD5
063fe934b18300c766e7279114db4b67

SHA1
d7e71855cf6e8d1e7fbaa763223857f50cd1d4bd

SHA256
8745914e0214bcd9d2e6a841f0679a81084ef3fc3d99125876bee26653f4253e

SHA512
9d0dfc21306b3a56c2ecdf1265392271969e3765e161e117c8765125b34793e24458217cf6514b364f351f47e65baaaf5856be0d13406a789f844d6ba8c7075f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
Filesize
151KB

MD5
7739350f11f36ec3a07b82584b42ab38

SHA1
d97e0e76a362e5fce9c47b7b01dab53db50963d8

SHA256
d84e9971e8c344b9ff5a5968e7252270757f211f0d408e26c12693729068ed75

SHA512
2cb436985e382ec17390a1f8a7c112bdf18206c66d845934a14f9c84781200828e05c57cef5d4128a9d9b96778042ecb7ba2c031563c78ee9b8ec41accf8a537

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
Filesize
21KB

MD5
e9a5315fe482aa6a84b4cd461a41a5cc

SHA1
06833b57adceda1c91eaa2072d368c54fe4995b0

SHA256
6a00fd28670b7ddc6725260bf6cf4c345762edcc5e74e4eb77367b4969efa9c9

SHA512
86dcee3ad5c69dfb9bf6f0e8246b1bf2f95a27188c17e1cab7b9270774c37b8d0e6b2acfd33f144ba74d17c849299a9c750dab9c8f1bff09147befb7876421c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e
Filesize
23KB

MD5
25378c883e050d6b28439fdb922384fe

SHA1
5e2bc1133184ccbaca4bd7b1cb3377f1685c828a

SHA256
ad8fc5b41461cc7fe296f1d423ad1469c6200f97334478db0e62b20cacd55f3c

SHA512
b739372961bf923d81f03a8892378de5acd7d10616a32c55501fd037cc1c7980eee542265b02fa92ec4ead43ca653d6c026b15c57c4ea342fe96adbf361e8133

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001f
Filesize
21KB

MD5
a7a7ca950d4d410c9574817eba85c027

SHA1
f485d36c12ad24c9dc4c9f21f53497e3f71234f7

SHA256
8cb3b0932fe49c708bddcf0c525eea2b20d3d55b92566f29e6ba38085ab898ce

SHA512
2b762542c88962e0bfdb9286e3bbab96d041ca9157d6a640537ccb7fcb6502fd2b7868849c6240a116a986a64b367dac5098755543fe8ad7434c6580064ab1e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020
Filesize
21KB

MD5
ebc633a368f3fac0b50f7a240f5c9b9e

SHA1
8e6931ee9534a5df409e6781500de861d1901051

SHA256
8213ca3eccc92b35c7cebec3680fb15cc6e77a1929dd50fd4de0f94da1ccdc18

SHA512
96df3569e12d2c0ed7e8292d0f65e87503fa0adef302d944fe5c60afc8877938bce64e81506f4c716c0a5df0f490e43f115811a721d59d6258738f45c3151fc5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\84ef792e97c5476a_0
Filesize
324B

MD5
60e603dccd4a9513820ea45e6bfba2c7

SHA1
4476b6dedf59657ce41239aeca950447795004f7

SHA256
c634886cd77b82ccb0a54a148690d69608c6d8e6706def255d5f7b3cd8cb3207

SHA512
75fa2d8b2f7e06540c49cdfd5cbe8c5ea76e53ae15554bc1e44709f81a1ce1c425007333e6c8d751d9967e5963f2f75e70510ee5440ec0b9462834f143ad8574

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\bf93463ae724d6e9_0
Filesize
34KB

MD5
2be0dc8602978563a897e5132b2e5c65

SHA1
86a29a618b6290796d3b4474cc33eadbc99eeb4b

SHA256
ced884be3db2403550b5864814e0e216e4930c8aa862b54c039b0908db7b9748

SHA512
1e6457938f49bec804fce36d4a6a3684ac79d037673ed658ed484d82db8a04be6d3429f7e7f1c8364a73d514c18687252b5e79856de09a3d8baa5c2064046f0e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\ff1c2cdc18ed865a_0
Filesize
286B

MD5
6a4389b540ceb6d1db0d048f7e1ab049

SHA1
a858e3518d30f443538b34e4057b7cc769867da3

SHA256
c4d1200f5577c89f6800f17a579e8da011ede61650a7048a8d41f968b226073f

SHA512
dd0602eb2d66580e39918b4a5f57b788a04a29aee17f500a06b16fc32a15b9292b4e58f5b594a7d73e1df6892fb068742f00ac072d5a337f046acff07c9c204e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Filesize
3KB

MD5
d47e628437b97c4a3617c9415588e170

SHA1
c5ca0ec865537614bd0f4c0aa26b586f8e589524

SHA256
ed13201bf58284a565e1023954ce65cf8de51b759f12c4839febecd05bdb250c

SHA512
58d2bbe704e4a8929afef7c7094768d6f61a73ff2354e6ae79a5493ce68e466a89924d53c18e6ee5dc3ca7e7a51dd3fc0d48f4fdb78e1219da40ea4514c36e5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
696B

MD5
a73cde207d8bc1adf4df74ebcbe9a7ea

SHA1
4209a47abde73e310e2d37d1599e223eb7e69860

SHA256
9272d3355096c4a724ef532e9becd94c8e57e3c55d63f1a6dc22aa096539b532

SHA512
6069318d172e2aeeab675739dc9f59434a39133ccb800014c18f441192fdacf5d0e1bb9ea7a8bc36089d362a4e93b338ea4a6d2a301abf8d72e723144ebdf9ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
3KB

MD5
1318a99aeec4a61a4fef6e859315707c

SHA1
710d07e118b1e93072cea8df509a8506a8069d5a

SHA256
cd1b2fd45ef3baf6faf5d9e25d95a7d7ef8bd2dfba7ee822e34cc26ff276053c

SHA512
a54266028019481f72a60922dad1054c361b9355b898d98c402c8d6a75f43e0db6e45f85f9d75593c9faed1a076348b6ade4c20be38222b9d3a2ea59c513c6c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
3KB

MD5
7da6713e2a4075cdb7dd4f2431c89d27

SHA1
27d23fa53d2816ca82ee73aa75ed977a62672bfd

SHA256
5d513bfb5c01ea6f4f1902fe7a836b2dfface66efd3138c77b8d44cdae624828

SHA512
cb4752c114931f2b72de3fa6df750f62c90bc3f2b085e6b96ea8300bffdb9efb99d56f85825c27da5c85f634c37bf38313898fcf2a09efcbca21dcb2fb2b8014

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Filesize
148KB

MD5
c019df8a6c26029110b9421d46ee7d11

SHA1
6dd8fbcad397875c23f8aeee06e0ffb8c3ec2d24

SHA256
5c7c738f3659521021e9baffb5077102e1600e5d5d56f1e8ef0fc3237a435814

SHA512
a02a6354b49e2c5ecadce389f860077ee926addef5ec685660797bda064fd8324bf123060f78425e949b5b5f70568a637c1f8c1dbf651c00cc83ea58da939ef6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
ec81d2e3830b01041717e9a56c7a43bc

SHA1
3be16498bc3874b9bd909b46c120a9a44fb535ae

SHA256
4a2e4f1a3a2def902de3b1ef3d114c95ab591cb4b5c40ef1b848f43b4c2ab38b

SHA512
0e1cb8c519d32cd2e5fd5f80918551c904776e1700b00e444379648f19a3cbd4feee03913124ff4d848c82ceaa4501cdc7db87c006f86c40846918ec599a22c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
7c4838743b9039e60ab91f1cee35405c

SHA1
dd911d66b9897263e6a886b1640c40f9045d6dda

SHA256
e216272353e5e6f7975c47cc9354c0ab8e88322fb732884312f3cf9c2c037c17

SHA512
4ccc56ef2ba9552392547c2d5b4595d70440324c8f89df36e08e8fd61252414419f5b38b466fe1a23e105c1acc169bce0e48765335c27ef1d64611140ceae519

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
bde30ed348961ad341f3644093b748a3

SHA1
2a9a5d9ce76082e9a3f3bd2d8b83e8a816f69075

SHA256
c29e3cd0b7b83040a2195f00d9f0bcca4af6120549266e37374e5f7edd1db5fe

SHA512
9763d591337fcc953a9d3da73b8094083ed52296cb4bb82a2e161b335cbb79f40a1ead7de44ec989d0077a5d6694d8241ffd511d3ad71cb69a57753916ce3640

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
26aabb97e7685b0f465207affa83a862

SHA1
52f90fc0bdd2a37f3013c8bc0ff1e0af9204715b

SHA256
7d8bc1a73d3cb7447f0b7c0d5a81a822caccbe9aa9d4b4289ecb3c69595bef4b

SHA512
06332be44d3faee159686ba769b1da78f1b18ebd29ed6d70d63b2885498dfd967c6ed96110662bc56727c5d77d6fd8c0f13c0df58235bbc4287cff68a3230b3a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
475a4792c9bc7f544041501236a0a878

SHA1
5d84e7b723dd6ae1bac2896f8e81cd5d516318fe

SHA256
1e8fce32f7ff5de6bb625a55ce1485165ca755a3f84ef739f097df6100af18c4

SHA512
3687cfb1dd49b2d3f13ee8bd77b6084f5a23b49f0a124abe8b0d1280cbe1eeab0b53feca027b4b171fc33b74a802b5c70b6ff9cafa8dc10b8ca24837a752c8a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
632c19b76651de19d1ff3d6e6b49e899

SHA1
0218a5287017be23306adbbb7d471df9b6c866d9

SHA256
96c768018da5838655bef942b8738fcf8c71dba1a58a07da2e00b8529cc10969

SHA512
139ecd4b04ee6d108f12d5ea143f2b93c10c21d021752bf84dcd52887125f7611e507b9763399099f740748a952e9aeb3d7f5cf7ae43b17b511c4819db4bd39b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
8a024cf636bd04330db5751d6063ed73

SHA1
ea28c95e226f0ea963c8487bb1956c2824c42467

SHA256
132f426597f5c66d7e73cf7525e3c03eee47da84801a88eaccac13b6f4f5940c

SHA512
bba97aabcfb5fd2cfa569255815e5b8112d8af262723fb3b50530535f9ecf1c68b275a75ac376d63633c89551fdb387708fe84b1234f9e75381b9c906831eed0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
b93c876ca678fe4d821d388f1cb0604f

SHA1
025a22e766e0983e7fa4b1d0b22b3be831b72d73

SHA256
fbca3420264b33da35c9ef7c9b0ce50952227038353a31934cb78ca311806285

SHA512
095a3226ba8e7170d366f60bccd52adf02fa88c806588f062d7cc88bc497fb7f612b585ad75130dd32952cd73321b53e7a3de082483964cdde4d622e9c85149a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
59927bd7fc6c2adb04ecc5b6c1504a81

SHA1
2fdb21b23288153f137321600667f15ad5d677b1

SHA256
5fb76ba198ec022c2443b6ff223fcc9c2090e0a65ab3b02a901d081907f23513

SHA512
d952c13318fe0208ce4eefe4dca57db3341c9222e1027988bc7709e25c9266734eb8630a74ecefec2f0c98ee42535220869e9353c4bb33583eeebbe4989bb885

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
435b1a4b4d2d4418c14f620fe3a2bc1e

SHA1
0fbf4fad02ad9c9bea06ade0767cba33e3cacfef

SHA256
ab4d529c5cc4e8c5d46af58477f928ecd36715c482d4db8987658bfec0056ff1

SHA512
5ec4b6ae5f77f0c13daad1749a6ff9e1e5f0d1c76aec6084501803bc82d05fa691d9768cb6dff44d5c1578200fc3f502b8d9ff865c1085cd8ef04133a0d0e502

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
6cba3aaf0e7ddd9d55085e5fbf32fae3

SHA1
7f0a34478a458a50f6bddf9688cdff33fc996e6e

SHA256
ebfa3a70e7ad41b579fa96c2c1a19febdc33f4024ba9225482d04f0b96d5daa5

SHA512
fff66c924e248cd0817501d4878c7fb55218e413e7954a8204210ded2b5a796adcb960c547e8a2a20b0428182a874fcd0606429ddaf943d9ddf0137586203045

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
9380d1981e7a13681b7e54de559e003a

SHA1
c4b64b68ec499894e2e0e25ab6ea1b6b67ebd863

SHA256
6a0366cac4513382cc737bf5f9a4ee338584a7c3a568be6d007d92a6ad9753de

SHA512
e22416f0b387e5220d1b9a5c0cb828577a38f7f3e6889818fc8146f768cb6dfeb1f4dd74d070a2fabfbb2b7f2ca3098684c70bfdc913a05e8abf5aaea004acfc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
125c9f6e61516d1e4e412d1a599d52b5

SHA1
0c80a0f48b1ecbd82e3568164cee3bd7bfa8dc67

SHA256
95063e510157f2598566f16a4141342cfa03d0d0452b20c6f9dda6cbf3697817

SHA512
e4cdd98bf44a9b4d3f281f2c376330cf3c794a053f9114e30f9038eaad552f2284b0eff4c530780a705bbaa75f739a20b5fe0a39152d0fc0c88453de04d72359

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
8a0b501bffae1b251d51c1e691ae4a30

SHA1
5e73d85a4c31d1d3eeaaed34a236fa6f6a263977

SHA256
3796768146d695cb9c9455e36b51fdb8db89eb2b53deaa2fe959e701310018a8

SHA512
9f6f08e6dfbfdb9b72008fc4d0fb54dcd8d8535ce5f571550053fefca7181d302722577cb67f44b3370b16264e6b8c086e8938dbfd46ebb23d810d1e1d67efbc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
9708d07edfc62629cf78ad4a106268ed

SHA1
e3ec932eeb46a9dc0e09e27c269f348170c895d1

SHA256
3075586fc2ef87fc2da553739db311418594c018458f03af90bcd9dba9fbe3ce

SHA512
e3ce0fc0888324c532401fec348cd47c8aa372fd437aa09895b47dd93083fd13a26f4f2161a47e3b0d726e2c84ff6aeae32b70f7574110f4cba882c01f40f4cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
2ee5c6598d733fd44e9de64f11761a5f

SHA1
3f4f67c34e9fe74d472c279c6609e08d9f6303ed

SHA256
41b58b6c32e2daf651ad2dcfa9fddcbd5f10f35e7ab2456029c0e32d6ec33052

SHA512
b4d9df49df0a2e830eb1547dcd732c890046d0c180200106bb638a61eac23033441084ef644585b48523da0a6ac2e1cae2d79530058289f7d5bca0fdfbe4d427

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
c779a5d5ad78c662b8b8f48ecd2e14d9

SHA1
7ab4093c4fde08996ce13cbdbc2c62e77973eb6a

SHA256
2c61a17a34dff348e54f9a518c5f99163150046685ef5e85af75021fb4c735e6

SHA512
fa922736a671d30f25173357aca791312ed3ab67fe2032fceb06c8cad654ed155d8fcfad1233340f331bc14b42c14335435adb021bc59b38c7947c71f8304bac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
9dd8ce2ae8701ca69db89e9854f2c837

SHA1
fffaba21446823d4f144d906c8c005d5cc55e3ec

SHA256
33f154526647e4620bfefd499863d1310dacd769dd368399d5937bfe11904ead

SHA512
51ef611b532d14aac8220b82a32e6b7875855207f6a8e01b42e3dad238549184f4f541022088577ebb6ab2c6f4fc136f2c775d309b7d02117f4ce3aa243261ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
ae960b800bad3af8d9bb7e6c3b9cf3cc

SHA1
b3d45b6c263dd1a7b7294781f8071323f4181904

SHA256
acfac1eefcb7c454a0ee89d7c5b0e2cb04ece82086142959cb48f41ecce35fd9

SHA512
9b9909d4aed6c33ea534c6d66c5f6e6a6b445d9811cf3ef6a9c3cc000f819a1e784ec9eccc428e27a353890306eeaed4af56b330d55833fa428f61d04a6bdd7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
55048007335c0fa8cf7fddf7deb1d530

SHA1
59b3ce1c95e6e321c92bf501a52b3009795c8e4d

SHA256
da92fbc512c62f5d48876ec84f718c7590de63aceb1ca731a97dd8e53a099eff

SHA512
e5dc1ecb304dfead885f0cf3f5755d80d4cfac16a7ef595132bd48519335bdd4284d2e0e1dc472f86a1549b89b033029fdd3167ac6d52948d9aa4194ae3d28dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
2436f6821d1b8283f0c6b3e6685b2243

SHA1
5f5c187e4062d480209d827a676a4e659a36e751

SHA256
46070111b581f9090615e1f95b9ba6e76964afcd4dc1854a97cf926b98371d6e

SHA512
74b13d3091e02297c6a8e35d42f45851b02dd2eba024e983a57ffa7efb1b34530d946f8624a5c3115c3fd30f7c1f6ff2e35053832fc724ec40f45b522b20e842

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
72B

MD5
6e917946c134aeba840e2c7720877349

SHA1
869d4a47e85c2c9f7035193bb060467bc933acdd

SHA256
21042f619d915a0053ce6d2b6cbce96986115fb26081ef64678485c473726ee0

SHA512
95412dc9d3f7da0a2cb522c8490b659a4bdc84adde0b8f2b58e8b14f15c0b29829fd1df0a6c7bc94140e8667aeab13c936a3a9381ab76e5a3223871b6afdfb22

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ac209.TMP
Filesize
48B

MD5
276d893d536d153b8af6468c7b616a04

SHA1
79b49cc86a0fb5a54e07c6ccb8be8ab7f1e25c0a

SHA256
03f2ea35442e8fcdf3a0fa41358707085af19dab1ef9173aad6c42b1bfb0b7d0

SHA512
42bd3504f39e4e5db0f67cd942e9ddd8f8c005eb2572e87c0425377f79e8af6ebc795bb78a94b6f35d3c00db280fb1b7966d01a57dc82d18fd417d088c053e64

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Filesize
92KB

MD5
cc9d9c20722cb0789327e6370bb1df9d

SHA1
c7116495f5bf39656ac0ee6f9e2221c392cd09e7

SHA256
b73ac77461c1e917ad425d6dbd9bbf5a22feda99d323d1d39a806a7240e7ea20

SHA512
a4ae402d2d650453ab8c9d634097990768382d65c82288d4ad20b5ded21a8317aa42de9f4060bc5b5ba1346487a00c2d43889ac885f94e9b31bec833e8f20beb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
136KB

MD5
b9424460226383835750194a61601877

SHA1
23b1caaa5474f2727b33eac6f982cebfb9cb9843

SHA256
3aa5a457df5b4070d27287c71300f1d452600271b7c565466e7fb6472ca2b4da

SHA512
c7da80b8519601ee6500769bcdf4111b18d7ca5e5342c60e19a1e0bde1393a92363f9da29248105c7ce24737329b37ae2d5fbde6fe0f4c4e4dd3aaf66de1069a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
136KB

MD5
59038a66eb901d18681f69b8e38b46c0

SHA1
45d5babf78be6087ffaf77d432ac113d0265c629

SHA256
191429d1d427e5f6d871974f7fb1d150dabe807c6df2907059ba68911e6d7209

SHA512
85d0c0a4833cc765b57cf9f29d29f28d82cc4cf3409b1db1f343fa9d918049e979b3671adcac92ee46ca3f66c7d14933de10333ace33a551fa5456f848d2640c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
136KB

MD5
85dcc25727b2bcdc2e4891a506b3d1c6

SHA1
90af485044a60a5817d5444cb6b5894092c4d322

SHA256
8ce25f9bf87d654a57bc37310477aecc2cf2bcc3de17b2db0cafc679d0c35d71

SHA512
08b2e7f0ecc10128fe1b71869621ff4212663b338d0168eaf2fd0deb29cfebcdbb582882f8f376931c53e13350b97b71096b1f6b1b90292a14a75aba0c61f02f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
98KB

MD5
ce129e0bdfa27a56de08563d64fdc633

SHA1
7d49aa47897a0180aeefba6fac85b0cc93350b95

SHA256
35806fe8f50304ba45cd103209e7c6af7bd515e3eea1e3c5caf1331a3d1025d1

SHA512
d06c274c59877d0e8cdff10e8cb6adf42d454da8cde3dbf0445c30b5e452743c9ea30c0ce73d95a172078c3ea962d397806821a66286358128b874fd479fbcc5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
105KB

MD5
442a755b9c6a84ce9e77d8f1ef37bb98

SHA1
ba24da838c7b71b758dd3e9a8cde16403ce60869

SHA256
eb9526eeace5f33cbff91cd620f55771f4af7353d2be0ba2f762e24aa6bb3d5d

SHA512
4fbc64161508ab93a9d4a5dec8411ccc4c92100517f63da6dd568fc6218426a4bcab7ebc01e3705f32b035fa785c11bbca48d5d9b36987198f1eb137d1397da9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
111KB

MD5
f6679349303282a42e30f17f34a27477

SHA1
3796e20e357bcd87cb326e48653133935ba028e6

SHA256
3e38447acca987a31a907f31945f2d278cd541604e5bfc846ad0f69eb219bd2e

SHA512
c39612cc5159067098ac230a6d3e9819e2f6f9db0c4d881bad969f1618d12b0848ba8b21dcf3f421a4c5c11f4c7d1f863db0ffdd60753707901fe536888308dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe596b91.TMP
Filesize
93KB

MD5
9dc95e32a279eb6369259fa01a979262

SHA1
654a1032d14590433ea100474fef4a5761d0a2a4

SHA256
ba88aa86bcee2ba36be63d96368d1fafbf0262247d38e619c09407f1195ce853

SHA512
d7ee70ad49e4e521769b165c6261cbf508748e6ddfc1e3343e1f246f35ed906fc86f6f0bf41cdfbfe6eb1479e551dfb4e101885b8bbab5e315e92c4c0ac2b14c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AimStar.exe
Filesize
2.4MB

MD5
541247b515c16d7190423e910cb27e87

SHA1
1c07ac5dce34438180f99541f7c7463a9da4587f

SHA256
15ac40bb2f6029f1873c685c1973de6ecabd94abd897f44ebc1514ef5c6d7fae

SHA512
cf692f446633ca14a775b4d76a529d17d0cced4f30d18abbbf89572de2c8c15365fe410fc89ea51d8ef50136ed9213eb3775a11ec68edd43d9f07f5ff89ebfdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CS2CheatInstaller.exe
Filesize
5.9MB

MD5
4055f098aea5af46f75d6f9e17cc1adc

SHA1
7ade17a4f0cf6e10580729061057c4d2b3f45b53

SHA256
2db2a52c4c48784759d8128cca68dff0b772378287e15ef335f0faaf95712f17

SHA512
e73856cef9f159ca2e43f02e67c78ba0fc71b34fd044ffda7e8942faec231ca3a4859032c819175941a3f50a502b85ec86a03018a8fd7798351aac2060b05fe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CS2Cheat_x64.exe
Filesize
1.4MB

MD5
de6a2a1b1c88430519f87c56f38d658f

SHA1
f4e575f7e5d28e18ff60c0d54d4b7d3e93343e71

SHA256
705ec5f2d0c41de299c3ea415bec9b43b3b533f2e53bbb09d38cf38f4d5795c3

SHA512
d9427b68415dd5611ca5e03fd0836389242c78fbae05706805661c0387bfe9961e5653771dd6da94f65b76860706838085121fb7b23b7b541500e78d1529678a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CS2Cheat_x64.exe
Filesize
512KB

MD5
b0e8832014b05577c84634a3bf29eb6f

SHA1
b1ccb281e79b1a7c4e2878d123a142a4d291115d

SHA256
dd69ce8b7f472b30ec57d563c998ed52442c866afebb293bd427a4aca8accc86

SHA512
afd00425715ce38058b9a3ea1642ed4c06de86e077a3322f26601666e90e338ee86795889d2360604156a38d8b8ba314f90dbfced03c3283518004d31d5c7618

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CounterStrike2FCx86.exe
Filesize
1.7MB

MD5
5b9a38d8f66d8b69c6984a4b85618296

SHA1
d9c629863ab1f2d2162ec729ac485cd1d0237a91

SHA256
fd59524dcb0f9145ecceda47830a58e105879e3a081d10afd79ab7c4668aa6f1

SHA512
69fbfa37b4b377fb6ab0357afe92aed594acc7af8b6d204c3bd91b41bdd48336a6f23e59803f853c838f2a597dfb1d36c7fadda65193887b89dc973305e003b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\CS2Cheat_x64.exe
Filesize
5.4MB

MD5
547619372080e09d0dfc0259d141ea96

SHA1
fbafb1cc20a199303ed9b92bd3b2867a59acddca

SHA256
b08db8b865d26c69f89206efbe5f7b6aa03e115ae88c9216602ee857158604f8

SHA512
2762cdd5fe75a6c1a809a06e86c14cacb1bd4dfb540eb5985fb093648b1250876a0934748c0967892313bea629452d81a04eb49a1936225ee5345547d32e3f98

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d14bpqcq.bvp.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\dfb7944323a455e450192e8399ecdfbd\Admin@DFZPKZRM_en-US\Browsers\Firefox\Bookmarks.txt
Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\dfb7944323a455e450192e8399ecdfbd\Admin@DFZPKZRM_en-US\Browsers\Google\History.txt
Filesize
1KB

MD5
5bd0196a9f9aec3dd69a1b70e8cbf162

SHA1
dc6dd6945dd006ab3d53e39d42ac749dc0ba9e1f

SHA256
926250d0da6e892233504380bdeefe245fb2db09a75df72f5a8be98e129fd511

SHA512
5010de6d2c8434686a3307b1303c999980eb8a768f07ce422a1c658394d43c933798ee7b1eb3d381c3164a13c0e9b7663b1d6dacff4e6e4433a4feaea3633022

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 702356.crdownload
Filesize
2.3MB

MD5
87b234dda4420f27e395256c88da2590

SHA1
65ada6784094e8bc01a0dda730f10986f3c27256

SHA256
f5c92459f250d68fb4a63588b0400f8177b13ec8bad614c736c29c3826ecacee

SHA512
77edde48588ba8490c72fbb76a842aaa319b5ac670c38ff1730047b58ed6de31a4efa0c82e4fd7a690d51bb2ad918ff0810feb6c497dd34f79a7465e129ad8fb

Download Submit
C:\Users\Admin\Downloads\[2024]-Counter-Strike-2-Free-Cheat-2024.zip
Filesize
6.9MB

MD5
f3ae1374cd0875b76b968270cc175d21

SHA1
a07cd9e77daee2e274368c83a174572145316793

SHA256
597ed13a4d6f3df6149defdf63859cfd92cfb86a9c4f0a5a7a61baca9d4ef5fc

SHA512
304b3fcdcb0325a4a7e1fa7770c0a483520c8d6442c8f6e769da2434c9fe69f5f83a1a1e9afef8f69cc53da9bc7a41d4c8dadc78ba3999d66a476d22810314e6

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
2KB

MD5
710d55f3d3ca732fc39af6ffc68981ed

SHA1
f5795ab6843bf05d8b845b854a7fcf566a8a6b41

SHA256
651618095b62236fcd605652b4ee1e92886ffc38d72660149030b25f2ace3306

SHA512
1b8f40d21a3674ec23b67501fb4305d1bdd8cb7c3837d43014585a185e1aa9c3f9405c8429f85f4f76df80ecfc071ad6ac4a85d8581481bd88fd0f8c7e188e54

Download Submit
\??\pipe\crashpad_4404_LMTZIHDZVPYQSYRI
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/580-1435-0x00000147F9FC0000-0x00000147F9FEB000-memory.dmp

Filesize
172KB

Download
memory/580-1438-0x00007FFBF6C10000-0x00007FFBF6C20000-memory.dmp

Filesize
64KB

Download
memory/580-1441-0x00000147F9FC0000-0x00000147F9FEB000-memory.dmp

Filesize
172KB

Download
memory/584-1407-0x00000204EA350000-0x00000204EA37B000-memory.dmp

Filesize
172KB

Download
memory/584-1414-0x00000204EA350000-0x00000204EA37B000-memory.dmp

Filesize
172KB

Download
memory/584-1406-0x00000204EA320000-0x00000204EA344000-memory.dmp

Filesize
144KB

Download
memory/584-1411-0x00007FFBF6C10000-0x00007FFBF6C20000-memory.dmp

Filesize
64KB

Download
memory/584-1418-0x00007FFC36C25000-0x00007FFC36C26000-memory.dmp

Filesize
4KB

Download
memory/636-1412-0x000001ACF4470000-0x000001ACF449B000-memory.dmp

Filesize
172KB

Download
memory/636-1422-0x000001ACF4470000-0x000001ACF449B000-memory.dmp

Filesize
172KB

Download
memory/636-1416-0x00007FFBF6C10000-0x00007FFBF6C20000-memory.dmp

Filesize
64KB

Download
memory/744-1423-0x00007FFBF6C10000-0x00007FFBF6C20000-memory.dmp

Filesize
64KB

Download
memory/744-1420-0x000001F677CC0000-0x000001F677CEB000-memory.dmp

Filesize
172KB

Download
memory/744-1427-0x000001F677CC0000-0x000001F677CEB000-memory.dmp

Filesize
172KB

Download
memory/904-1424-0x0000023CA0850000-0x0000023CA087B000-memory.dmp

Filesize
172KB

Download
memory/904-1429-0x00007FFBF6C10000-0x00007FFBF6C20000-memory.dmp

Filesize
64KB

Download
memory/904-1432-0x0000023CA0850000-0x0000023CA087B000-memory.dmp

Filesize
172KB

Download
memory/980-1425-0x0000022ED7630000-0x0000022ED765B000-memory.dmp

Filesize
172KB

Download
memory/980-1430-0x00007FFBF6C10000-0x00007FFBF6C20000-memory.dmp

Filesize
64KB

Download
memory/980-1437-0x0000022ED7630000-0x0000022ED765B000-memory.dmp

Filesize
172KB

Download
memory/1032-1439-0x0000021B1BCF0000-0x0000021B1BD1B000-memory.dmp

Filesize
172KB

Download
memory/1032-1446-0x0000021B1BCF0000-0x0000021B1BD1B000-memory.dmp

Filesize
172KB

Download
memory/1032-1443-0x00007FFBF6C10000-0x00007FFBF6C20000-memory.dmp

Filesize
64KB

Download
memory/1096-1450-0x0000020507360000-0x000002050738B000-memory.dmp

Filesize
172KB

Download
memory/1096-1448-0x00007FFBF6C10000-0x00007FFBF6C20000-memory.dmp

Filesize
64KB

Download
memory/1096-1445-0x0000020507360000-0x000002050738B000-memory.dmp

Filesize
172KB

Download
memory/1112-1476-0x000001C15D3C0000-0x000001C15D3EB000-memory.dmp

Filesize
172KB

Download
memory/1112-1456-0x00007FFBF6C10000-0x00007FFBF6C20000-memory.dmp

Filesize
64KB

Download
memory/1112-1451-0x000001C15D3C0000-0x000001C15D3EB000-memory.dmp

Filesize
172KB

Download
memory/1196-1455-0x0000024199DC0000-0x0000024199DEB000-memory.dmp

Filesize
172KB

Download
memory/1196-1457-0x00007FFBF6C10000-0x00007FFBF6C20000-memory.dmp

Filesize
64KB

Download
memory/1216-1468-0x00007FFBF6C10000-0x00007FFBF6C20000-memory.dmp

Filesize
64KB

Download
memory/1216-1460-0x00000202CB470000-0x00000202CB49B000-memory.dmp

Filesize
172KB

Download
memory/1244-1466-0x00007FFBF6C10000-0x00007FFBF6C20000-memory.dmp

Filesize
64KB

Download
memory/1244-1465-0x0000015373260000-0x000001537328B000-memory.dmp

Filesize
172KB

Download
memory/1256-1473-0x00007FFBF6C10000-0x00007FFBF6C20000-memory.dmp

Filesize
64KB

Download
memory/1256-1472-0x0000024DCF9F0000-0x0000024DCFA1B000-memory.dmp

Filesize
172KB

Download
memory/1368-1479-0x000001823CB40000-0x000001823CB6B000-memory.dmp

Filesize
172KB

Download
memory/1412-1484-0x0000023D05CC0000-0x0000023D05CEB000-memory.dmp

Filesize
172KB

Download
memory/1468-1487-0x000001A805B00000-0x000001A805B2B000-memory.dmp

Filesize
172KB

Download
memory/1512-1494-0x000001D43ECD0000-0x000001D43ECFB000-memory.dmp

Filesize
172KB

Download
memory/1536-1545-0x0000000001670000-0x000000000169B000-memory.dmp

Filesize
172KB

Download
memory/1560-1503-0x0000022E045A0000-0x0000022E045CB000-memory.dmp

Filesize
172KB

Download
memory/1568-1515-0x00000232ED4D0000-0x00000232ED4FB000-memory.dmp

Filesize
172KB

Download
memory/1664-1509-0x0000013C810D0000-0x0000013C810FB000-memory.dmp

Filesize
172KB

Download
memory/1684-1521-0x00000230E3DD0000-0x00000230E3DFB000-memory.dmp

Filesize
172KB

Download
memory/1716-1400-0x00007FFC16E00000-0x00007FFC177EC000-memory.dmp

Filesize
9.9MB

Download
memory/1716-1410-0x0000019496250000-0x0000019496260000-memory.dmp

Filesize
64KB

Download
memory/1716-1408-0x0000019496250000-0x0000019496260000-memory.dmp

Filesize
64KB

Download
memory/1820-1532-0x00000161888B0000-0x00000161888DB000-memory.dmp

Filesize
172KB

Download
memory/1844-1526-0x000002B1BB4C0000-0x000002B1BB4EB000-memory.dmp

Filesize
172KB

Download
memory/1856-1537-0x0000027AE6ED0000-0x0000027AE6EFB000-memory.dmp

Filesize
172KB

Download
memory/1992-1541-0x000001F482980000-0x000001F4829AB000-memory.dmp

Filesize
172KB

Download
memory/2072-1549-0x00000134E7BD0000-0x00000134E7BFB000-memory.dmp

Filesize
172KB

Download
memory/2172-1553-0x0000020F27D60000-0x0000020F27D8B000-memory.dmp

Filesize
172KB

Download
memory/2348-1557-0x000001A668450000-0x000001A66847B000-memory.dmp

Filesize
172KB

Download
memory/2364-1562-0x000001C8B7B90000-0x000001C8B7BBB000-memory.dmp

Filesize
172KB

Download
memory/2420-1242-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/2420-1245-0x0000000005510000-0x0000000005520000-memory.dmp

Filesize
64KB

Download
memory/2420-1250-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/2440-1567-0x000001AAE3A00000-0x000001AAE3A2B000-memory.dmp

Filesize
172KB

Download
memory/2452-1571-0x000001F6839D0000-0x000001F6839FB000-memory.dmp

Filesize
172KB

Download
memory/2460-1576-0x000001DFA0DF0000-0x000001DFA0E1B000-memory.dmp

Filesize
172KB

Download
memory/3024-1402-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/3024-1387-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/3024-1497-0x00007FFC36B80000-0x00007FFC36D5B000-memory.dmp

Filesize
1.9MB

Download
memory/3024-1385-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/3024-1386-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/3024-1393-0x00007FFC34AE0000-0x00007FFC34B8E000-memory.dmp

Filesize
696KB

Download
memory/3024-1391-0x00007FFC36B80000-0x00007FFC36D5B000-memory.dmp

Filesize
1.9MB

Download
memory/3024-1388-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/3024-1390-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/3420-1337-0x0000000005B30000-0x0000000005B40000-memory.dmp

Filesize
64KB

Download
memory/3420-1248-0x0000000005B20000-0x0000000005B28000-memory.dmp

Filesize
32KB

Download
memory/3420-1313-0x0000000007910000-0x00000000079A2000-memory.dmp

Filesize
584KB

Download
memory/3420-1217-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/3420-1216-0x0000000000F00000-0x00000000010BE000-memory.dmp

Filesize
1.7MB

Download
memory/3420-1256-0x0000000006E20000-0x0000000006E3E000-memory.dmp

Filesize
120KB

Download
memory/3420-1255-0x0000000006E00000-0x0000000006E08000-memory.dmp

Filesize
32KB

Download
memory/3420-1254-0x0000000006DF0000-0x0000000006DFA000-memory.dmp

Filesize
40KB

Download
memory/3420-1247-0x0000000005AF0000-0x0000000005B16000-memory.dmp

Filesize
152KB

Download
memory/3420-1331-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/3420-1218-0x00000000059E0000-0x0000000005A46000-memory.dmp

Filesize
408KB

Download
memory/3420-1320-0x0000000007EB0000-0x00000000083AE000-memory.dmp

Filesize
5.0MB

Download
memory/3420-1246-0x0000000005EB0000-0x0000000005F42000-memory.dmp

Filesize
584KB

Download
memory/3420-1219-0x0000000005B30000-0x0000000005B40000-memory.dmp

Filesize
64KB

Download
memory/4752-1378-0x000001602FEE0000-0x000001602FEF0000-memory.dmp

Filesize
64KB

Download
memory/4752-1335-0x00007FFC16E90000-0x00007FFC1787C000-memory.dmp

Filesize
9.9MB

Download
memory/4752-1338-0x000001602FEE0000-0x000001602FEF0000-memory.dmp

Filesize
64KB

Download
memory/4752-1334-0x0000016049D40000-0x0000016049D62000-memory.dmp

Filesize
136KB

Download
memory/4752-1341-0x000001604A7B0000-0x000001604A826000-memory.dmp

Filesize
472KB

Download
memory/4752-1336-0x000001602FEE0000-0x000001602FEF0000-memory.dmp

Filesize
64KB

Download
memory/4752-1382-0x00007FFC16E90000-0x00007FFC1787C000-memory.dmp

Filesize
9.9MB

Download
memory/4752-1355-0x000001602FEE0000-0x000001602FEF0000-memory.dmp

Filesize
64KB

Download