Overview

overview

10

Static

static

3

sasasa.rar

windows10-2004-x64

10

Analysis

  • max time kernel
    83s
  • max time network
    84s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-12-2024 21:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sasasa.rar

  • Size

    52.2MB

  • MD5

    59f794fea5bfd53feb55c754cf2b1a52

  • SHA1

    2878304c317d05daff6f30de640ab64742b2dd77

  • SHA256

    0c4b7a3670f4ef5f7ba2d7e820cb3df837a72c08a4d039768b50617c06983308

  • SHA512

    2b48c5160a7d2ec0c67c1ed119e666a8a509f64b43f94835a77041e58d025dfcc0df7a969d2cf83c9a1453fd9e5f0f4fadaf7975c4e1255b89f866fac785fc6b

  • SSDEEP

    786432:SRbg1VYxvtPUpHOL7Of0Ub+yoAoxGfMvJLniIroQtC311gqkYdGYD0AWWQQHp22C:SBTdL6f0UbnoA+LzZgqxQHQQs2pemJC

Score
10/10
asyncratservicedefense_evasionexecutionpersistencerat

Malware Config

Extracted

Family

asyncrat

Version

0.6.1

Botnet

service

C2

193.57.137.78:5555

Mutex

Q8ghiNEV5vpA

Attributes
  • delay

    3

  • install

    true

  • install_file

    cmd.exe

  • install_folder

    %Temp%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 62 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion
  • Loads dropped DLL 40 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 9 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 21 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
    • Executes dropped EXE
    PID:612
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      2⤵
        PID:796
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Executes dropped EXE
        PID:336
    • C:\Windows\system32\lsass.exe
      C:\Windows\system32\lsass.exe
      1⤵
      • Executes dropped EXE
      PID:660
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p
      1⤵
      • Executes dropped EXE
      • Modifies registry class
      PID:780
      • C:\Windows\system32\wbem\unsecapp.exe
        C:\Windows\system32\wbem\unsecapp.exe -Embedding
        2⤵
        • Executes dropped EXE
        PID:3056
      • C:\Windows\system32\DllHost.exe
        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
        2⤵
          PID:3784
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          2⤵
          • Executes dropped EXE
          PID:3900
        • C:\Windows\System32\RuntimeBroker.exe
          C:\Windows\System32\RuntimeBroker.exe -Embedding
          2⤵
          • Loads dropped DLL
          PID:3976
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          2⤵
          • Executes dropped EXE
          PID:4060
        • C:\Windows\System32\RuntimeBroker.exe
          C:\Windows\System32\RuntimeBroker.exe -Embedding
          2⤵
          • Loads dropped DLL
          PID:3880
        • C:\Windows\system32\SppExtComObj.exe
          C:\Windows\system32\SppExtComObj.exe -Embedding
          2⤵
          • Executes dropped EXE
          PID:444
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          2⤵
            PID:3088
          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
            2⤵
            • Executes dropped EXE
            PID:3156
          • C:\Windows\System32\RuntimeBroker.exe
            C:\Windows\System32\RuntimeBroker.exe -Embedding
            2⤵
            • Executes dropped EXE
            PID:4128
          • C:\Windows\system32\backgroundTaskHost.exe
            "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca
            2⤵
              PID:2576
            • C:\Windows\system32\wbem\wmiprvse.exe
              C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
              2⤵
              • Loads dropped DLL
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:4788
            • C:\Windows\System32\mousocoreworker.exe
              C:\Windows\System32\mousocoreworker.exe -Embedding
              2⤵
              • Loads dropped DLL
              PID:872
            • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
              C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
              2⤵
              • Loads dropped DLL
              PID:4492
            • C:\Windows\system32\DllHost.exe
              C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
              2⤵
              • Loads dropped DLL
              PID:1620
            • C:\Windows\system32\backgroundTaskHost.exe
              "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
              2⤵
                PID:1248
              • C:\Windows\system32\backgroundTaskHost.exe
                "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                2⤵
                • Loads dropped DLL
                PID:2592
              • C:\Windows\system32\DllHost.exe
                C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                2⤵
                • Loads dropped DLL
                PID:1984
              • C:\Windows\system32\backgroundTaskHost.exe
                "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                2⤵
                • Loads dropped DLL
                PID:4540
            • C:\Windows\system32\fontdrvhost.exe
              "fontdrvhost.exe"
              1⤵
                PID:792
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k RPCSS -p
                1⤵
                • Executes dropped EXE
                PID:896
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
                1⤵
                • Executes dropped EXE
                PID:956
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                1⤵
                • Executes dropped EXE
                PID:388
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                1⤵
                • Executes dropped EXE
                PID:868
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                1⤵
                • Executes dropped EXE
                PID:1052
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                1⤵
                • Loads dropped DLL
                PID:1132
                • C:\Windows\system32\taskhostw.exe
                  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                  2⤵
                  • Executes dropped EXE
                  PID:2972
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                1⤵
                • Executes dropped EXE
                • Indicator Removal: Clear Windows Event Logs
                PID:1140
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                1⤵
                • Executes dropped EXE
                PID:1148
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                1⤵
                • Executes dropped EXE
                PID:1236
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                1⤵
                • Executes dropped EXE
                PID:1272
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                1⤵
                • Executes dropped EXE
                PID:1288
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                1⤵
                • Executes dropped EXE
                PID:1376
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                1⤵
                • Executes dropped EXE
                PID:1384
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                1⤵
                • Executes dropped EXE
                PID:1468
                • C:\Windows\system32\sihost.exe
                  sihost.exe
                  2⤵
                  • Executes dropped EXE
                  • Modifies registry class
                  PID:2656
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                1⤵
                • Executes dropped EXE
                PID:1552
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                1⤵
                • Executes dropped EXE
                PID:1572
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                1⤵
                • Executes dropped EXE
                PID:1668
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                1⤵
                • Executes dropped EXE
                PID:1704
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                1⤵
                • Executes dropped EXE
                PID:1736
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                1⤵
                • Executes dropped EXE
                PID:1812
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                1⤵
                • Executes dropped EXE
                PID:1820
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                1⤵
                • Executes dropped EXE
                PID:1892
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                1⤵
                • Executes dropped EXE
                PID:1900
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                1⤵
                • Executes dropped EXE
                PID:1932
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                1⤵
                • Executes dropped EXE
                PID:1976
              • C:\Windows\System32\spoolsv.exe
                C:\Windows\System32\spoolsv.exe
                1⤵
                • Executes dropped EXE
                PID:1844
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
                1⤵
                • Executes dropped EXE
                PID:2080
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                1⤵
                • Executes dropped EXE
                PID:2140
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:2184
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                1⤵
                • Executes dropped EXE
                PID:2268
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                1⤵
                • Executes dropped EXE
                PID:2456
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                1⤵
                • Executes dropped EXE
                PID:2464
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                1⤵
                • Executes dropped EXE
                PID:2732
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                1⤵
                • Loads dropped DLL
                • Drops file in System32 directory
                PID:2744
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                1⤵
                • Executes dropped EXE
                PID:2752
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                1⤵
                • Executes dropped EXE
                PID:2760
              • C:\Windows\sysmon.exe
                C:\Windows\sysmon.exe
                1⤵
                • Executes dropped EXE
                PID:2780
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:2812
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                1⤵
                • Executes dropped EXE
                PID:2168
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                1⤵
                • Executes dropped EXE
                PID:3312
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                • Loads dropped DLL
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:3476
                • C:\Program Files\7-Zip\7zFM.exe
                  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\sasasa.rar"
                  2⤵
                  • Loads dropped DLL
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  PID:3884
                • C:\Users\Admin\Desktop\0oj3.exe
                  "C:\Users\Admin\Desktop\0oj3.exe"
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:996
                  • C:\Users\Admin\Desktop\cmd.exe
                    cmd.exe
                    3⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:4472
                    • C:\Users\Admin\AppData\Local\Temp\cmd.exe
                      "C:\Users\Admin\AppData\Local\Temp\cmd.exe"
                      4⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Drops file in System32 directory
                      • Drops file in Program Files directory
                      • Drops file in Windows directory
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:528
                      • C:\Windows\system32\cmd.exe
                        "C:\Windows\system32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "cmd" /tr '"C:\ProgramData\cmd.exe"' & exit
                        5⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2284
                        • C:\Windows\system32\schtasks.exe
                          schtasks /create /f /sc onlogon /rl highest /tn "cmd" /tr '"C:\ProgramData\cmd.exe"'
                          6⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:3656
                      • C:\Windows\System32\sc.exe
                        "C:\Windows\System32\sc.exe" create AutoRunService binPath="C:\Program Files\cmd.exe" type=own start=auto
                        5⤵
                        • Launches sc.exe
                        PID:2820
                      • C:\Windows\System32\sc.exe
                        "C:\Windows\System32\sc.exe" start AutoRunService
                        5⤵
                        • Launches sc.exe
                        PID:1444
                • C:\Users\Admin\Desktop\gmhx.exe
                  "C:\Users\Admin\Desktop\gmhx.exe"
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of SetWindowsHookEx
                  PID:3732
                  • C:\Windows\System32\Conhost.exe
                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    3⤵
                    • Loads dropped DLL
                    • Suspicious use of FindShellTrayWindow
                    PID:3052
                  • C:\Users\Admin\Desktop\cmd.exe
                    cmd.exe
                    3⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious use of SetWindowsHookEx
                    PID:4828
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -u -p 4828 -s 1148
                      4⤵
                      • Loads dropped DLL
                      PID:1008
                • C:\Windows\system32\NOTEPAD.EXE
                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Config.ini
                  2⤵
                  • Loads dropped DLL
                  • Opens file in notepad (likely ransom note)
                  PID:3712
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                1⤵
                • Executes dropped EXE
                PID:3612
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                1⤵
                • Loads dropped DLL
                PID:4328
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                1⤵
                • Executes dropped EXE
                PID:1048
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                1⤵
                • Executes dropped EXE
                PID:968
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                1⤵
                • Loads dropped DLL
                • Modifies data under HKEY_USERS
                PID:4524
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                1⤵
                • Executes dropped EXE
                PID:1952
              • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                1⤵
                • Executes dropped EXE
                PID:4244
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                1⤵
                • Executes dropped EXE
                PID:3540
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
                1⤵
                • Loads dropped DLL
                PID:1500
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                1⤵
                • Loads dropped DLL
                PID:5052
              • C:\Windows\servicing\TrustedInstaller.exe
                C:\Windows\servicing\TrustedInstaller.exe
                1⤵
                • Loads dropped DLL
                PID:1652
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                1⤵
                • Loads dropped DLL
                PID:3912
              • C:\Program Files\cmd.exe
                "C:\Program Files\cmd.exe"
                1⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                PID:5112
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k WerSvcGroup
                1⤵
                • Loads dropped DLL
                PID:2284

              Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              System Services

              1
              T1569

              Service Execution

              1
              T1569.002

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Defense Evasion

              Indicator Removal

              1
              T1070

              Clear Windows Event Logs

              1
              T1070.001

              Modify Registry

              2
              T1112

              Credential Access

              Discovery

              Query Registry

              4
              T1012

              System Information Discovery

              4
              T1082

              Lateral Movement

              Collection

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files\cmd.exe
                Filesize

                1.9MB

                MD5

                5d864ba27836417dbbb494b3a5d888a9

                SHA1

                66b87eb33a31d18ac8c89d237c2235b80ecc1b79

                SHA256

                0f916874ee10e6b39afb2319eb33ee8f6b6d1b11f223ce859ead0b1375f84b36

                SHA512

                6f59639c1b1ec0f928347d2ec7da1c46a5b2c9ef3cff71d2e4ec8009b6a97ca0f033d27a830d4efd697f99982c2a86f6620cd9e392918756425223ca9caafdf6

                Download Submit

              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133799800183438676.txt
                Filesize

                74KB

                MD5

                4fd6ecdf7ab655c593f20dd930c20579

                SHA1

                78d0a7d2ac6bc2c351f34c7dbbf51867752b8535

                SHA256

                7d4addec270be727901fbda02d9786be0ae88706a56e5a591bd3345d7de785e9

                SHA512

                7805e5c6a1e4aaaaf4360c701dc6ede7beeee8ac6a25c49090fe72dad26921c16e79eda4f27a07d9c0cdf1534f6ab51afb6619a58ff8534b658ff573c7c419a1

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\cmd.exe
                Filesize

                2.2MB

                MD5

                dd2b4161313175caffafa7fa4ee184c6

                SHA1

                e660e3063e7771425e1edfffc45d8387c090fb59

                SHA256

                c2572e03276acd9c8b641606eb123a304ddfcb1bab172706ce863b1102e42bf4

                SHA512

                ed567c0d9827969a66c43dd7c5ac552c18a4f7f4c9063cda30badceddb0397faa14dbef4bb7730b00dc78e55d6f05adc3c149e37a6517f944e4d179e1ae49ce0

                Download Submit

              • C:\Users\Admin\Desktop\0oj3.exe
                Filesize

                37.0MB

                MD5

                d57050cc8f1d71bb068a181301146855

                SHA1

                564deb2344ea43dd519ee0000642cb0ced55da83

                SHA256

                08058004805b7054e6dd6c55e1aebfa356cddd46167aae7de4322d4c3ae79db1

                SHA512

                43af8130465347d06e23838bc652a94b8d06518d81c40f32f87d78d87a485ae23b13d7585f3e05f0231b9f6f59e383b98617b268519d1c6742b7309c1da494e4

                Download Submit

              • C:\Users\Admin\Desktop\Acrobat Reader DC.lnk
                Filesize

                2KB

                MD5

                a6b2e7ddf50875de0240e54a17be8f66

                SHA1

                88be69379c89cd87fc3eccad75647560fe633adc

                SHA256

                4bc4b2756ac421a66ad1e906cdf8604305b0e763f0ea6bcd70e0f61c6b24ad4b

                SHA512

                edfa9dcf482f58fd2722f6a836ea25b3123563f455089d74d6be977d945ee076c52e38f44a976ca6de826c5f64a20fd56751f3ef266e18f74e1eddd6e2bb5cc5

                Download Submit

              • C:\Users\Admin\Desktop\AddInvoke.xht - Shortcut.lnk
                Filesize

                521B

                MD5

                b5663db79843c37bfcfb04f5ab11a6c1

                SHA1

                d13bad0aeb55e484f024be3eeb61e88a0776c6c6

                SHA256

                a9be4a01cd63b294abf632754c6030bab055eb48f4b761c912625e020910a7c6

                SHA512

                c1ee0a4833c104d1cbe8054b02e6ac3d4a643b7e49cd727e89700a1bfac2668cc7efcdc9a4c9b6c91b270d494f751108d93e9531d5307b12fe0d321afae3dd0e

                Download Submit

              • C:\Users\Admin\Desktop\ClearExport.ADTS - Shortcut.lnk
                Filesize

                536B

                MD5

                612a7257de96ab46f5d5f5ae45474027

                SHA1

                233e80d8b0bba1ca673ca15728fbc8ea6e38f08d

                SHA256

                9f74738e0e94435f0eb0b16e78eced8971fd60adcb48b4c9e5cf742aa0337df7

                SHA512

                0b1dd62f72c10f28c4fdd38a8e305ea0bfc766373727ec6ecbdd016ab7702d3659b61fa0dfc63658834df9c4f51704e8048f30fcd7d751314fbd3b5a104020b8

                Download Submit

              • C:\Users\Admin\Desktop\CompareCompress.mp2v - Shortcut.lnk
                Filesize

                556B

                MD5

                ece3921a2d6af5aec4e62d51ac6bbf5a

                SHA1

                420ff6dbb4818db126fb9c1e12245ac71e1003a1

                SHA256

                1bbd5e6c89cc7c7d0b776469b18a269d91192d40088eb8240e120087c5f514cb

                SHA512

                1aa4464a45f07a8235aa80760c565ca66b56ddfc7d11de53567a70ce0ae1423ac1f64fdc91925e15b98ce9083b2bfabc7b6815e213c03b91c335ca85a9410470

                Download Submit

              • C:\Users\Admin\Desktop\Config.ini
                Filesize

                2KB

                MD5

                33091622dd3fc6b4392accc1486cd153

                SHA1

                b454550bff6bd68cc7eee60b53524f100298dc35

                SHA256

                9fa4f6cb0398d1ee1fd73b6d67a54f0aa8befd33cc0d211285b63061e0d89a51

                SHA512

                3a4ee283f6ad4366aceea4082f5e82770f7bbbe81662080f6df34fdf729ed15eaff32167ae55c6b279980e5e4ac022608b9c093fbb05546d230c76b8ac1cc80a

                Download Submit

              • C:\Users\Admin\Desktop\Config.ini - Shortcut.lnk
                Filesize

                504B

                MD5

                65cc3b909caeadbf9ce0d22f0411e4e3

                SHA1

                f1bf242a946188918bd9440b171c14a8092bd0ae

                SHA256

                b50ec45367c4bf6b22d7f95bd28a6891ceefc70ff1a77d28897847c64bbafd72

                SHA512

                3af3e4d60b4ee5ffa81285ff638c63e4f7326080dd0da1a0e7d47004d669bf0dbcd113d00d44f2287d8072163a9c90dbd22a71bd568a3d2acf148faa7c8d7e3f

                Download Submit

              • C:\Users\Admin\Desktop\Firefox.lnk
                Filesize

                1000B

                MD5

                f8a3a081a51329a42ef988b12cbab467

                SHA1

                0cdf87190d551079098eb77f61cfa563c491a6ec

                SHA256

                d48860187c1a247a2abc78153f7df119f17e76366ad8bd47ac4f93f7bfed974d

                SHA512

                9087b12d2ff9235f34b18c789d7f9483794819a777d6b5d37bf470d1cee6be9f95b176db33d537f1591a6da3f3a0d9a453681e9e56ad90ebe29459b31d94b141

                Download Submit

              • C:\Users\Admin\Desktop\GetAdd.mht - Shortcut.lnk
                Filesize

                919B

                MD5

                cd3c0983e4f1e98b106af38d21be5404

                SHA1

                19f6304d39d76b7ac38eae8151cb31ae91bf9cf7

                SHA256

                80f134bca7d7d95f27e2a400d2a8566e70548a569120b8da9927dcdb919ade31

                SHA512

                10dd7c41f61a804e99193838fecce453eb56387be67d69fbfeeff6e6fb69cf8793fd0b7ce383320f03ab16413c6e2c24fa27f0ae8940a437a3ad2e7116dc6b9d

                Download Submit

              • C:\Users\Admin\Desktop\InitializePop.tif - Shortcut.lnk
                Filesize

                541B

                MD5

                966857a57c574b21b39ef406a71fa07e

                SHA1

                926be220813da914ee3a7c5f570400ec1230133f

                SHA256

                500682492c80e0ba8b6d38321e19aae8383029090adb61c8a9765a7a50f2232c

                SHA512

                132904f46d4a9bc435264e726e7c1bb912b5d695e6dbb4ed9f0e7212ce67fcba349b8408d97c7f70416fa8cc1215e246413510590b132c6e4987a22159b6c6ae

                Download Submit

              • C:\Users\Admin\Desktop\OutGet.docx - Shortcut.lnk
                Filesize

                979B

                MD5

                f44736f70df371806bf5221f52b3b7d9

                SHA1

                109b668dd0dbbdd8c58111eacb8ffc3643377e46

                SHA256

                a33f47e1fd8dd3667b76ca69aa3d96b409aff7a43fbe41f716a239175d641732

                SHA512

                cec2ab126aa29ce47d61df5f404cdff38d500dce3c0e97cbeb7e74ca75e40a5dee8e704080d6752a78a4d3ebb9d8531c1e4ea3a6c72aa09eac389393891e61ad

                Download Submit

              • C:\Users\Admin\Desktop\ResetRepair.3g2 - Shortcut.lnk
                Filesize

                531B

                MD5

                24d2e0a143b58e1e7432f70e17fc0046

                SHA1

                d6616e03b0018426ec6fd75336c1f185da565a4e

                SHA256

                d367eb2f3ec51686e2423b7f8f39ac1b6be67e65ca7963857be2f1210d28de2e

                SHA512

                0048c86e37fd389b40e4456d04c25f7eeb72f0bb35e18c11b5d266274f2939422c24224f1ae84ac0e65f1cd40c20e95126fdd96b5196c7de6cf80e7449e2bcb6

                Download Submit

              • C:\Users\Admin\Desktop\ResizeMove.jpg - Shortcut.lnk
                Filesize

                526B

                MD5

                30efc841eee7b66ef650f5822f932a83

                SHA1

                996e26754376fb89b26f776c96033154ff635bb2

                SHA256

                8ddcc5eaac634f21ac63228e81c54088041908894962e83587ca4035a3d2fb74

                SHA512

                6013d866e20d8d8d65cda51c7810ff9ff70ce22cf47ba083ecf70b83b74b4ac17c46bb4fc2bd6f3a64a51576a2acbe3c1067463243bdf287e8fed5f74a888ea3

                Download Submit

              • C:\Users\Admin\Desktop\RevokeLimit.mhtml - Shortcut.lnk
                Filesize

                984B

                MD5

                cfff71ce37bc11b95291027e445f1307

                SHA1

                718af61cce1d9d0eb5b47de5361d6685c391f69e

                SHA256

                c82dd5393e0ac0d34cca522c7e3923593e5cebfc554288e056c8efe61353713c

                SHA512

                d6b6619b2b69255945abed0a1b727e10b67a1d38cb331a9f17966d58093500a055b5e2f0eb66d3a0be260b8091c7f9ed28d294ea85f87038392123cf0ad12613

                Download Submit

              • C:\Users\Admin\Desktop\SelectReset.snd - Shortcut.lnk
                Filesize

                954B

                MD5

                516197216fe50fd74969e47374f81367

                SHA1

                e5c9fea2ce3c55d1d645e048a9d987b17ed48947

                SHA256

                c4e90e7a703eea1ede5341a55f939fb9e92b0886a71db2a184024939db7f1e92

                SHA512

                8f660b0e327a3b25d97d3aff7182308be60bcda085b9d2a7dbb9f16347901e889f61df2b3c1d202b127df529cc902c46e698f9289c8dcd6b7070fafadf198f76

                Download Submit

              • C:\Users\Admin\Desktop\UnprotectAssert.ico - Shortcut.lnk
                Filesize

                551B

                MD5

                99bf845c85668c90e5f6bc7e55331138

                SHA1

                857a6dd5a66526bff6a5481dbde7b0a8199eaa98

                SHA256

                dd477082b6f49078e6137004012ba158400f14c7e56fd96534d48777a267118e

                SHA512

                108d7ba3e1af02707c01c1c29871197a21e280a88b5a4b94b422084d2a1d293dd51601b6b447c9a815d4c0470e6b7c56d2a33a7aea1beb27fce424ebabbfa7dd

                Download Submit

              • C:\Users\Admin\Desktop\UnregisterUnlock.TS - Shortcut.lnk
                Filesize

                549B

                MD5

                ab9916a03fa5b50bb7dbb4d03566e740

                SHA1

                203276436f35e0560d7a29816ca4375b440ece52

                SHA256

                61c3287a2d87a8346589594bea6bf727286570a5096f09dbecc29d9f4359647f

                SHA512

                3dfd616e9a0fc1e006af991b08f8fbf8d6aa4e1773e73dd9b5bd34df783c04bd9a06a1441055794de7f5f4e402682c1293cdc186021910a983849677efff8b14

                Download Submit

              • C:\Users\Admin\Desktop\UpdateNew.docx - Shortcut.lnk
                Filesize

                1006B

                MD5

                aea6e1c7587ff0131ac989268bce6abe

                SHA1

                aaa98203bf7fe73c7106689f50cc602f984d13c6

                SHA256

                d1f03da7237187a2e206003fcbc4cfe9fa717069448a20d839e5a2db6ec7edf5

                SHA512

                47c2cee593312853ebf41c63f301f1bb57a6b0517a38e0bfa50a229b94676161966bc6545c81b3683719617cf8a897986fbd039fef5c487746614c2a95d1b698

                Download Submit

              • C:\Users\Admin\Desktop\VLC media player.lnk
                Filesize

                923B

                MD5

                1e5bad707903cda78197541ddcd42ce4

                SHA1

                51cc76663cf3f120dd28c5ab11ba588aa1731e16

                SHA256

                430079f21a5544f29290793b61ba01ca6a8e19f5500cc6c4114ec23b20d30f4e

                SHA512

                a8fc769f9121ef455b708fcdbc5ea46515dae292b367db110e0fb56219575524da913e5bb3c13c36d34d49d46a6e41a5646423a074ddbb7e24ec0ad8a0cb5a53

                Download Submit

              • C:\Users\Admin\Desktop\interception.dll
                Filesize

                11KB

                MD5

                fe8b2a022297aa36a3546391221f635a

                SHA1

                346e04907eb628372f459fbbf109b6cff57cac13

                SHA256

                ab88164c11b1b48488772d4c3bfaa4509d5b0ae9dbc5a691dc4f96f0260443c8

                SHA512

                fa203db607cb1154f7ac84e64b236b19ff29abab1b443609648ee3fafa53581c22420edd1f5ed2c522ab7f3c2577c73822eafbf143a8c80914a3061193b10a1c

                Download Submit

              • C:\Users\Admin\Desktop\libcrypto-3-x64.dll
                Filesize

                4.5MB

                MD5

                dc0b5510731cbf1cb12859b137efedfe

                SHA1

                4925f0c77fd32cf2f8eab916d00872d0bc9324e2

                SHA256

                fd92dbc1a720ef43d53a6c3536ab05ccc78b5efe768cc3624d4f7b3cf0d02132

                SHA512

                1adc1e36445d1125703675b7a47beaef05992a2ef5051a6513973f16dee374bf72085ffb26d502295d1c69283a56578d8bb59b432f9087102c5bb5e93a49ddb4

                Download Submit

              • C:\Users\Admin\Desktop\onnxruntime.dll
                Filesize

                11.0MB

                MD5

                8c218c52a99f6c536438242dc99a8006

                SHA1

                d31dc3ad0a9578975b4b0ed895d27d65d9768cc0

                SHA256

                52f8ebe8f08f369a44fed6d1cb680c7c89169795e1c2949ee25b88b538ef0948

                SHA512

                5163d8d81989fd45506d540ccdba990bf4e613dc6438841cb812d7c92069aa643aff509903595dd9fdf542cb580b8937bb6fa016e9f2d463958d37fbd5b7092e

                Download Submit

              • C:\Users\Admin\Desktop\onnxruntime.dll - Shortcut.lnk
                Filesize

                531B

                MD5

                340f1f11e13573337674e6990a6559c5

                SHA1

                2f30bd263dc464e76c9af00c58c333f7f7a0e1f3

                SHA256

                d06cdafcb20aa12b8c2a247e0a6185bc4b761b24f21a05d415769f3d017dbbce

                SHA512

                4399ce9a7845f556639066787fc7bbf597459a4111eedbcd59e7d5bab2b25efdeacae5f567446bc39d1a60256efa470be3316378be11e8d5a9e0b84286cc13a4

                Download Submit

              • C:\Users\Admin\Desktop\opencv_world490.dll - Shortcut.lnk
                Filesize

                551B

                MD5

                31b6c39661d5288948f69a57078a3328

                SHA1

                3b7fc5902cc82d18ec495aa375ceb1d7aa656876

                SHA256

                74a1784dba44efcca3380b214fb540c959d1356887c89bb434b7392fe12de33a

                SHA512

                6144403047587895e4cbbcb2bbb5ff15596f38c24ea2d204295bca426f1db4880a52b3e67752f2a4d014588bae03c7bb990d439d49549516d5fdee870bfc1535

                Download Submit

              • C:\Users\Admin\Desktop\qHYS.exe - Shortcut.lnk
                Filesize

                492B

                MD5

                97bb8c85a1bad177e933c923b88da0a2

                SHA1

                44022ed4f055765db09f9fb6c60616b3d39648e2

                SHA256

                ad1f7e7a41fd0c9aae3bff40d9b382afe922a60712d8877dbd8f7566f9d3eb9a

                SHA512

                b8ec351a826e6777cd7cdc6229a72df67eab00c9627ecf3d4129f90d5da5b9622e7fb42d91ac75e7d1adc86e762c91e2f0075119e0d5624fa324ee442e32b74d

                Download Submit

              • C:\Windows\system32\ASChelp.dll
                Filesize

                112KB

                MD5

                6a0f36515a46c1a29da10d9aaf6c2193

                SHA1

                47f57d38c99d2e9d6cdbb8c8ef9da9eb2b9f6365

                SHA256

                ee45c3f9d8b46a1414a313b356c14ef728847072ad01791924eef53215f2e937

                SHA512

                3e33c23b2d0de819fa7cdde962c14934b14d81438f5df0b48e450a851ded2f03809ee80246241d8df2c8768f12a4176792f39808534fdbaea8d00cd41b3a6e02

                Download Submit

              • memory/528-48-0x000001E635750000-0x000001E635756000-memory.dmp

                Filesize

                24KB

                Download

              • memory/528-47-0x000001E635160000-0x000001E6353A2000-memory.dmp

                Filesize

                2.3MB

                Download

              • memory/996-30-0x00007FF6C1A60000-0x00007FF6C2A60000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/996-24-0x00007FF6C1A60000-0x00007FF6C2A60000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/996-23-0x00007FFA01000000-0x00007FFA01002000-memory.dmp

                Filesize

                8KB

                Download

              • memory/996-22-0x00007FFA00FF0000-0x00007FFA00FF2000-memory.dmp

                Filesize

                8KB

                Download

              • memory/1984-235-0x0000027110BA0000-0x0000027110BB0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/1984-234-0x0000027110BA0000-0x0000027110BB0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/1984-233-0x0000027110BA0000-0x0000027110BB0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-159-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-152-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-163-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-162-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-161-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-164-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-165-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-166-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-168-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-169-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-167-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-170-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-171-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-172-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-173-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-158-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-155-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-154-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-153-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-160-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-149-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-150-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-151-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-148-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-147-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-146-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-144-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-143-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-145-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-142-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-141-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3476-140-0x0000000008450000-0x0000000008460000-memory.dmp

                Filesize

                64KB

                Download

              • memory/3732-113-0x00007FF6C1A60000-0x00007FF6C2A60000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/3732-110-0x00007FF6C1A60000-0x00007FF6C2A60000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/4472-46-0x00007FF6C1A60000-0x00007FF6C2A60000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/4472-41-0x00007FF6C1A60000-0x00007FF6C2A60000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/4472-37-0x00007FF6C1A60000-0x00007FF6C2A60000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/4828-122-0x00007FF6C1A60000-0x00007FF6C2A60000-memory.dmp

                Filesize

                16.0MB

                Download

              • memory/5112-61-0x000001E209330000-0x000001E20951C000-memory.dmp

                Filesize

                1.9MB

                Download