Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-05-2024 13:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    af88d495c9805d9cf5b9d5781e07893d355159fd4a1fbf71cbe3c7682ceba114.exe

  • Size

    1.8MB

  • MD5

    9af0e06ba3a31d47c46029dd26335f3a

  • SHA1

    d953a6ea03d5ffe43185cc108285b67d4fdbe0bc

  • SHA256

    af88d495c9805d9cf5b9d5781e07893d355159fd4a1fbf71cbe3c7682ceba114

  • SHA512

    55b3eb3fba2323297a275c2e18ac4cfb19fdb2e87df7775e9ffc5c925cfa1d7adab149745ffa5220d4adec9261390b723e21e00aff3043f04275fb99b3f7e179

  • SSDEEP

    49152:aogPtgPhwGy2PM9mwpvQYeDSZYvJjfNF3:azI+GJQpxif73

Score
10/10
amadeylummaredlinesectopratstealcxmrigxworm1@logscloudyt_botc767c0viczzvvdiscoveryevasionexecutioninfostealerminerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.20

Botnet

c767c0

C2

http://5.42.96.7

Attributes
  • install_dir

    7af68cdb52

  • install_file

    axplons.exe

  • strings_key

    e2ce58e78f631ed97d01fe7b70e85d5e

  • url_paths

    /zamo7h/index.php

rc4.plain

Extracted

Family

redline

Botnet

@LOGSCLOUDYT_BOT

C2

185.172.128.33:8970

Extracted

Family

redline

Botnet

1

C2

185.215.113.67:26260

Extracted

Family

stealc

Botnet

zzvv

C2

http://23.88.106.134

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

xworm

C2

127.0.0.1:7000

beshomandotestbesnd.run.place:7000
Attributes
  • Install_directory

    %ProgramData%

  • install_file

    taskmgr.exe

  • telegram

    https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672

Extracted

Family

redline

Botnet

Vic

C2

beshomandotestbesnd.run.place:1111

Extracted

Family

lumma

C2

https://civilianurinedtsraov.shop/api

https://museumtespaceorsp.shop/api

https://buttockdecarderwiso.shop/api

https://averageaattractiionsl.shop/api

https://femininiespywageg.shop/api

https://employhabragaomlsp.shop/api

https://stalfbaclcalorieeis.shop/api

https://roomabolishsnifftwk.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect Xworm Payload 2 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 6 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 2 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 2 IoCs
    evasiontrojan
  • XMRig Miner payload 2 IoCs
    miner
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • .NET Reactor proctector 20 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 41 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 45 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\af88d495c9805d9cf5b9d5781e07893d355159fd4a1fbf71cbe3c7682ceba114.exe
    "C:\Users\Admin\AppData\Local\Temp\af88d495c9805d9cf5b9d5781e07893d355159fd4a1fbf71cbe3c7682ceba114.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1552
    • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
      "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4316
      • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
        "C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:5016
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Checks computer location settings
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2084
          • C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
            "C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"
            5⤵
            • Executes dropped EXE
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1424
          • C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
            "C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2472
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
            5⤵
              PID:6120
              • C:\Windows\SysWOW64\choice.exe
                choice /C Y /N /D Y /T 3
                6⤵
                  PID:1672
          • C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe
            "C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1016
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
                PID:3580
            • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
              "C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4536
            • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
              "C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of WriteProcessMemory
              PID:2728
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:4252
                • C:\Windows\SysWOW64\sc.exe
                  Sc stop GameServerClient
                  5⤵
                  • Launches sc.exe
                  PID:3164
                • C:\Program Files (x86)\GameSyncLink\GameService.exe
                  GameService remove GameServerClient confirm
                  5⤵
                  • Executes dropped EXE
                  PID:4776
                • C:\Windows\SysWOW64\sc.exe
                  Sc delete GameSyncLink
                  5⤵
                  • Launches sc.exe
                  PID:2684
                • C:\Program Files (x86)\GameSyncLink\GameService.exe
                  GameService remove GameSyncLink confirm
                  5⤵
                  • Executes dropped EXE
                  PID:1972
                • C:\Program Files (x86)\GameSyncLink\GameService.exe
                  GameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:3580
                • C:\Program Files (x86)\GameSyncLink\GameService.exe
                  GameService start GameSyncLink
                  5⤵
                  • Executes dropped EXE
                  PID:3040
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "
                4⤵
                  PID:4292
                  • C:\Windows\SysWOW64\sc.exe
                    Sc stop GameServerClientC
                    5⤵
                    • Launches sc.exe
                    PID:4344
                  • C:\Program Files (x86)\GameSyncLink\GameService.exe
                    GameService remove GameServerClientC confirm
                    5⤵
                    • Executes dropped EXE
                    PID:3756
                  • C:\Windows\SysWOW64\sc.exe
                    Sc delete PiercingNetLink
                    5⤵
                    • Launches sc.exe
                    PID:3136
                  • C:\Program Files (x86)\GameSyncLink\GameService.exe
                    GameService remove PiercingNetLink confirm
                    5⤵
                    • Executes dropped EXE
                    PID:4260
                  • C:\Program Files (x86)\GameSyncLink\GameService.exe
                    GameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:1580
                  • C:\Program Files (x86)\GameSyncLink\GameService.exe
                    GameService start PiercingNetLink
                    5⤵
                    • Executes dropped EXE
                    PID:4352
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "
                  4⤵
                    PID:5100
                    • C:\Windows\SysWOW64\sc.exe
                      Sc delete GameSyncLinks
                      5⤵
                      • Launches sc.exe
                      PID:4912
                    • C:\Program Files (x86)\GameSyncLink\GameService.exe
                      GameService remove GameSyncLinks confirm
                      5⤵
                      • Executes dropped EXE
                      PID:5444
                    • C:\Program Files (x86)\GameSyncLink\GameService.exe
                      GameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                      5⤵
                      • Executes dropped EXE
                      PID:5728
                    • C:\Program Files (x86)\GameSyncLink\GameService.exe
                      GameService start GameSyncLinks
                      5⤵
                      • Executes dropped EXE
                      PID:4960
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
                    4⤵
                      PID:5508
                  • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe"
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of WriteProcessMemory
                    PID:1748
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      4⤵
                      • Loads dropped DLL
                      • Checks processor information in registry
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4752
                  • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:1184
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      4⤵
                        PID:4232
                    • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"
                      3⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      PID:3200
                      • C:\Windows\SysWOW64\schtasks.exe
                        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F
                        4⤵
                        • Creates scheduled task(s)
                        PID:2012
                    • C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe"
                      3⤵
                      • UAC bypass
                      • Windows security bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Windows security modification
                      • Checks whether UAC is enabled
                      • Suspicious use of SetThreadContext
                      • System policy modification
                      PID:1300
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe" -Force
                        4⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5896
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
                        4⤵
                        • Suspicious use of UnmapMainImage
                        PID:5904
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 5904 -s 20
                          5⤵
                          • Program crash
                          PID:5984
                    • C:\Users\Admin\AppData\Local\Temp\1000052001\ReurgingGleek.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000052001\ReurgingGleek.exe"
                      3⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1580
                      • C:\ProgramData\system.exe
                        "C:\ProgramData\system.exe"
                        4⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Suspicious behavior: AddClipboardFormatListener
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetWindowsHookEx
                        PID:5492
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\system.exe'
                          5⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5292
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'system.exe'
                          5⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2616
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\taskmgr.exe'
                          5⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:6104
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskmgr.exe'
                          5⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5268
                        • C:\Windows\System32\schtasks.exe
                          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "taskmgr" /tr "C:\ProgramData\taskmgr.exe"
                          5⤵
                          • Creates scheduled task(s)
                          PID:60
                      • C:\ProgramData\build.exe
                        "C:\ProgramData\build.exe"
                        4⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5572
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 1312
                        4⤵
                        • Program crash
                        PID:5788
                    • C:\Users\Admin\AppData\Local\Temp\1000065001\gold.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000065001\gold.exe"
                      3⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:5648
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        4⤵
                          PID:5848
                  • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                    C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4352
                  • C:\Program Files (x86)\GameSyncLink\GameService.exe
                    "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                    1⤵
                    • Executes dropped EXE
                    PID:2880
                    • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                      "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                      2⤵
                      • Executes dropped EXE
                      PID:336
                      • C:\Windows\Temp\753772.exe
                        "C:\Windows\Temp\753772.exe" --list-devices
                        3⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:2664
                  • C:\Program Files (x86)\GameSyncLink\GameService.exe
                    "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                    1⤵
                    • Executes dropped EXE
                    PID:1336
                    • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                      "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                      2⤵
                      • Executes dropped EXE
                      PID:3520
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1580 -ip 1580
                    1⤵
                      PID:5692
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5904 -ip 5904
                      1⤵
                        PID:5924
                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                        "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                        1⤵
                        • Executes dropped EXE
                        PID:5320
                        • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                          "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                          2⤵
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          PID:4540
                          • C:\Windows\Temp\80162.exe
                            "C:\Windows\Temp\80162.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 83dQM82bj4yY83XKGKHnbHTzqgY4FUt2pi1JS15u7rTs8v84mTU5ny5MiRoSeyduBUAQKFZ6MsvbMHYTisNeThDM3BqQ59y --coin XMR -t 1 --no-color -p x
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            PID:1512
                      • C:\Windows\System32\sihclient.exe
                        C:\Windows\System32\sihclient.exe /cv enMtF/dPeUe4hwPLKMfOYg.0.2
                        1⤵
                          PID:4352
                        • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                          C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1404
                        • C:\ProgramData\taskmgr.exe
                          C:\ProgramData\taskmgr.exe
                          1⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5860
                        • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                          C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                          1⤵
                          • Executes dropped EXE
                          PID:5752
                        • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                          C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2996
                        • C:\ProgramData\taskmgr.exe
                          C:\ProgramData\taskmgr.exe
                          1⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1380
                        • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                          C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                          1⤵
                          • Executes dropped EXE
                          PID:1364

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        1
                        T1059

                        PowerShell

                        1
                        T1059.001

                        Scheduled Task/Job

                        1
                        T1053

                        System Services

                        1
                        T1569

                        Service Execution

                        1
                        T1569.002

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Privilege Escalation

                        Abuse Elevation Control Mechanism

                        1
                        T1548

                        Bypass User Account Control

                        1
                        T1548.002

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Defense Evasion

                        Abuse Elevation Control Mechanism

                        1
                        T1548

                        Bypass User Account Control

                        1
                        T1548.002

                        Impair Defenses

                        4
                        T1562

                        Disable or Modify Tools

                        3
                        T1562.001

                        Modify Registry

                        6
                        T1112

                        Subvert Trust Controls

                        1
                        T1553

                        Install Root Certificate

                        1
                        T1553.004

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Credential Access

                        Unsecured Credentials

                        3
                        T1552

                        Credentials In Files

                        3
                        T1552.001

                        Discovery

                        Query Registry

                        7
                        T1012

                        System Information Discovery

                        5
                        T1082

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Lateral Movement

                        Collection

                        Data from Local System

                        3
                        T1005

                        Command and Control

                        Exfiltration

                        Impact

                        Service Stop

                        1
                        T1489

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Program Files (x86)\GameSyncLink\GameService.exe
                          Filesize

                          288KB

                          MD5

                          d9ec6f3a3b2ac7cd5eef07bd86e3efbc

                          SHA1

                          e1908caab6f938404af85a7df0f80f877a4d9ee6

                          SHA256

                          472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c

                          SHA512

                          1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

                          Download Submit
                        • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                          Filesize

                          2.5MB

                          MD5

                          e6943a08bb91fc3086394c7314be367d

                          SHA1

                          451d2e171f906fa6c43f8b901cd41b0283d1fa40

                          SHA256

                          aafdcfe5386452f4924cfcc23f2cf7eccf3f868947ad7291a77b2eca2af0c873

                          SHA512

                          505d3c76988882602f06398e747c4e496ecad9df1b7959069b87c8111c4d9118484f4d6baef5f671466a184c8caec362d635da210fa0987ccb746cbeea218d2a

                          Download Submit
                        • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                          Filesize

                          6.2MB

                          MD5

                          1bacbebf6b237c75dbe5610d2d9e1812

                          SHA1

                          3ca5768a9cf04a2c8e157d91d4a1b118668f5cf1

                          SHA256

                          c3747b167c70fd52b16fb93a4f815e7a4ee27cf67d2c7d55ea9d1edc7969c67d

                          SHA512

                          f6438eced6915890d5d15d853c3ad6856de949b7354dcea97b1cf40d0c8aed767c8e45730e64ab0368f3606da5e95fd1d4db9cc21e613d517f37ddebbd0fa1fe

                          Download Submit
                        • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                          Filesize

                          13.2MB

                          MD5

                          72b396a9053dff4d804e07ee1597d5e3

                          SHA1

                          5ec4fefa66771613433c17c11545c6161e1552d5

                          SHA256

                          d0b206f0f47a9f8593b6434dc27dadde8480a902e878882fa8c73fc7fe01b11d

                          SHA512

                          ad96c9ca2feae7af7fcf01a843d5aa6cbdde0520d68dedff44554a17639c6c66b2301d73daf272708cb76c22eae2d5c89db23af45105c4f0e35f4787f98e192b

                          Download Submit
                        • C:\Program Files (x86)\GameSyncLink\installc.bat
                          Filesize

                          301B

                          MD5

                          998ab24316795f67c26aca0f1b38c8ce

                          SHA1

                          a2a6dc94e08c086fe27f8c08cb8178e7a64f200d

                          SHA256

                          a468b43795f1083fb37b12787c5ff29f8117c26ac35af470084e00c48280442e

                          SHA512

                          7c9c2ade898a8defb6510ddd15730bec859d4474071eb6b8e8738ea6089764f81924ad2a6ebf0479d4fed7d61890edaa38f4bfbf70a4e6b30d33aa5bfc5b5c75

                          Download Submit
                        • C:\Program Files (x86)\GameSyncLink\installg.bat
                          Filesize

                          284B

                          MD5

                          5dee3cbf941c5dbe36b54690b2a3c240

                          SHA1

                          82b9f1ad3ca523f3794e052f7e67ecdcd1ae87e1

                          SHA256

                          98370b86626b8fd7a7cac96693348045b081326c49e2421113f49a5ea3588edb

                          SHA512

                          9ee431d485e2f09268a22b287b0960859d2f22db8c7e61309a042999c436b3de74f5d75837b739e01122a796ad65bc6468d009ec6ddf4962f4ff288155410556

                          Download Submit
                        • C:\Program Files (x86)\GameSyncLink\installm.bat
                          Filesize

                          218B

                          MD5

                          94b87b86dc338b8f0c4e5869496a8a35

                          SHA1

                          2584e6496d048068f61ac72f5c08b54ad08627c3

                          SHA256

                          2928d8e9a41f39d3802cfd2900d8edeb107666baa942d9c0ffbfd0234b5e5bfc

                          SHA512

                          b67eb73fe51d4dba990789f1e0123e902dac6d26569851c3d51ca0a575221ce317f973999d962669016017d8f81a01f11bd977609e66bb1b244334bce2db5d5d

                          Download Submit
                        • C:\ProgramData\build.exe
                          Filesize

                          95KB

                          MD5

                          16280875fdcf55ab4c8f1dff6dabc72e

                          SHA1

                          39880e6fbb258f4f4fa5c79337ec893acae55fb7

                          SHA256

                          91455ac8837ff1fdba7067cd3e7f790c1649ae70164ccbdf0483eae831a7253a

                          SHA512

                          53ba4e5e88a8f19ba3faa2f1244501c2d62827a9178ec0fdc995582e03e7d8e39f2dfd7bde11285781a65a021d4f4aab48b94be66a8a1cebbd47ab0cb819202e

                          Download Submit
                        • C:\ProgramData\mozglue.dll
                          Filesize

                          593KB

                          MD5

                          c8fd9be83bc728cc04beffafc2907fe9

                          SHA1

                          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                          SHA256

                          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                          SHA512

                          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                          Download Submit
                        • C:\ProgramData\nss3.dll
                          Filesize

                          2.0MB

                          MD5

                          1cc453cdf74f31e4d913ff9c10acdde2

                          SHA1

                          6e85eae544d6e965f15fa5c39700fa7202f3aafe

                          SHA256

                          ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                          SHA512

                          dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                          Download Submit
                        • C:\ProgramData\system.exe
                          Filesize

                          75KB

                          MD5

                          70b9f8ef4c4ce24fe372b292aebcd138

                          SHA1

                          5fd7ce9318727b27db0dd50effbb632686d53f8c

                          SHA256

                          15af516d88e83cfc8d3deebe7aeb9ccaebc558fc93544ef31b612113fcce907b

                          SHA512

                          b4658ccb665aa9f43cc049a51c477a0b314c5c13d254d648e34f9feca9feb06021bbf271857f73998e31cc7f877fa5457fbe7420beb58f3563fbfbe121a4cbad

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
                          Filesize

                          2.2MB

                          MD5

                          ebc2640384e061203dcf9efb12a67cd9

                          SHA1

                          3fb2340408a4a61647fefa97766f4f82d41069f7

                          SHA256

                          c7f29056f46d16f7500f5356adaa2ef637aaf5cade2b9a78f3bcd95c0e6ec207

                          SHA512

                          50f038e54234ca439d106cec8d2c7f48f9a1d93f396e5c4a5230215b4fa4e5277fe20fe8c7cdf798f0280f712d06b330d6552ae9160dd7fcb6c4cf1aa13ce173

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe
                          Filesize

                          474KB

                          MD5

                          e967f019b01357086d92181e6ee28e0b

                          SHA1

                          7f26480ea5ca0ee9481dfc0bea12194bd6f10283

                          SHA256

                          c69c17f4c6b2206437e7954c02424b80605d40e98c0adcad6839e170c94b1c82

                          SHA512

                          dd2abe993397cf9f117753fd71ed9f98c4952616ee30f10479fbc3dad93a88dcfbfd6b80083541c7a796936dd37667a0f178156bdf5c35abf76dd8b23015d88a

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
                          Filesize

                          304KB

                          MD5

                          9faf597de46ed64912a01491fe550d33

                          SHA1

                          49203277926355afd49393782ae4e01802ad48af

                          SHA256

                          0854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715

                          SHA512

                          ef8a7a8566eaf962c4e21d49d9c1583ed2cdc9c2751ce75133a9765d2fa6dc511fc6cc99ea871eb83d50bd08a31cb0b25c03f27b8e6f351861231910a6cf1a1e

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
                          Filesize

                          4.2MB

                          MD5

                          0f52e5e68fe33694d488bfe7a1a71529

                          SHA1

                          11d7005bd72cb3fd46f24917bf3fc5f3203f361f

                          SHA256

                          efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8

                          SHA512

                          238fbb1c04eef2f2005cb7abf0223e3cd062d9d2840966292e19dcaa495609e134a0bdc35389ae9925ecfc787a13772d3ac7b29058579f702bc849dd0343c400

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
                          Filesize

                          778KB

                          MD5

                          05b11e7b711b4aaa512029ffcb529b5a

                          SHA1

                          a8074cf8a13f21617632951e008cdfdace73bb83

                          SHA256

                          2aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa

                          SHA512

                          dde7b561ffb3b9fe71827be9313cd3b83900c3ce76b053d028e84223fba1b06035437b3860a74de7dc2f5d40f0b90bd7d60139701d752c803eb08f362a5d57ff

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
                          Filesize

                          1.2MB

                          MD5

                          56e7d98642cfc9ec438b59022c2d58d7

                          SHA1

                          26526f702e584d8c8b629b2db5d282c2125665d7

                          SHA256

                          a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383

                          SHA512

                          0be0b11de472029bd4e2268cddb5ddb381f7f275dfe50c47b9c836980e5cbfa7f71fe78804ef2180ee110ca9cf36944ec8b8b22babb31a1fc7a6585f79932a1f

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                          Filesize

                          418KB

                          MD5

                          0099a99f5ffb3c3ae78af0084136fab3

                          SHA1

                          0205a065728a9ec1133e8a372b1e3864df776e8c

                          SHA256

                          919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                          SHA512

                          5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
                          Filesize

                          1.1MB

                          MD5

                          b9809bd949c3bc586cdee24b1a6de3df

                          SHA1

                          25bbf7f47a779cdce30f67b51b4cfbc2a2e30d7c

                          SHA256

                          79bb1f7b467bbceed03d27d325a0c076943f57d696d96d0d1178a2b750a931a8

                          SHA512

                          f54dee552c57d6537042a7f53c0c637eb400833fc16f5bb03152abbc743160165cd6cb13017294f37f6c60fff86f19ad50e33eb44dd6036654206200002ff7a2

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\1000052001\ReurgingGleek.exe
                          Filesize

                          596KB

                          MD5

                          1d3535cc01b2cc54b808a55e945707a0

                          SHA1

                          a9a563b8ee37f17c847248bb207b28086d9f4628

                          SHA256

                          f5faa2b827aaae846580fe313cfc3562fcf04dbf26320c7190247621c7e10f19

                          SHA512

                          4c344a2abc7ace17a3fced1e3fcf09ac959b47d8bc1a5bf4280d46c3dccd015254a42ce722f93bbbe28f9866696db685df6209b4e863fa9e02772753eeb2ebbc

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\1000065001\gold.exe
                          Filesize

                          460KB

                          MD5

                          c49297876753f4cd93461e26db8b586e

                          SHA1

                          ca9e6c59d61709585867a41de09429542c380a36

                          SHA256

                          74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b

                          SHA512

                          8cdb0953e129b0bb74d946d304ad9b21c0365b85b0db378ba568057c30234ec1ce0e18cc26d25fc70180680928051ba2b6829768bdd714286fcb1d359d0f00d3

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                          Filesize

                          1.8MB

                          MD5

                          9af0e06ba3a31d47c46029dd26335f3a

                          SHA1

                          d953a6ea03d5ffe43185cc108285b67d4fdbe0bc

                          SHA256

                          af88d495c9805d9cf5b9d5781e07893d355159fd4a1fbf71cbe3c7682ceba114

                          SHA512

                          55b3eb3fba2323297a275c2e18ac4cfb19fdb2e87df7775e9ffc5c925cfa1d7adab149745ffa5220d4adec9261390b723e21e00aff3043f04275fb99b3f7e179

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\Tmp60BD.tmp
                          Filesize

                          2KB

                          MD5

                          1420d30f964eac2c85b2ccfe968eebce

                          SHA1

                          bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                          SHA256

                          f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                          SHA512

                          6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cvd5hzgd.hx1.ps1
                          Filesize

                          60B

                          MD5

                          d17fe0a3f47be24a6453e9ef58c94641

                          SHA1

                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                          SHA256

                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                          SHA512

                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                          Download Submit
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-540404634-651139247-2967210625-1000\76b53b3ec448f7ccdda2063b15d2bfc3_41e50f4a-4a76-42e1-a3df-51306e426307
                          Filesize

                          2KB

                          MD5

                          2f2c86a05df04d493ea2f0d9a11a6d5e

                          SHA1

                          ec98edd68e60324687b42972e0f0697d61748ec8

                          SHA256

                          939cf35ef855a39e1ddc3dc1bdf70b96b853ccc2a29872d9d8a674ddd424e1e7

                          SHA512

                          5bad57eb450d9368ee2e54cad7d96b77166055807b59364b68b45a43d1c17f3bf096856046f94ac9e740b2e1979b46555d58d5e74a6e5bc132d335213e0ae292

                          Download Submit
                        • C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
                          Filesize

                          408KB

                          MD5

                          816df4ac8c796b73a28159a0b17369b6

                          SHA1

                          db8bbb6f73fab9875de4aaa489c03665d2611558

                          SHA256

                          7843255bc50ddda8c651f51347313daf07e53a745d39cc61d708c6e7d79b3647

                          SHA512

                          7dd155346acf611ffaf6399408f6409146fd724d7d382c7e143e3921e3d109563c314a0367a378b0965e427470f36bf6d70e1586d695a266f34aebd789965285

                          Download Submit
                        • C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
                          Filesize

                          304KB

                          MD5

                          15a7cae61788e4718d3c33abb7be6436

                          SHA1

                          62dac3a5d50c93c51f2ab4a5ebf78837dc7d3a9f

                          SHA256

                          bed71147aa297d95d2e2c67352fc06f7f631af3b7871ea148638ae66fc41e200

                          SHA512

                          5b3e3028523e95452be169bdfb966cd03ea5dbe34b7b98cf7482ca91b8317a0f4de224751d5a530ec23e72cbd6cc8e414d2d3726fefee9c30feab69dc348fa45

                          Download Submit
                        • C:\Users\Public\Desktop\Google Chrome.lnk
                          Filesize

                          2KB

                          MD5

                          eff701b29dfa0eb5787c20cdb6fe7436

                          SHA1

                          4c9f3d195a36cb0d28ccc13ed7d1e643763d1fd3

                          SHA256

                          52bf8f24a8d9e9c646163b17aa341cf387af9e23b9a7f6ed7456802a6a1855d2

                          SHA512

                          4700e23c46e0bcddef4400158f0a1a6accc011455527bc194a148d5615794e8c99ed57e3cfea4f956f0b6e0e2e3c54a9da1506549de6d455429e43cece280b1d

                          Download Submit
                        • C:\Users\Public\Desktop\Microsoft Edge.lnk
                          Filesize

                          2KB

                          MD5

                          f96fcb15806908bfb4f0e7f82f6d9985

                          SHA1

                          6153248783e11de1637e6c98af64f251d471e8ae

                          SHA256

                          81c3d3eedff493979a8966002fc6537e3c610d46f75d21f1b1073137b4486332

                          SHA512

                          4a1d3c3377ba4acb74387941955108db8c401e748f5f19352eff1d0eb951f053408dc20af38acb37517bdcb67b59bdfc41fd31d1f954b2b0826aaef0056d48e5

                          Download Submit
                        • C:\Windows\Temp\753772.exe
                          Filesize

                          2.0MB

                          MD5

                          5c9e996ee95437c15b8d312932e72529

                          SHA1

                          eb174c76a8759f4b85765fa24d751846f4a2d2ef

                          SHA256

                          0eecdbfabaaef36f497e944a6ceb468d01824f3ae6457b4ae4b3ac8e95eebb55

                          SHA512

                          935102aad64da7eeb3e4b172488b3a0395298d480f885ecedc5d8325f0a9eabeea8ba1ece512753ac170a03016c80ba4990786ab608b4de0b11e6343fbf2192b

                          Download Submit
                        • C:\Windows\Temp\cudart64_101.dll
                          Filesize

                          398KB

                          MD5

                          1d7955354884a9058e89bb8ea34415c9

                          SHA1

                          62c046984afd51877ecadad1eca209fda74c8cb1

                          SHA256

                          111f216aef35f45086888c3f0a30bb9ab48e2b333daeddafd3a76be037a22a6e

                          SHA512

                          7eb8739841c476cda3cf4c8220998bc8c435c04a89c4bbef27b8f3b904762dede224552b4204d35935562aa73f258c4e0ddb69d065f732cb06cc357796cdd1b2

                          Download Submit
                        • memory/1016-82-0x0000000000DC0000-0x0000000000DC1000-memory.dmp
                          Filesize

                          4KB

                          Download
                        • memory/1184-290-0x0000000000FA0000-0x0000000000FA1000-memory.dmp
                          Filesize

                          4KB

                          Download
                        • memory/1300-341-0x00000276062F0000-0x00000276062FE000-memory.dmp
                          Filesize

                          56KB

                          Download
                        • memory/1300-536-0x000002761EC00000-0x000002761EC5C000-memory.dmp
                          Filesize

                          368KB

                          Download
                        • memory/1404-632-0x0000000000990000-0x0000000000E3B000-memory.dmp
                          Filesize

                          4.7MB

                          Download
                        • memory/1404-634-0x0000000000990000-0x0000000000E3B000-memory.dmp
                          Filesize

                          4.7MB

                          Download
                        • memory/1424-104-0x0000000006020000-0x000000000603E000-memory.dmp
                          Filesize

                          120KB

                          Download
                        • memory/1424-103-0x0000000005730000-0x00000000057A6000-memory.dmp
                          Filesize

                          472KB

                          Download
                        • memory/1424-113-0x0000000006400000-0x000000000644C000-memory.dmp
                          Filesize

                          304KB

                          Download
                        • memory/1424-112-0x0000000006290000-0x00000000062CC000-memory.dmp
                          Filesize

                          240KB

                          Download
                        • memory/1424-111-0x0000000006230000-0x0000000006242000-memory.dmp
                          Filesize

                          72KB

                          Download
                        • memory/1424-110-0x00000000062F0000-0x00000000063FA000-memory.dmp
                          Filesize

                          1.0MB

                          Download
                        • memory/1424-78-0x0000000004F80000-0x0000000005524000-memory.dmp
                          Filesize

                          5.6MB

                          Download
                        • memory/1424-109-0x00000000067A0000-0x0000000006DB8000-memory.dmp
                          Filesize

                          6.1MB

                          Download
                        • memory/1424-301-0x0000000007990000-0x0000000007EBC000-memory.dmp
                          Filesize

                          5.2MB

                          Download
                        • memory/1424-83-0x0000000004C90000-0x0000000004C9A000-memory.dmp
                          Filesize

                          40KB

                          Download
                        • memory/1424-300-0x0000000007290000-0x0000000007452000-memory.dmp
                          Filesize

                          1.8MB

                          Download
                        • memory/1424-227-0x0000000006540000-0x00000000065A6000-memory.dmp
                          Filesize

                          408KB

                          Download
                        • memory/1424-79-0x0000000004AD0000-0x0000000004B62000-memory.dmp
                          Filesize

                          584KB

                          Download
                        • memory/1424-77-0x00000000001C0000-0x0000000000212000-memory.dmp
                          Filesize

                          328KB

                          Download
                        • memory/1552-2-0x0000000000FA1000-0x0000000000FCF000-memory.dmp
                          Filesize

                          184KB

                          Download
                        • memory/1552-3-0x0000000000FA0000-0x000000000144B000-memory.dmp
                          Filesize

                          4.7MB

                          Download
                        • memory/1552-1-0x0000000077044000-0x0000000077046000-memory.dmp
                          Filesize

                          8KB

                          Download
                        • memory/1552-0-0x0000000000FA0000-0x000000000144B000-memory.dmp
                          Filesize

                          4.7MB

                          Download
                        • memory/1552-17-0x0000000000FA0000-0x000000000144B000-memory.dmp
                          Filesize

                          4.7MB

                          Download
                        • memory/1552-5-0x0000000000FA0000-0x000000000144B000-memory.dmp
                          Filesize

                          4.7MB

                          Download
                        • memory/1580-389-0x00000000051D0000-0x000000000522F000-memory.dmp
                          Filesize

                          380KB

                          Download
                        • memory/1580-370-0x0000000004B70000-0x0000000004BD6000-memory.dmp
                          Filesize

                          408KB

                          Download
                        • memory/1580-375-0x00000000051D0000-0x000000000522F000-memory.dmp
                          Filesize

                          380KB

                          Download
                        • memory/1580-379-0x00000000051D0000-0x000000000522F000-memory.dmp
                          Filesize

                          380KB

                          Download
                        • memory/1580-381-0x00000000051D0000-0x000000000522F000-memory.dmp
                          Filesize

                          380KB

                          Download
                        • memory/1580-383-0x00000000051D0000-0x000000000522F000-memory.dmp
                          Filesize

                          380KB

                          Download
                        • memory/1580-385-0x00000000051D0000-0x000000000522F000-memory.dmp
                          Filesize

                          380KB

                          Download
                        • memory/1580-377-0x00000000051D0000-0x000000000522F000-memory.dmp
                          Filesize

                          380KB

                          Download
                        • memory/1580-397-0x00000000051D0000-0x000000000522F000-memory.dmp
                          Filesize

                          380KB

                          Download
                        • memory/1580-372-0x00000000051D0000-0x000000000522F000-memory.dmp
                          Filesize

                          380KB

                          Download
                        • memory/1580-373-0x00000000051D0000-0x000000000522F000-memory.dmp
                          Filesize

                          380KB

                          Download
                        • memory/1580-395-0x00000000051D0000-0x000000000522F000-memory.dmp
                          Filesize

                          380KB

                          Download
                        • memory/1580-371-0x00000000051D0000-0x0000000005234000-memory.dmp
                          Filesize

                          400KB

                          Download
                        • memory/1580-391-0x00000000051D0000-0x000000000522F000-memory.dmp
                          Filesize

                          380KB

                          Download
                        • memory/1580-405-0x00000000051D0000-0x000000000522F000-memory.dmp
                          Filesize

                          380KB

                          Download
                        • memory/1580-403-0x00000000051D0000-0x000000000522F000-memory.dmp
                          Filesize

                          380KB

                          Download
                        • memory/1580-401-0x00000000051D0000-0x000000000522F000-memory.dmp
                          Filesize

                          380KB

                          Download
                        • memory/1580-495-0x0000000005260000-0x00000000052FC000-memory.dmp
                          Filesize

                          624KB

                          Download
                        • memory/1580-387-0x00000000051D0000-0x000000000522F000-memory.dmp
                          Filesize

                          380KB

                          Download
                        • memory/1580-393-0x00000000051D0000-0x000000000522F000-memory.dmp
                          Filesize

                          380KB

                          Download
                        • memory/1580-399-0x00000000051D0000-0x000000000522F000-memory.dmp
                          Filesize

                          380KB

                          Download
                        • memory/1748-215-0x0000000000860000-0x0000000000861000-memory.dmp
                          Filesize

                          4KB

                          Download
                        • memory/2084-38-0x0000000000400000-0x0000000000592000-memory.dmp
                          Filesize

                          1.6MB

                          Download
                        • memory/2472-583-0x000000001E2C0000-0x000000001E2D2000-memory.dmp
                          Filesize

                          72KB

                          Download
                        • memory/2472-586-0x000000001EB60000-0x000000001EBD6000-memory.dmp
                          Filesize

                          472KB

                          Download
                        • memory/2472-590-0x000000001F6B0000-0x000000001FBD8000-memory.dmp
                          Filesize

                          5.2MB

                          Download
                        • memory/2472-86-0x0000000000AA0000-0x0000000000B0C000-memory.dmp
                          Filesize

                          432KB

                          Download
                        • memory/2472-582-0x000000001E3D0000-0x000000001E4DA000-memory.dmp
                          Filesize

                          1.0MB

                          Download
                        • memory/2472-584-0x000000001E320000-0x000000001E35C000-memory.dmp
                          Filesize

                          240KB

                          Download
                        • memory/2472-589-0x000000001EFB0000-0x000000001F172000-memory.dmp
                          Filesize

                          1.8MB

                          Download
                        • memory/2472-587-0x000000001C520000-0x000000001C53E000-memory.dmp
                          Filesize

                          120KB

                          Download
                        • memory/2996-646-0x0000000000990000-0x0000000000E3B000-memory.dmp
                          Filesize

                          4.7MB

                          Download
                        • memory/2996-648-0x0000000000990000-0x0000000000E3B000-memory.dmp
                          Filesize

                          4.7MB

                          Download
                        • memory/3580-81-0x0000000000400000-0x0000000000457000-memory.dmp
                          Filesize

                          348KB

                          Download
                        • memory/3580-84-0x0000000000400000-0x0000000000457000-memory.dmp
                          Filesize

                          348KB

                          Download
                        • memory/4232-291-0x0000000000400000-0x0000000000458000-memory.dmp
                          Filesize

                          352KB

                          Download
                        • memory/4232-289-0x0000000000400000-0x0000000000458000-memory.dmp
                          Filesize

                          352KB

                          Download
                        • memory/4316-20-0x0000000000990000-0x0000000000E3B000-memory.dmp
                          Filesize

                          4.7MB

                          Download
                        • memory/4316-591-0x0000000000990000-0x0000000000E3B000-memory.dmp
                          Filesize

                          4.7MB

                          Download
                        • memory/4316-302-0x0000000000990000-0x0000000000E3B000-memory.dmp
                          Filesize

                          4.7MB

                          Download
                        • memory/4316-21-0x0000000000990000-0x0000000000E3B000-memory.dmp
                          Filesize

                          4.7MB

                          Download
                        • memory/4316-18-0x0000000000990000-0x0000000000E3B000-memory.dmp
                          Filesize

                          4.7MB

                          Download
                        • memory/4316-581-0x0000000000990000-0x0000000000E3B000-memory.dmp
                          Filesize

                          4.7MB

                          Download
                        • memory/4316-19-0x0000000000991000-0x00000000009BF000-memory.dmp
                          Filesize

                          184KB

                          Download
                        • memory/4316-603-0x0000000000990000-0x0000000000E3B000-memory.dmp
                          Filesize

                          4.7MB

                          Download
                        • memory/4352-106-0x0000000000990000-0x0000000000E3B000-memory.dmp
                          Filesize

                          4.7MB

                          Download
                        • memory/4352-155-0x0000000000990000-0x0000000000E3B000-memory.dmp
                          Filesize

                          4.7MB

                          Download
                        • memory/4536-299-0x0000000007540000-0x0000000007590000-memory.dmp
                          Filesize

                          320KB

                          Download
                        • memory/4536-132-0x0000000000780000-0x00000000007D2000-memory.dmp
                          Filesize

                          328KB

                          Download
                        • memory/4752-245-0x0000000061E00000-0x0000000061EF3000-memory.dmp
                          Filesize

                          972KB

                          Download
                        • memory/4752-216-0x0000000000400000-0x000000000063B000-memory.dmp
                          Filesize

                          2.2MB

                          Download
                        • memory/4752-214-0x0000000000400000-0x000000000063B000-memory.dmp
                          Filesize

                          2.2MB

                          Download
                        • memory/5016-40-0x0000000000870000-0x0000000000871000-memory.dmp
                          Filesize

                          4KB

                          Download
                        • memory/5016-37-0x0000000000870000-0x0000000000871000-memory.dmp
                          Filesize

                          4KB

                          Download
                        • memory/5492-530-0x00000000001B0000-0x00000000001CA000-memory.dmp
                          Filesize

                          104KB

                          Download
                        • memory/5572-539-0x0000000000140000-0x000000000015E000-memory.dmp
                          Filesize

                          120KB

                          Download
                        • memory/5896-552-0x0000014FF0480000-0x0000014FF04A2000-memory.dmp
                          Filesize

                          136KB

                          Download