a6b13cf620a23848beec2c268892edad40693b0a06c414dbca2912898775dc38

Analysis

max time kernel
130s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 15:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

InfiniteFusionSetup.bat
Size

3KB
MD5

fce0bbd5cf2e90a6ac69511184732b67
SHA1

7c1e03765c6effd9bd938494a2d9b7d13d6dd288
SHA256

2ee810c315516729c4038b88049c99bad39810f25c6db2d8576d1588ad89c88b
SHA512

c6e28c0e5ff8f1bbf7dc8c0f9ad8587214179b74890b106798a5010fdb385f7c2e17444890cccf5cc1709c46f71bf5240437e18149b16c03518bbc43aac8d2e8

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	cmd.exe

Deletes itself 1 IoCs

pid	Process
3184	git.exe

Executes dropped EXE 39 IoCs

pid	Process
540	git.exe
3976	git.exe
2908	git.exe
1632	git.exe
4004	git.exe
1444	git.exe
964	git.exe
1364	git.exe
532	git.exe
3056	git.exe
2572	git.exe
4772	git.exe
4452	git.exe
1572	git.exe
1840	git.exe
812	git.exe
3044	git.exe
4336	git.exe
2952	git.exe
696	git.exe
4892	git.exe
2116	git.exe
468	git.exe
3052	git.exe
1276	git.exe
2240	git.exe
3544	git.exe
2020	git.exe
2260	git.exe
4084	git.exe
3148	git.exe
3268	git.exe
1876	git.exe
3380	git-remote-https.exe
3120	git.exe
3324	git.exe
4944	git.exe
3408	git.exe
3184	git.exe

Loads dropped DLL 64 IoCs

pid	Process
3976	git.exe
3976	git.exe
3976	git.exe
3976	git.exe
3976	git.exe
1632	git.exe
1632	git.exe
1632	git.exe
1632	git.exe
1632	git.exe
1444	git.exe
1444	git.exe
1444	git.exe
1444	git.exe
1444	git.exe
1364	git.exe
1364	git.exe
1364	git.exe
1364	git.exe
1364	git.exe
3056	git.exe
3056	git.exe
3056	git.exe
3056	git.exe
3056	git.exe
4772	git.exe
4772	git.exe
4772	git.exe
4772	git.exe
4772	git.exe
1572	git.exe
1572	git.exe
1572	git.exe
1572	git.exe
1572	git.exe
812	git.exe
812	git.exe
812	git.exe
812	git.exe
812	git.exe
4336	git.exe
4336	git.exe
4336	git.exe
4336	git.exe
4336	git.exe
696	git.exe
696	git.exe
696	git.exe
696	git.exe
696	git.exe
2116	git.exe
2116	git.exe
2116	git.exe
2116	git.exe
2116	git.exe
3052	git.exe
3052	git.exe
3052	git.exe
3052	git.exe
3052	git.exe
2240	git.exe
2240	git.exe
2240	git.exe
2240	git.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "E74APG5N6VQ95T16M1PPZY0D"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "705CLQ6PKAOR1JX1CQXXK6QN"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Software	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Software\Microsoft	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "9OHK5QOOPZCB2HLQVBRVME5H"	dfsvc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	4184	7z.exe
Token: 35	4184	7z.exe
Token: SeSecurityPrivilege	4184	7z.exe
Token: SeSecurityPrivilege	4184	7z.exe
Token: SeDebugPrivilege	4232	dfsvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 4184	3048	cmd.exe	84
PID 3048 wrote to memory of 4184	3048	cmd.exe	84
PID 3048 wrote to memory of 540	3048	cmd.exe	86
PID 3048 wrote to memory of 540	3048	cmd.exe	86
PID 540 wrote to memory of 3976	540	git.exe	87
PID 540 wrote to memory of 3976	540	git.exe	87
PID 3048 wrote to memory of 2908	3048	cmd.exe	88
PID 3048 wrote to memory of 2908	3048	cmd.exe	88
PID 2908 wrote to memory of 1632	2908	git.exe	89
PID 2908 wrote to memory of 1632	2908	git.exe	89
PID 3048 wrote to memory of 4004	3048	cmd.exe	91
PID 3048 wrote to memory of 4004	3048	cmd.exe	91
PID 4004 wrote to memory of 1444	4004	git.exe	92
PID 4004 wrote to memory of 1444	4004	git.exe	92
PID 3048 wrote to memory of 964	3048	cmd.exe	95
PID 3048 wrote to memory of 964	3048	cmd.exe	95
PID 964 wrote to memory of 1364	964	git.exe	96
PID 964 wrote to memory of 1364	964	git.exe	96
PID 3048 wrote to memory of 532	3048	cmd.exe	97
PID 3048 wrote to memory of 532	3048	cmd.exe	97
PID 532 wrote to memory of 3056	532	git.exe	98
PID 532 wrote to memory of 3056	532	git.exe	98
PID 3048 wrote to memory of 2572	3048	cmd.exe	100
PID 3048 wrote to memory of 2572	3048	cmd.exe	100
PID 2572 wrote to memory of 4772	2572	git.exe	101
PID 2572 wrote to memory of 4772	2572	git.exe	101
PID 3048 wrote to memory of 4452	3048	cmd.exe	104
PID 3048 wrote to memory of 4452	3048	cmd.exe	104
PID 4452 wrote to memory of 1572	4452	git.exe	105
PID 4452 wrote to memory of 1572	4452	git.exe	105
PID 3048 wrote to memory of 1840	3048	cmd.exe	106
PID 3048 wrote to memory of 1840	3048	cmd.exe	106
PID 1840 wrote to memory of 812	1840	git.exe	107
PID 1840 wrote to memory of 812	1840	git.exe	107
PID 3048 wrote to memory of 3044	3048	cmd.exe	109
PID 3048 wrote to memory of 3044	3048	cmd.exe	109
PID 3044 wrote to memory of 4336	3044	git.exe	111
PID 3044 wrote to memory of 4336	3044	git.exe	111
PID 3048 wrote to memory of 2952	3048	cmd.exe	112
PID 3048 wrote to memory of 2952	3048	cmd.exe	112
PID 2952 wrote to memory of 696	2952	git.exe	113
PID 2952 wrote to memory of 696	2952	git.exe	113
PID 3048 wrote to memory of 4892	3048	cmd.exe	114
PID 3048 wrote to memory of 4892	3048	cmd.exe	114
PID 4892 wrote to memory of 2116	4892	git.exe	115
PID 4892 wrote to memory of 2116	4892	git.exe	115
PID 3048 wrote to memory of 468	3048	cmd.exe	117
PID 3048 wrote to memory of 468	3048	cmd.exe	117
PID 468 wrote to memory of 3052	468	git.exe	118
PID 468 wrote to memory of 3052	468	git.exe	118
PID 3048 wrote to memory of 1276	3048	cmd.exe	119
PID 3048 wrote to memory of 1276	3048	cmd.exe	119
PID 1276 wrote to memory of 2240	1276	git.exe	120
PID 1276 wrote to memory of 2240	1276	git.exe	120
PID 3048 wrote to memory of 3544	3048	cmd.exe	121
PID 3048 wrote to memory of 3544	3048	cmd.exe	121
PID 3544 wrote to memory of 2020	3544	git.exe	122
PID 3544 wrote to memory of 2020	3544	git.exe	122
PID 3048 wrote to memory of 2260	3048	cmd.exe	123
PID 3048 wrote to memory of 2260	3048	cmd.exe	123
PID 2260 wrote to memory of 4084	2260	git.exe	124
PID 2260 wrote to memory of 4084	2260	git.exe	124
PID 3048 wrote to memory of 3148	3048	cmd.exe	125
PID 3048 wrote to memory of 3148	3048	cmd.exe	125

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\InfiniteFusionSetup.bat"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\MinGit\7z.exe
  .\MinGit\7z.exe e -spf -aoa "MinGit\MinGit.7z"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4184
- C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe
  ".\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe" config --global http.postBuffer 1048576000
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\git.exe
    git.exe config --global http.postBuffer 1048576000
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3976
- C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe
  ".\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe" config --global http.version HTTP/2
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\git.exe
    git.exe config --global http.version HTTP/2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1632
- C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe
  ".\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe" config --global pack.window 1
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\git.exe
    git.exe config --global pack.window 1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1444
- C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe
  ".\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe" config --global core.compression 0
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\git.exe
    git.exe config --global core.compression 0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1364
- C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe
  ".\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe" config --global core.packedGitLimit 512m
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\git.exe
    git.exe config --global core.packedGitLimit 512m
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3056
- C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe
  ".\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe" config --global core.packedGitWindowSize 512m
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\git.exe
    git.exe config --global core.packedGitWindowSize 512m
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4772
- C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe
  ".\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe" config --global pack.deltaCacheSize 2047m
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\git.exe
    git.exe config --global pack.deltaCacheSize 2047m
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1572
- C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe
  ".\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe" config --global pack.packSizeLimit 2047m
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\git.exe
    git.exe config --global pack.packSizeLimit 2047m
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:812
- C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe
  ".\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe" config --global pack.windowMemory 2047m
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\git.exe
    git.exe config --global pack.windowMemory 2047m
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4336
- C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe
  ".\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe" config --global http.lowSpeedLimit 0
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\git.exe
    git.exe config --global http.lowSpeedLimit 0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:696
- C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe
  ".\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe" config --global http.lowSpeedTime 999999
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\git.exe
    git.exe config --global http.lowSpeedTime 999999
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2116
- C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe
  ".\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe" config --global core.autocrlf false
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\git.exe
    git.exe config --global core.autocrlf false
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3052
- C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe
  ".\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe" init .
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\git.exe
    git.exe init .
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2240
- C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe
  ".\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe" remote add origin "https://github.com/x-megaman/InfiniteFusionAppInstaller.git"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\git.exe
    git.exe remote add origin "https://github.com/x-megaman/InfiniteFusionAppInstaller.git"
    3⤵
    - Executes dropped EXE
    PID:2020
- C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe
  ".\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe" config --local core.autocrlf false
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\git.exe
    git.exe config --local core.autocrlf false
    3⤵
    - Executes dropped EXE
    PID:4084
- C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe
  ".\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe" fetch origin main
  2⤵
  - Executes dropped EXE
  PID:3148
- - C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\git.exe
    git.exe fetch origin main
    3⤵
    - Executes dropped EXE
    PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\git.exe
      git remote-https origin https://github.com/x-megaman/InfiniteFusionAppInstaller.git
      4⤵
      Executes dropped EXE
      PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\git-remote-https.exe
        
        git-remote-https origin https://github.com/x-megaman/InfiniteFusionAppInstaller.git
        5⤵
        Executes dropped EXE
        
        PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\git.exe
      git index-pack --stdin -v --fix-thin "--keep=fetch-pack 3268 on Yclextal" --pack_header=2,309
      4⤵
      Executes dropped EXE
      PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\git.exe
      git rev-list --objects --stdin --not --exclude-hidden=fetch --all --quiet --alternate-refs
      4⤵
      Executes dropped EXE
      PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\git.exe
      git maintenance run --auto --no-quiet
      4⤵
      Executes dropped EXE
      PID:4944
- C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe
  ".\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe" reset --hard origin/main
  2⤵
  - Executes dropped EXE
  PID:3408
- - C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\git.exe
    git.exe reset --hard origin/main
    3⤵
    - Deletes itself
    - Executes dropped EXE
    PID:3184
- C:\Windows\system32\xcopy.exe
  xcopy /s /e /i "C:\Users\Admin\AppData\Local\Temp\Lib" "C:\Users\Admin\AppData\Roaming\spriteInstaller\\InfiniteFusionApp\Lib"
  2⤵
  PID:3052
- C:\Windows\system32\xcopy.exe
  xcopy /s /e /i "C:\Users\Admin\AppData\Local\Temp\MinGit" "C:\Users\Admin\AppData\Roaming\spriteInstaller\\InfiniteFusionApp\MinGit"
  2⤵
  PID:1288
- C:\Windows\system32\xcopy.exe
  xcopy /s /e /i "C:\Users\Admin\AppData\Roaming\spriteInstaller\\InfiniteFusionApp\MinGit\InfiniteFusionUpdater.bat" "C:\Users\Admin\AppData\Roaming\spriteInstaller\\InfiniteFusionApp\"
  2⤵
  PID:3416
- C:\Windows\System32\rundll32.exe
  "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication C:\Users\Admin\AppData\Roaming\spriteInstaller\InfiniteFusionApp\Lib\InfiniteFusionApp.application
  2⤵
  PID:4488
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
    3⤵
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.gitconfig

Filesize
116B

MD5
7da2172384b60b04085bf5740ae170aa

SHA1
0237956e65fd9ff3462e7d66ef60f38a072da2e8

SHA256
dfc6f266d4cec09f8fcfd2f2d3d08f921f31ede51724e0291a673d2ef7ea5d14

SHA512
8de6d1f009f2feac035e71049ef73257eac38f2a5019d013a295cb1608a8dcdb951f02bf1139996dd4a7369542a50448ca016150f7d150b211403e26a2c2c159

Download Submit
C:\Users\Admin\.gitconfig

Filesize
69B

MD5
bc8086499c51917d47244e71d580120f

SHA1
43c2533982961a7786a44de1fe466b437e3d7932

SHA256
ed7b379b93d3b9b449e53b237dfb251353a30811ca928df38b5dca807f409fc7

SHA512
3ad7ea81dc01976bea8dde5be4535b2a634aaa733b7f1681db97ecf966215a3537f2fbee67bfe77eaa426feec7f2894305cae38c01285e0c0744aef64d6ec72a

Download Submit
C:\Users\Admin\.gitconfig

Filesize
32B

MD5
73668d23ea9cf32f4a38ca2e6f9b7a90

SHA1
fc5bc489ca2cfa878635140fc48150a5e1759493

SHA256
152628626c99777d9cd25d01c6e9fff6060c41766563f0f5ae77c7e8fd0813ca

SHA512
68b97247088eb22054defe212dca7b1eeb29afb6c21f55bdb23fe9095b01a266b0c400df6947629bdd305cf82b3fc43a2cd4285c216eff1ec9936ec7f6448069

Download Submit
C:\Users\Admin\.gitconfig

Filesize
50B

MD5
d8c6e479ae6d8c12d9dfd0bb3abe581b

SHA1
cbd1ff5602a457ed72ae2ac6be3d9e64fa349f7e

SHA256
41f6e6a828b007050e4466999a15b3158d167619c3cf4e80514b0bbe94c851e8

SHA512
060d03479e0180fecdd3ffd005e9f459a737d123511ab214b0e7fbd2fce6a8b7d4b5b8b8306625953bd276622e561665eb12ab0f627b6c7ad3a4bbee15f6585c

Download Submit
C:\Users\Admin\.gitconfig

Filesize
93B

MD5
013fb46e5cb3e4ac88c534eb1ab05667

SHA1
a8b734ba506a11a2ff36efb685f68ded32a83fbe

SHA256
3d1c6193066ed4ae24d785751da3d9bac0aff9429cf1c7406850fc793d7ccb46

SHA512
b75af2dd877202b4ff86097ae7e57a84582bb6faa9aee9cecf9b6ed47761422019d8c0ea875b30231d628bd63985b5d75691c7480635b37b93c793ce15b812c5

Download Submit
C:\Users\Admin\.gitconfig

Filesize
144B

MD5
140afd9145d0e0a364aff9ea0504375b

SHA1
8d6c9959c20dc6d6c9d851aaca30480fb9d6dea4

SHA256
95445c3ff4493aa187cf953dc98a8e20f68eb5a59794ad216f7ec00eb157aa4a

SHA512
5a504a9054a7c69b05bc0d96beedb616e7124c9a9cbd1dd1d321b9b7e5f61813faae92ba8a0355f28482c491ffdef29bcf8db3c035e9b6433a5370f3941ab245

Download Submit
C:\Users\Admin\AppData\Local\Temp\.git\config

Filesize
36B

MD5
8c534af220c6e2de8dc8662364427eac

SHA1
5ff0531d73ce971ddc5fde6e80700639f99574ce

SHA256
3fcc3a7ff5b8273d86f9cff108bb48a7449601f70a4a4d0e19d89411aa812f85

SHA512
8d8eeaa84f075696d9309e49fa47f0bcd172708721e8e8420d99286ff39ab39bdc5272bd9fa5f5aca1199552bdba4e106c6424883d52884a6764dd7dad52bde9

Download Submit
C:\Users\Admin\AppData\Local\Temp\.git\config

Filesize
54B

MD5
606b0d057ba0a8f2520de6bc5cb872ae

SHA1
7ffbc6a70b16bf64c1608d75f425a67184bdf58f

SHA256
e13b754e006cac590da9e5f26abc95035816347304bb0bef62d7c4c53d41b708

SHA512
9e2347a4863322b637754bce498c4a7ee00c695492920b7f3240fd51f9a3cc3f6fa6973a4a9ea625c99ff79d2b8928b0f761468d8fa54d1ded6b51414787cf14

Download Submit
C:\Users\Admin\AppData\Local\Temp\.git\config

Filesize
215B

MD5
e10f09a68b309f9432772dcca529d1f1

SHA1
1656b70537038ba07e678cbc97f40a765505b27e

SHA256
68e7d69a963beadd3e96b992d4d5b2f5912ef96bdbddba18ef0946b2636f098c

SHA512
6eb8d45eff3986e770e5110019d65d342cc90d11c6ae0596d577f9d92ee3a634495ff6b03933742839d24935bcb3d817a04fea943c74054c64f3567924171aaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\.git\config

Filesize
68B

MD5
3386bdccce841938d882cfd7a155cd30

SHA1
4ee7a0efd17896672c57798c9d5f59f9cd2cf2ba

SHA256
2779793109b88db4ddc1f399586cd37fb6d238ac89b83cb1a9e95d42241c68a2

SHA512
2583970eef19a2dadc635502185d80203187c2dfeda82b84d8407f6e5a81ed2edca5121087ee72d94fae08aef4d14a71a765bdb007a257feaf13e01007948bcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\.git\config

Filesize
93B

MD5
e4f821133b798a11df61c827e289815e

SHA1
0cef25acc2a94c540e22062dd871597dcfd70da5

SHA256
9dbbdbab1e106f5322578649b8582428f176266c5233a549a0b2da9213253741

SHA512
b844622db54e59e1fea13d3ce08cae7c0329ce44eed3d7772fef5cab90c2dbd5bfc33642afd2e553c25624f2da49a50a14327e2fc715e2fe5549cd39948dfc64

Download Submit
C:\Users\Admin\AppData\Local\Temp\.git\config

Filesize
111B

MD5
f3eeff3fabaf2bf6afd509406aafbae8

SHA1
a9637c217a90dab2be93ab8bd0e332683b243d04

SHA256
ff399a979951677457048a4112441f7262fbe8b69eb344592ff160259c44dd62

SHA512
0b819eae0cc382da3110434c43c097a5d148938865ece160d3da660a5d00c4e26efb98b08b6385d8194cf1fa74e04f432ff231d65e3116a0d75cd0df519b9450

Download Submit
C:\Users\Admin\AppData\Local\Temp\.git\objects\pack\tmp_pack_NqeolG

Filesize
30.2MB

MD5
55b53a871783f250f8767c02c006cf62

SHA1
28aeea8f07f7bfc1c1179b961dedeeb79471779d

SHA256
44ed67692373951a747e9e297cf6d8b96d235c5436b126f91179a7f8573c5a2b

SHA512
b6ee72de962f8a3f59d2bb651a3196eecd45b208fa8ac1317a27001269b98bb50f5212d32ebf9dd9b9a1badb871a19551c572c2a20d3e01de917d3425319dc34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\0V2XRVCM.1TN\4W6929M6.XLZ\InfiniteFusionApp.exe.manifest

Filesize
18KB

MD5
c164057a65f4f52f8a41292a84495ec2

SHA1
f59d1fe65d466ed080acda3d34e864e498d1d892

SHA256
8b884837160c2ec246231a941692fd1c5bd27da7add37d50275d58adc3ef3afa

SHA512
ceed342cf7ddf7084e5aedd958975ba96cba2bb23334ba41af7efe249cbb3f21f7e98cce4fda5e8dff61701af0ae1c1b22aa6330ce593a4c2fad856c45f0a49a

Download Submit
C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\cmd\git.exe

Filesize
43KB

MD5
0856ef2b08003730e062398c74acdee1

SHA1
3711eb6092fdf075c20c07ca139b5981036ce6ef

SHA256
f4f1ff2df52c33239013f8cac4047696a380b02b7790c69895bcf8fd81ea7bb6

SHA512
d20037d61dedc1a2b5194df8ca5c827832f0749041d495f1fdef206ed855a7a22efac8546187bf8f90a3cb087171d27d8e4e9424de4dec7ff21c7e7421457ff3

Download Submit
C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\etc\gitconfig

Filesize
434B

MD5
75d20ee160b8737a88f20fa75c37de04

SHA1
0f533dd5128a8fbf5daa9c68a5cf6c46565d88e5

SHA256
a8570f5efedf6188c9133624720cf9a5ea409d84852df172f4a5f5f9bf1561fd

SHA512
b88b16f7d6bb1c06310e0b1741c1a698dab12737e490fc37edf81eab879f6ddeb864b3ea3a6e3506974f94d0cf4dec4d3d412faa9bca9b8b3d3b0f3361a8a319

Download Submit
C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\git-upload-pack.exe

Filesize
44KB

MD5
4290fcf12ae1fd71d1e00486c80c7a2e

SHA1
02db3c84f6865c4d4a1d02e13e01e0acbdf0602f

SHA256
2bcb0c999675c2ab5a96069f5e851d7f45bba1ee549204b36c234ff29697c1fd

SHA512
e0a7bb7a7ace516514beb53cd8206b3b5b5e28831ddf44bb80ae31e5a2471540b7405598914683ea3bfa6ef1455e0d59a284ee4676c310618145967eace3f29f

Download Submit
C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\git.exe

Filesize
3.7MB

MD5
9171252c8b061a99f43d681b04896b0b

SHA1
488fa398e6ba0c07288facc37897b285c8079c60

SHA256
14770aa3ed5426e6fab3bf897d07e1381b8ddf24edd54aad098ba072cc30b9bd

SHA512
1572713502ba3aa24fab48b8f482b1a809d984f41290c1089f6972f33eb035a2ade9775ed5bf163b87fef0bc3a8df54d7fd1de454193d77ca4b7c4748690e613

Download Submit
C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\libiconv-2.dll

Filesize
1.1MB

MD5
263263b8395e0c8f153aae906fad2115

SHA1
b427c166e72d0fe1e2d4c243f245670833678593

SHA256
55de11531dc0e566cb91f26e48d1301a161a4b8b24abed42304d711412368760

SHA512
99339321ebf22515dfb8ac38978e1fccb31ea33370afd55f86f6ef7441e2096cef47c1e23bc059ee47059afb10c0523e4605ccf555843d59077c1218ec444140

Download Submit
C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\libintl-8.dll

Filesize
137KB

MD5
b14f928937e24087a3a4d7b0abc9ac84

SHA1
c8402d666433943a556d27c4ecd9b0a66d390feb

SHA256
56a5148d00c2d9e58415be2d64eca922a58063fe26d9af1c87084aa383c9058e

SHA512
f7bc1886f2355c5ed1ed8799cd159bd1c56207eecc938318447e64e4bf73fc6afe0501803c149140afa4ddb942355835437b25b84900c31c64ca48d765f4a203

Download Submit
C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\libpcre2-8-0.dll

Filesize
622KB

MD5
dcd15cd0f3a26756c1606bf90eff8009

SHA1
940354c6a9a705c2e453ed964535b29c30410e38

SHA256
19588e6a318894abe8094374bee233e666f319de909c69f12a6047b14473e299

SHA512
db5b690572ec24d3487db08203cc5a21d2cfa1719b8ac63241f941c829d06ea32705016be3777087e29f32952cbac7b81ac8fe89bf3581dc6022777d025b9da1

Download Submit
C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\libwinpthread-1.dll

Filesize
59KB

MD5
41b72927c053b5067f3dbc236e1287b0

SHA1
4b0f54f1a3e6c98e073cce9f135e96263c72c0f2

SHA256
0d0d8f2eaff6b5f75e63d9721d5a0480b30e70792fe0d3a24d76fd3e61b05982

SHA512
e7b02161725dc03c6fff1c1669fd99968e9caff3090e59da3fa93122ece42a334f2bd79136d87c93439ca13f092bb6ca0ed717f1860a3773d04001b2d6429299

Download Submit
C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\bin\zlib1.dll

Filesize
117KB

MD5
5e14e5dc82041df0f2274183cdc72106

SHA1
e41c7680266d2653e16412e30b6dfec18abfd31c

SHA256
83ee0ff920144edb2c2f4ea10130f55443493290886985a63233fa2431e450f9

SHA512
0f9a64b2ea07c65dfb6a46b804caf1d9d9c6dfe8af4c8dd471f26a2af745ff10f45ca722c944ea69fd434ccb158b2eb68175ed07799568652db212bcd591a45f

Download Submit
C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\share\licenses\libtasn1\COPYING

Filesize
34KB

MD5
d32239bcb673463ab874e80d47fae504

SHA1
8624bcdae55baeef00cd11d5dfcfa60f68710a02

SHA256
8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903

SHA512
7633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\REQUIRED_BY_INSTALLER_UPDATER\mingw64\share\licenses\libtasn1\COPYING.LESSER

Filesize
25KB

MD5
4fbd65380cdd255951079008b364516c

SHA1
01a6b4bf79aca9b556822601186afab86e8c4fbf

SHA256
dc626520dcd53a22f727af3ee42c770e56c97a64fe3adb063799d8ab032fe551

SHA512
1bca76c9f2f559a7851c278650125cd4f44a7ae4a96ceee6a6ba81d34d28fe7d6125c5ee459fef729b6a2a0eba3075c0841c8a156b3a26f66194f77f7d49151c

Download Submit
C:\Users\Admin\AppData\Roaming\spriteInstaller\InfiniteFusionApp\InfiniteFusionUpdater.bat

Filesize
2KB

MD5
b440474e0461a14e3726b55053e15c07

SHA1
e96e2abc3289b26a6dea94a36d84365ffb831a8a

SHA256
24efba9537f7a294e7a1e6667ad98079ccf8ada94e6559fb29935fda84b3b799

SHA512
aacd3df37f04a2cbc2db450bb3bddc3e7a5692a4d46ce1cd923fd65b1b2febae312292811e891903a18e101b05670857c96af9f5b37a617c03f7b623c4f56ee9

Download Submit
C:\Users\Admin\AppData\Roaming\spriteInstaller\InfiniteFusionApp\Lib\Application Files\InfiniteFusionApp_2_9_7_1\MinGit\7-zip.dll.deploy

Filesize
99KB

MD5
956d826f03d88c0b5482002bb7a83412

SHA1
560658185c225d1bd274b6a18372fd7de5f336af

SHA256
f9b4944d3a5536a6f8b4d5db17d903988a3518b22fbee6e3f6019aaf44189b3d

SHA512
6503064802101bca6e25b259a2bfe38e2d8b786bf2cf588ab1fb026b755f04a20857ee27e290cf50b2667425c528313b1c02e09b7b50edbcd75a3335439c3647

Download Submit
C:\Users\Admin\AppData\Roaming\spriteInstaller\InfiniteFusionApp\Lib\Application Files\InfiniteFusionApp_2_9_7_1\MinGit\7z.dll.deploy

Filesize
1.8MB

MD5
4e35a902ca8ed1c3d4551b1a470c4655

SHA1
ad9a9b5dbe810a6d7ea2c8430c32417d87c5930c

SHA256
77222e81cb7004e8c3e077aada02b555a3d38fb05b50c64afd36ca230a8fd5b9

SHA512
c7966f892c1f81fbe6a2197bd229904d398a299c53c24586ca77f7f657529323e5a7260ed32da9701fce9989b0b9a2463cd45c5a5d77e56a1ea670e02e575a30

Download Submit
C:\Users\Admin\AppData\Roaming\spriteInstaller\InfiniteFusionApp\Lib\Application Files\InfiniteFusionApp_2_9_7_1\MinGit\7z.exe.deploy

Filesize
544KB

MD5
9a1dd1d96481d61934dcc2d568971d06

SHA1
f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

SHA256
8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

SHA512
7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

Download Submit
C:\Users\Admin\AppData\Roaming\spriteInstaller\InfiniteFusionApp\Lib\Application Files\InfiniteFusionApp_2_9_7_1\MinGit\MinGit.7z.deploy

Filesize
23.5MB

MD5
23e8a10acd61d54b1ce699ec9ef1c0a0

SHA1
ab3f37bdd62bac9e01287a466baef8e5013a7055

SHA256
9404f5285903cc09d4095d0b565a24d3451a68c0251c792c05c8c315afcdbf8e

SHA512
6d1a28cdb9febcd10b234af0efca9b65a30c674e0904a19800f269d72a2cbff33893115ed575c0d63a480505efa8c1e141208d2be2958f1ffe2f874655e941ba

Download Submit
C:\Users\Admin\AppData\Roaming\spriteInstaller\InfiniteFusionApp\Lib\InfiniteFusionApp.application

Filesize
5KB

MD5
d7a4fd56d52d3ab508640a7802c14502

SHA1
498ff5f97892b487a598cb47ee1e86e0ea86cc2d

SHA256
c67e73b2bca46280486ebb462fdeef0c4b58f756f3277a85ecbd554afd83d4b2

SHA512
d6a55e0f364ddc368c966fc54d845ebb8424bbe130cd57e2db26037aac90cb6164644db47ff28a0150bb255151d49c872497961caafd2d7176f2785c03a98c64

Download Submit
memory/532-788-0x00007FF7627A0000-0x00007FF7627F2000-memory.dmp

Filesize
328KB

Download
memory/540-708-0x00007FF7627A0000-0x00007FF7627F2000-memory.dmp

Filesize
328KB

Download
memory/696-855-0x00007FFB574E0000-0x00007FFB575F9000-memory.dmp

Filesize
1.1MB

Download
memory/812-834-0x00007FF6C3A60000-0x00007FF6C3E80000-memory.dmp

Filesize
4.1MB

Download
memory/812-839-0x00007FFB657D0000-0x00007FFB657F4000-memory.dmp

Filesize
144KB

Download
memory/812-838-0x00007FFB6F620000-0x00007FFB6F636000-memory.dmp

Filesize
88KB

Download
memory/812-837-0x00007FFB57430000-0x00007FFB574D4000-memory.dmp

Filesize
656KB

Download
memory/812-836-0x00007FFB65F70000-0x00007FFB65F99000-memory.dmp

Filesize
164KB

Download
memory/812-835-0x00007FFB574E0000-0x00007FFB575F9000-memory.dmp

Filesize
1.1MB

Download
memory/964-768-0x00007FF7627A0000-0x00007FF7627F2000-memory.dmp

Filesize
328KB

Download
memory/1364-763-0x00007FFB574E0000-0x00007FFB575F9000-memory.dmp

Filesize
1.1MB

Download
memory/1364-762-0x00007FF6C3A60000-0x00007FF6C3E80000-memory.dmp

Filesize
4.1MB

Download
memory/1364-767-0x00007FFB657D0000-0x00007FFB657F4000-memory.dmp

Filesize
144KB

Download
memory/1364-765-0x00007FFB57430000-0x00007FFB574D4000-memory.dmp

Filesize
656KB

Download
memory/1364-764-0x00007FFB65F70000-0x00007FFB65F99000-memory.dmp

Filesize
164KB

Download
memory/1364-766-0x00007FFB6F620000-0x00007FFB6F636000-memory.dmp

Filesize
88KB

Download
memory/1444-743-0x00007FFB56870000-0x00007FFB56989000-memory.dmp

Filesize
1.1MB

Download
memory/1444-745-0x00007FFB57490000-0x00007FFB57534000-memory.dmp

Filesize
656KB

Download
memory/1444-744-0x00007FFB661A0000-0x00007FFB661C9000-memory.dmp

Filesize
164KB

Download
memory/1444-742-0x00007FF6C3A60000-0x00007FF6C3E80000-memory.dmp

Filesize
4.1MB

Download
memory/1444-746-0x00007FFB66470000-0x00007FFB66486000-memory.dmp

Filesize
88KB

Download
memory/1444-747-0x00007FFB65F70000-0x00007FFB65F94000-memory.dmp

Filesize
144KB

Download
memory/1572-823-0x00007FFB574E0000-0x00007FFB575F9000-memory.dmp

Filesize
1.1MB

Download
memory/1572-824-0x00007FFB65F70000-0x00007FFB65F99000-memory.dmp

Filesize
164KB

Download
memory/1572-827-0x00007FFB657D0000-0x00007FFB657F4000-memory.dmp

Filesize
144KB

Download
memory/1572-826-0x00007FFB6F620000-0x00007FFB6F636000-memory.dmp

Filesize
88KB

Download
memory/1572-825-0x00007FFB57430000-0x00007FFB574D4000-memory.dmp

Filesize
656KB

Download
memory/1572-822-0x00007FF6C3A60000-0x00007FF6C3E80000-memory.dmp

Filesize
4.1MB

Download
memory/1632-722-0x00007FF6C3A60000-0x00007FF6C3E80000-memory.dmp

Filesize
4.1MB

Download
memory/1632-726-0x00007FFB6F620000-0x00007FFB6F636000-memory.dmp

Filesize
88KB

Download
memory/1632-723-0x00007FFB574E0000-0x00007FFB575F9000-memory.dmp

Filesize
1.1MB

Download
memory/1632-725-0x00007FFB57430000-0x00007FFB574D4000-memory.dmp

Filesize
656KB

Download
memory/1632-724-0x00007FFB66380000-0x00007FFB663A9000-memory.dmp

Filesize
164KB

Download
memory/1632-727-0x00007FFB661A0000-0x00007FFB661C4000-memory.dmp

Filesize
144KB

Download
memory/1840-840-0x00007FF7627A0000-0x00007FF7627F2000-memory.dmp

Filesize
328KB

Download
memory/2572-808-0x00007FF7627A0000-0x00007FF7627F2000-memory.dmp

Filesize
328KB

Download
memory/2908-728-0x00007FF7627A0000-0x00007FF7627F2000-memory.dmp

Filesize
328KB

Download
memory/3044-850-0x00007FF7627A0000-0x00007FF7627F2000-memory.dmp

Filesize
328KB

Download
memory/3056-787-0x00007FFB657D0000-0x00007FFB657F4000-memory.dmp

Filesize
144KB

Download
memory/3056-786-0x00007FFB6F620000-0x00007FFB6F636000-memory.dmp

Filesize
88KB

Download
memory/3056-785-0x00007FFB57430000-0x00007FFB574D4000-memory.dmp

Filesize
656KB

Download
memory/3056-784-0x00007FFB65F70000-0x00007FFB65F99000-memory.dmp

Filesize
164KB

Download
memory/3056-783-0x00007FFB574E0000-0x00007FFB575F9000-memory.dmp

Filesize
1.1MB

Download
memory/3056-782-0x00007FF6C3A60000-0x00007FF6C3E80000-memory.dmp

Filesize
4.1MB

Download
memory/3976-704-0x00007FFB66380000-0x00007FFB663A9000-memory.dmp

Filesize
164KB

Download
memory/3976-703-0x00007FFB574E0000-0x00007FFB575F9000-memory.dmp

Filesize
1.1MB

Download
memory/3976-707-0x00007FFB6F620000-0x00007FFB6F636000-memory.dmp

Filesize
88KB

Download
memory/3976-706-0x00007FFB661A0000-0x00007FFB661C4000-memory.dmp

Filesize
144KB

Download
memory/3976-705-0x00007FFB57430000-0x00007FFB574D4000-memory.dmp

Filesize
656KB

Download
memory/3976-702-0x00007FF6C3A60000-0x00007FF6C3E80000-memory.dmp

Filesize
4.1MB

Download
memory/4004-748-0x00007FF7627A0000-0x00007FF7627F2000-memory.dmp

Filesize
328KB

Download
memory/4232-1267-0x00000147F0910000-0x00000147F0960000-memory.dmp

Filesize
320KB

Download
memory/4232-1264-0x00000147EF4D0000-0x00000147EF656000-memory.dmp

Filesize
1.5MB

Download
memory/4232-1263-0x00000147D4E30000-0x00000147D4E38000-memory.dmp

Filesize
32KB

Download
memory/4336-849-0x00007FFB57EA0000-0x00007FFB57EC4000-memory.dmp

Filesize
144KB

Download
memory/4336-845-0x00007FFB574E0000-0x00007FFB575F9000-memory.dmp

Filesize
1.1MB

Download
memory/4336-848-0x00007FFB6F620000-0x00007FFB6F636000-memory.dmp

Filesize
88KB

Download
memory/4336-844-0x00007FF6C3A60000-0x00007FF6C3E80000-memory.dmp

Filesize
4.1MB

Download
memory/4336-846-0x00007FFB58130000-0x00007FFB58159000-memory.dmp

Filesize
164KB

Download
memory/4336-847-0x00007FFB57430000-0x00007FFB574D4000-memory.dmp

Filesize
656KB

Download
memory/4452-828-0x00007FF7627A0000-0x00007FF7627F2000-memory.dmp

Filesize
328KB

Download
memory/4772-803-0x00007FFB574E0000-0x00007FFB575F9000-memory.dmp

Filesize
1.1MB

Download
memory/4772-804-0x00007FFB65F70000-0x00007FFB65F99000-memory.dmp

Filesize
164KB

Download
memory/4772-802-0x00007FF6C3A60000-0x00007FF6C3E80000-memory.dmp

Filesize
4.1MB

Download
memory/4772-805-0x00007FFB57430000-0x00007FFB574D4000-memory.dmp

Filesize
656KB

Download
memory/4772-806-0x00007FFB6F620000-0x00007FFB6F636000-memory.dmp

Filesize
88KB

Download
memory/4772-807-0x00007FFB657D0000-0x00007FFB657F4000-memory.dmp

Filesize
144KB

Download