Overview

overview

10

Static

static

3

2025-03-17...ia.exe

windows7-x64

10

2025-03-17...ia.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/03/2025, 14:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-17_29712ab76fafd2052b09359a36bbdcee_mafia.exe

  • Size

    650KB

  • MD5

    29712ab76fafd2052b09359a36bbdcee

  • SHA1

    c447727b047432a18c8135927ad659ca4655344e

  • SHA256

    5408864dbf9de70920fe31c4bc515bb74241ae09da0fce2758f8d7e2da9fbfa5

  • SHA512

    6f3b05831d688f3432821de026f4464fb245583115da4aa16f6fb507dba154c5df5cea684c9e0760d17ffe921b114291189d761f6399796e8ffb0c89579f1a56

  • SSDEEP

    12288:c+dgVfybGZRJwtZJ7SdQtguC+WM6co03X5HKPP/d:c+dgCGZRJwTJ+Q1C3Mdo03X5mP/d

Score
10/10
phorphiexxmrigdefense_evasiondiscoveryexecutionloaderminerpersistencespywarestealertrojanupxworm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

http://45.93.20.18/
Wallets

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9

AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z

LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT

MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

0xCa90599132C4D88907Bd8E046540284aa468a035

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3ESHude8zUHksQg1h6hHmzY79BS36L91Yn

CSLKveRL2zqkbV2TqiFVuW6twtpqgFajoUZLAJQTTQk2

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2

bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr
Attributes
  • mutex

    k9ubbn6sdfs

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Extracted

Family

phorphiex

C2

http://185.215.113.66

http://45.93.20.18

185.215.113.66

Signatures

  • Phorphiex family
    phorphiex
  • Phorphiex payload 1 IoCs
  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 20 IoCs
    miner
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file 17 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks computer location settings 2 TTPs 11 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 34 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Suspicious use of SetThreadContext 14 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 13 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-17_29712ab76fafd2052b09359a36bbdcee_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-17_29712ab76fafd2052b09359a36bbdcee_mafia.exe"
    1⤵
    • Downloads MZ/PE file
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3972
    • C:\Users\Admin\AppData\Local\Temp\B93E.exe
      "C:\Users\Admin\AppData\Local\Temp\B93E.exe"
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1988
      • C:\Users\Admin\AppData\Local\Temp\2380728992.exe
        C:\Users\Admin\AppData\Local\Temp\2380728992.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3652
        • C:\Windows\sysldrvcs.exe
          C:\Windows\sysldrvcs.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2408
          • C:\Users\Admin\AppData\Local\Temp\3359824083.exe
            C:\Users\Admin\AppData\Local\Temp\3359824083.exe
            5⤵
            • Downloads MZ/PE file
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5012
            • C:\Users\Admin\AppData\Local\Temp\226438714.exe
              C:\Users\Admin\AppData\Local\Temp\226438714.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1924
            • C:\Users\Admin\AppData\Local\Temp\729833359.exe
              C:\Users\Admin\AppData\Local\Temp\729833359.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1684
            • C:\Users\Admin\AppData\Local\Temp\129814417.exe
              C:\Users\Admin\AppData\Local\Temp\129814417.exe
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1140
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c sc delete "SrvcDrvcs" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SrvcDrvcs" /f
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:1260
                • C:\Windows\system32\sc.exe
                  sc delete "SrvcDrvcs"
                  8⤵
                  • Launches sc.exe
                  PID:2240
                • C:\Windows\system32\reg.exe
                  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SrvcDrvcs" /f
                  8⤵
                    PID:4860
              • C:\Users\Admin\AppData\Local\Temp\1150527940.exe
                C:\Users\Admin\AppData\Local\Temp\1150527940.exe
                6⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:972
                • C:\Windows\System32\conhost.exe
                  "C:\Windows\System32\conhost.exe" ""
                  7⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3968
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "winsrvcs" & exit
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1600
                    • C:\Windows\system32\schtasks.exe
                      schtasks /delete /f /tn "winsrvcs"
                      9⤵
                        PID:3512
                • C:\Users\Admin\AppData\Local\Temp\81839358.exe
                  C:\Users\Admin\AppData\Local\Temp\81839358.exe
                  6⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4688
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c sc delete "WinSrvcsDrv" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinSrvcsDrv" /f
                    7⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1236
                    • C:\Windows\system32\sc.exe
                      sc delete "WinSrvcsDrv"
                      8⤵
                      • Launches sc.exe
                      PID:4496
                    • C:\Windows\system32\reg.exe
                      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinSrvcsDrv" /f
                      8⤵
                        PID:3960
                  • C:\Users\Admin\AppData\Local\Temp\764122877.exe
                    C:\Users\Admin\AppData\Local\Temp\764122877.exe
                    6⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:2416
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c sc delete "WinDrvUpd" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinDrvUpd" /f
                      7⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4988
                      • C:\Windows\system32\sc.exe
                        sc delete "WinDrvUpd"
                        8⤵
                        • Launches sc.exe
                        PID:4912
                      • C:\Windows\system32\reg.exe
                        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinDrvUpd" /f
                        8⤵
                          PID:4820
                    • C:\Users\Admin\AppData\Local\Temp\178483632.exe
                      C:\Users\Admin\AppData\Local\Temp\178483632.exe
                      6⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:4140
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c sc delete "WinUpdt" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinUpdt" /f
                        7⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3964
                        • C:\Windows\system32\sc.exe
                          sc delete "WinUpdt"
                          8⤵
                          • Launches sc.exe
                          PID:796
                        • C:\Windows\system32\reg.exe
                          reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinUpdt" /f
                          8⤵
                            PID:2348
                      • C:\Users\Admin\AppData\Local\Temp\3357517256.exe
                        C:\Users\Admin\AppData\Local\Temp\3357517256.exe
                        6⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1792
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c sc delete "WinMngr" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinMngr" /f
                          7⤵
                            PID:1124
                            • C:\Windows\system32\sc.exe
                              sc delete "WinMngr"
                              8⤵
                              • Launches sc.exe
                              PID:1188
                            • C:\Windows\system32\reg.exe
                              reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinMngr" /f
                              8⤵
                                PID:696
                          • C:\Users\Admin\AppData\Local\Temp\2757631082.exe
                            C:\Users\Admin\AppData\Local\Temp\2757631082.exe
                            6⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2864
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c sc delete "WinSvcs" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinSvcs" /f
                              7⤵
                                PID:2156
                                • C:\Windows\system32\sc.exe
                                  sc delete "WinSvcs"
                                  8⤵
                                  • Launches sc.exe
                                  PID:4616
                                • C:\Windows\system32\reg.exe
                                  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinSvcs" /f
                                  8⤵
                                    PID:3724
                              • C:\Users\Admin\AppData\Local\Temp\3238812552.exe
                                C:\Users\Admin\AppData\Local\Temp\3238812552.exe
                                6⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2272
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                                  7⤵
                                    PID:4084
                                    • C:\Windows\system32\reg.exe
                                      reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                                      8⤵
                                        PID:3620
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
                                      7⤵
                                        PID:4220
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks /delete /f /tn "Windows Upgrade Manager"
                                          8⤵
                                            PID:2808
                                      • C:\Users\Admin\AppData\Local\Temp\2638826379.exe
                                        C:\Users\Admin\AppData\Local\Temp\2638826379.exe
                                        6⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2936
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c sc delete "SrvcDrvcs" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SrvcDrvcs" /f
                                          7⤵
                                            PID:1008
                                            • C:\Windows\system32\sc.exe
                                              sc delete "SrvcDrvcs"
                                              8⤵
                                              • Launches sc.exe
                                              PID:2032
                                            • C:\Windows\system32\reg.exe
                                              reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SrvcDrvcs" /f
                                              8⤵
                                                PID:3508
                                          • C:\Users\Admin\AppData\Local\Temp\38277134.exe
                                            C:\Users\Admin\AppData\Local\Temp\38277134.exe
                                            6⤵
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:780
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c schtasks /Delete /TN "Microsoft Windows Security" /F
                                              7⤵
                                              • Indicator Removal: Clear Persistence
                                              • System Location Discovery: System Language Discovery
                                              PID:3572
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                schtasks /Delete /TN "Microsoft Windows Security" /F
                                                8⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:4032
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c taskkill /F /IM dwm.exe
                                              7⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:4776
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /F /IM dwm.exe
                                                8⤵
                                                • System Location Discovery: System Language Discovery
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:708
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c taskkill /F /IM conhost.exe
                                              7⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:4144
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /F /IM conhost.exe
                                                8⤵
                                                • System Location Discovery: System Language Discovery
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4160
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c taskkill /F /IM conhost.exe
                                              7⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:5080
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /F /IM conhost.exe
                                                8⤵
                                                • System Location Discovery: System Language Discovery
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4676
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c taskkill /F /IM conhost.exe
                                              7⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:2232
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /F /IM conhost.exe
                                                8⤵
                                                • System Location Discovery: System Language Discovery
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:5092
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c taskkill /F /IM conhost.exe
                                              7⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:4960
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /F /IM conhost.exe
                                                8⤵
                                                • System Location Discovery: System Language Discovery
                                                • Kills process with taskkill
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1304
                                          • C:\Users\Admin\AppData\Local\Temp\590020604.exe
                                            C:\Users\Admin\AppData\Local\Temp\590020604.exe
                                            6⤵
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1264
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c sc delete "Windows Services" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Windows Services" /f
                                              7⤵
                                                PID:1700
                                                • C:\Windows\system32\sc.exe
                                                  sc delete "Windows Services"
                                                  8⤵
                                                  • Launches sc.exe
                                                  PID:1060
                                                • C:\Windows\system32\reg.exe
                                                  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Windows Services" /f
                                                  8⤵
                                                    PID:4672
                                              • C:\Users\Admin\AppData\Local\Temp\326681663.exe
                                                C:\Users\Admin\AppData\Local\Temp\326681663.exe
                                                6⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1760
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c sc delete "WinUpla" & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinUpla" /f
                                                  7⤵
                                                    PID:4228
                                                    • C:\Windows\system32\sc.exe
                                                      sc delete "WinUpla"
                                                      8⤵
                                                      • Launches sc.exe
                                                      PID:412
                                                    • C:\Windows\system32\reg.exe
                                                      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinUpla" /f
                                                      8⤵
                                                        PID:4216
                                                  • C:\Users\Admin\AppData\Local\Temp\1010715185.exe
                                                    C:\Users\Admin\AppData\Local\Temp\1010715185.exe
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:116
                                                  • C:\Users\Admin\AppData\Local\Temp\956628705.exe
                                                    C:\Users\Admin\AppData\Local\Temp\956628705.exe
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:3508
                                                    • C:\Windows\system32\sc.exe
                                                      C:\Windows\system32\sc.exe delete "MgrDrvSvc"
                                                      7⤵
                                                      • Launches sc.exe
                                                      PID:2108
                                                    • C:\Windows\system32\sc.exe
                                                      C:\Windows\system32\sc.exe create "MgrDrvSvc" binpath= "C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe" start= "auto"
                                                      7⤵
                                                      • Launches sc.exe
                                                      PID:2260
                                                    • C:\Windows\system32\sc.exe
                                                      C:\Windows\system32\sc.exe stop eventlog
                                                      7⤵
                                                      • Launches sc.exe
                                                      PID:2216
                                                    • C:\Windows\system32\sc.exe
                                                      C:\Windows\system32\sc.exe start "MgrDrvSvc"
                                                      7⤵
                                                      • Launches sc.exe
                                                      PID:2376
                                                • C:\Users\Admin\AppData\Local\Temp\1925722491.exe
                                                  C:\Users\Admin\AppData\Local\Temp\1925722491.exe
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4972
                                        • C:\Windows\system32\dwm.exe
                                          "dwm.exe"
                                          1⤵
                                          • Checks SCSI registry key(s)
                                          • Enumerates system info in registry
                                          • Modifies data under HKEY_USERS
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4888
                                        • C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe
                                          C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe
                                          1⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4244
                                          • C:\Windows\system32\conhost.exe
                                            C:\Windows\system32\conhost.exe
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4120
                                            • C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe
                                              "C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3256
                                              • C:\Windows\system32\dwm.exe
                                                dwm.exe
                                                4⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1856
                                            • C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe
                                              "C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:772
                                              • C:\Windows\system32\dwm.exe
                                                dwm.exe
                                                4⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4968
                                            • C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe
                                              "C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3568
                                              • C:\Windows\system32\dwm.exe
                                                dwm.exe
                                                4⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3868
                                            • C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe
                                              "C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3532
                                              • C:\Windows\system32\dwm.exe
                                                dwm.exe
                                                4⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3076
                                            • C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe
                                              "C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3084
                                              • C:\Windows\system32\dwm.exe
                                                dwm.exe
                                                4⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2500
                                            • C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe
                                              "C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3924
                                              • C:\Windows\system32\dwm.exe
                                                dwm.exe
                                                4⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1792
                                            • C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe
                                              "C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:1480
                                              • C:\Windows\system32\dwm.exe
                                                dwm.exe
                                                4⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:516
                                            • C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe
                                              "C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4700
                                              • C:\Windows\system32\dwm.exe
                                                dwm.exe
                                                4⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4048
                                            • C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe
                                              "C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4912
                                              • C:\Windows\system32\dwm.exe
                                                dwm.exe
                                                4⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:164
                                            • C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe
                                              "C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:772
                                              • C:\Windows\system32\dwm.exe
                                                dwm.exe
                                                4⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2652
                                            • C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe
                                              "C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3740
                                              • C:\Windows\system32\dwm.exe
                                                dwm.exe
                                                4⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4356
                                            • C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe
                                              "C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:1836
                                              • C:\Windows\system32\dwm.exe
                                                dwm.exe
                                                4⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1584
                                          • C:\Windows\system32\dwm.exe
                                            dwm.exe
                                            2⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3452

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Reconnaissance

                                        Resource Development

                                        Initial Access

                                        Execution

                                        System Services

                                        2
                                        T1569

                                        Service Execution

                                        2
                                        T1569.002

                                        Persistence

                                        Boot or Logon Autostart Execution

                                        1
                                        T1547

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Create or Modify System Process

                                        2
                                        T1543

                                        Windows Service

                                        2
                                        T1543.003

                                        Privilege Escalation

                                        Boot or Logon Autostart Execution

                                        1
                                        T1547

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Create or Modify System Process

                                        2
                                        T1543

                                        Windows Service

                                        2
                                        T1543.003

                                        Defense Evasion

                                        Impair Defenses

                                        1
                                        T1562

                                        Indicator Removal

                                        1
                                        T1070

                                        Clear Persistence

                                        1
                                        T1070.009

                                        Modify Registry

                                        1
                                        T1112

                                        Credential Access

                                        Credentials from Password Stores

                                        1
                                        T1555

                                        Credentials from Web Browsers

                                        1
                                        T1555.003

                                        Unsecured Credentials

                                        1
                                        T1552

                                        Credentials In Files

                                        1
                                        T1552.001

                                        Discovery

                                        Peripheral Device Discovery

                                        1
                                        T1120

                                        Query Registry

                                        4
                                        T1012

                                        System Information Discovery

                                        4
                                        T1082

                                        System Location Discovery

                                        1
                                        T1614

                                        System Language Discovery

                                        1
                                        T1614.001

                                        Lateral Movement

                                        Collection

                                        Data from Local System

                                        1
                                        T1005

                                        Command and Control

                                        Exfiltration

                                        Impact

                                        Service Stop

                                        1
                                        T1489

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\3357517256.exe.log
                                          Filesize

                                          425B

                                          MD5

                                          fff5cbccb6b31b40f834b8f4778a779a

                                          SHA1

                                          899ed0377e89f1ed434cfeecc5bc0163ebdf0454

                                          SHA256

                                          b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76

                                          SHA512

                                          1a188a14c667bc31d2651b220aa762be9cce4a75713217846fbe472a307c7bbc6e3c27617f75f489902a534d9184648d204d03ee956ac57b11aa90551248b8f9

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\1010715185.exe
                                          Filesize

                                          8KB

                                          MD5

                                          3af1ff90e1a83a4930ab2b24f51b4149

                                          SHA1

                                          b8a1faff60dc255ffd48d25e6f23c73ee6e9e1ac

                                          SHA256

                                          835108db5fb2e1e6ce3e532fd91a33980f153d482a3f41ac92ed12b669820446

                                          SHA512

                                          5fbc665f8f4325539075c12c43826ac0a98886ee76205ad985688be7fa79bdcda1492d979aae02372e791cf11bb3d92589f908e6743dbe00d0fccadc0f4a0107

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\1150527940.exe
                                          Filesize

                                          50KB

                                          MD5

                                          64d97ceac5d0fbb39f316eb8707c5af4

                                          SHA1

                                          3114d530f716e3dc9e07d78703e0ad34256b8e1c

                                          SHA256

                                          3cef6251ea6a26aaf56f933a3ef27b6b1b20d591a3cac9816ac5d850cd3a51c9

                                          SHA512

                                          19a0468aee08521640a5934e57411f91492c6287a07bf9aa331ef5855c16f7e54ae13c678b2cf86ae363987205925e2c7c9e0cab233f6341a602b78391b3c2bb

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\129814417.exe
                                          Filesize

                                          8KB

                                          MD5

                                          c44040574183a3e141f2afee1a427b7d

                                          SHA1

                                          f77780ddec6f3a4f9adf95cf641fae123b076723

                                          SHA256

                                          6c1a7c919dfa3dfbcaf6eec780f9114ca688fcf8751886b57a64d816e3ff52e9

                                          SHA512

                                          4a639e2e1e931a8ace54a38f4be0293a5fc8a480a980f0541fbdf3146064e61fe19b2a9c067c50f1211a7ed20a9a8ce389181163d0408982a904fe94de4a4f6d

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\178483632.exe
                                          Filesize

                                          8KB

                                          MD5

                                          9f3b28cd269f23eb326c849cb6d8ed3d

                                          SHA1

                                          db2cab47fffa3770f19c7f16b1c7807da17ac9fd

                                          SHA256

                                          90164053f4c19004a051638a1a47ea3fe7cb9f004b5dd623de928f0bc2b06a81

                                          SHA512

                                          ba18b44914469be2696a8e5b61b88844aa6a8c8dd5f1942c48918734a699045b143b555c4e274f4cf3d040e115340dc5a74c4eda639e6669fca1b2c2b383ca8a

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\1925722491.exe
                                          Filesize

                                          12KB

                                          MD5

                                          0d2e3b221afdfd27afb04a73f9d79030

                                          SHA1

                                          ee87be2e1f6d4b1ff83f31d06d68e10c2f195691

                                          SHA256

                                          b1e61a67388182131302be4e5f75843993724657cb6fa506b075b4795073f565

                                          SHA512

                                          4935f9ca3669c1db456f81d6e4d82a969ff04aed3b64ee3d9471da787f537b9356559c49242878a3e0fb3964a1235b2049943e6bb147a637da27f86855cc2708

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\226438714.exe
                                          Filesize

                                          53KB

                                          MD5

                                          60686a27b79838583920c9a0954104c9

                                          SHA1

                                          0c253b3c72cd5b01a9403230ff3ec9d3cdd8b71c

                                          SHA256

                                          270149da5feb9487799083b5e76d41d3aa69afaf8f731e72e7d64c3a7c070c7e

                                          SHA512

                                          c0a9308b5a3baca0906c9663ca3e3eaf64fc131aaa5358557874b30e4b743ffe898da6fbace032c3481693bf9081f938127fd07c8d550d9eb74958b20e24ab04

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\2380728992.exe
                                          Filesize

                                          101KB

                                          MD5

                                          8a30adfbb8c9ed8170177ce8c5738fbf

                                          SHA1

                                          2d029ddd39fe81a08982dd4309a74045aa91004f

                                          SHA256

                                          72b19310a8c3cdfc23be1041eb773e6e41a08ec608e53b027b32e05a275b1da9

                                          SHA512

                                          8885308b53b8d1baab14a98ec257acac9c700f2cebe48cbb79a25e3d7133f0016ba082ec9f8397c9b1677375dd5a1d3894d813aba5947f267b44b012fa6a027f

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\2757631082.exe
                                          Filesize

                                          28KB

                                          MD5

                                          354b172c63f7693310212e3eba68e4ba

                                          SHA1

                                          843cec7cf78015f5b226d439f046c9a42064cfe2

                                          SHA256

                                          f68c61db632448996936440c7d7ea0e1f46007fb157ab59d48028765875ded00

                                          SHA512

                                          e7e35a4791a73629b92a07a17ca3278f73a788ac8563b05fa37d47f0be9af8f952886ccc02a7478d292a2deccc1bf9f42fa40e7b824a5d976f4b229a85c1a460

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\3238812552.exe
                                          Filesize

                                          28KB

                                          MD5

                                          02320b5a9ffb3aa91fc2fe0f0906c575

                                          SHA1

                                          5209092f99ed5f1e2fd50e8d57b639160440b76d

                                          SHA256

                                          03349521a6994d528817f755d1d6c4ee74cda6cc6036525b911a06f8cc7707c9

                                          SHA512

                                          7addb20d4edb8678c6bc02654d841a5401408e8dc07cb5e3df9eee96feb9d480fcf343578ef3c1774724e3ec29e947a4191bbe5af5c4cebc076b92b427c68353

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\326681663.exe
                                          Filesize

                                          8KB

                                          MD5

                                          9e1aafb6d1c75d75f7e1a8e135f9c508

                                          SHA1

                                          745cd643e657281c0c198d895d1daf53dcba29ba

                                          SHA256

                                          41307ffc2c8273962750cec20533c2c043d8456379885e82151c843af3d31615

                                          SHA512

                                          b97b10881ab4ec24bf5d615169932ed6cd09661c21f1ba631cbbef146ff81bdf9ee61ed1b85f76fdb602ccc553a0a98c8189967a515d729c42b4ac04e44cdefd

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\3357517256.exe
                                          Filesize

                                          28KB

                                          MD5

                                          8f1f692c2e839e6f821e42057f8b1c01

                                          SHA1

                                          54ab2dec09e3b76114aaab1cc32c6ba5b4c2f7c8

                                          SHA256

                                          8f3c4a66f4c66b34d7d79fbcccb03b81d0139a279789981c16de5e66e6678cb5

                                          SHA512

                                          1296065ba17657e3ad1fe88c58b9d36f3def89e8bd44893d10d42a5ba5d0c8a2e5a0da23d46ca2d0b5a88dc2b4b9716d38b6e926c1f7f66a66808310c80fcf4d

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\3359824083.exe
                                          Filesize

                                          14KB

                                          MD5

                                          dbef896fee8509b83679949d5dd1ed70

                                          SHA1

                                          7792964f787b105f7ebbe291dca4e99b2209aa0f

                                          SHA256

                                          6c8c08026bf7fff06b7ba68457caa8de0bf1ae5f74b05946c9e9128abbe27e52

                                          SHA512

                                          940e4660afbeb4a372f1554fc23f7f82d5f7f0e15d9c2a4ae440e33dc485407add2806c94a05edf03efca45c68484d28073449204f29a6fcba723e7de178ee27

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\38277134.exe
                                          Filesize

                                          9KB

                                          MD5

                                          9e1f23d4c920f2a9795a5e5fe4c60ad1

                                          SHA1

                                          cccd5690d19b0819b806c86867e7685e962f341f

                                          SHA256

                                          8f614c53cef81d2d481ac230f6fbf5f72f3e43cc8787e06f9a935d7bb19da034

                                          SHA512

                                          5edcb6a6049f6d12a78c164f39cf27a32e0ac65cf698629e87da273a5049bf593ca9956e1cdedf91583d5050b2eef8564ce16d4bdf4f40c6fc3fe2731f9ebc2f

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\590020604.exe
                                          Filesize

                                          28KB

                                          MD5

                                          b1c1d77e69753d822893438b35b2e7cc

                                          SHA1

                                          1573a0dc3dd72af4e6b1215591e81b3d2fb7d2d0

                                          SHA256

                                          f4a5fa872a3df6d3092c68259d2f071e34c1f5420c97a72c2eaeed3a7f5d3fc8

                                          SHA512

                                          dc6214203bbedee6cf5e6e28d68f9345cb687b8e38bea183827b14e51bdf9898bd1f2cb606ba2047a9e8f826d6a8fbf0596989b202097454da6afcde9082cfca

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\729833359.exe
                                          Filesize

                                          20KB

                                          MD5

                                          2e5f10745392643c8cf21aae4241e4cc

                                          SHA1

                                          ad390d62e2215a37a3faf5e0cb3f0f3244452c07

                                          SHA256

                                          44db578a4075ab126df387da3fa757f76bd3074606f3a9be21ee55ec6ac1ed29

                                          SHA512

                                          85e63e752fc43d4b2be83628f5f8dcb288276c5369a3e940f795e87409f70473221d2d28a87f04e68c126bc0836171310d00247f240e05f4618e1f9393b132af

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\764122877.exe
                                          Filesize

                                          8KB

                                          MD5

                                          5e24b9457135b737012cde5e30cf124b

                                          SHA1

                                          58575839926a1e6ae798867bbba0ed4db088d85e

                                          SHA256

                                          d3a4c4f0557019d5fe04b57486e9ed0b9c823e9d1d137138feab200e96dd9abf

                                          SHA512

                                          7192d902a9f1a51ea34291bdcb2fc09e802148f7cc415e498c67414ef2377c796b93f11dcd6b08968ea9fa6a99b7516c9bdd297ee4cab906949d41d3cebce1ec

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\81839358.exe
                                          Filesize

                                          8KB

                                          MD5

                                          38c5ce383f70dc49175cc5843f017ff9

                                          SHA1

                                          4c3ae746f22a1de56b4e1a6d26b7353f39f1cdfd

                                          SHA256

                                          c69a0f757d1ac585078fe3fecb4a4a925b55f412904f581cdbcfcfa72292ada3

                                          SHA512

                                          3f418ac147d4d3acfd5830cd1085b6e87afaf02497332780eb9126bb71d35eedc6ca695ef534bcba3a220f6a3960b80d3b778787e8506bad029fb41bdbc99688

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\956628705.exe
                                          Filesize

                                          2.5MB

                                          MD5

                                          024dd77c38676e6ce0a5a2201f6145de

                                          SHA1

                                          5d020adf1adb0b0c0b370df63b2b09d89df0acfb

                                          SHA256

                                          b4553ff5d7ae98614d4856de134f49e503f046a15fc49033af3232fbeab9ed4c

                                          SHA512

                                          a94312eaea187830c28680164d80e3e9c2f58a7b24930dc224ac52a308406ccfd56524dffaf5c3a37e6b713d1d711f1b44d99d1fb60669c8b2351bb4c9d2fc85

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\B93E.exe
                                          Filesize

                                          10KB

                                          MD5

                                          4c52cf849be8954638925c242e0cc976

                                          SHA1

                                          949ba0061ea9dbe3b9059bb2a7b20caa74861280

                                          SHA256

                                          fa6fcf2e154c0b18b12ab86267ccd38d79cc9c27e7e261a7e9201a0a9dd9d0bb

                                          SHA512

                                          c11572dcd274bdcb5e94cf38ec36aa65e4d5605df250ee8887cd5098b044e3e2e71be3b3292118b967e27bc752b5cf5d9c8da5ac2834b7c156302c307abe123b

                                          Download Submit

                                        • C:\Windows\TEMP\iumgljdpmggh.sys
                                          Filesize

                                          14KB

                                          MD5

                                          0c0195c48b6b8582fa6f6373032118da

                                          SHA1

                                          d25340ae8e92a6d29f599fef426a2bc1b5217299

                                          SHA256

                                          11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

                                          SHA512

                                          ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

                                          Download Submit

                                        • memory/116-130-0x0000000000F70000-0x0000000000F76000-memory.dmp

                                          Filesize

                                          24KB

                                          Download

                                        • memory/1140-46-0x00000000001A0000-0x00000000001A6000-memory.dmp

                                          Filesize

                                          24KB

                                          Download

                                        • memory/1264-116-0x00000000003D0000-0x00000000003D6000-memory.dmp

                                          Filesize

                                          24KB

                                          Download

                                        • memory/1760-123-0x0000000000680000-0x0000000000686000-memory.dmp

                                          Filesize

                                          24KB

                                          Download

                                        • memory/1792-83-0x0000000000920000-0x0000000000926000-memory.dmp

                                          Filesize

                                          24KB

                                          Download

                                        • memory/1856-179-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download

                                        • memory/1856-183-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download

                                        • memory/1856-180-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download

                                        • memory/1856-178-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download

                                        • memory/1856-181-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download

                                        • memory/1856-182-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download

                                        • memory/2272-98-0x00000000001C0000-0x00000000001C6000-memory.dmp

                                          Filesize

                                          24KB

                                          Download

                                        • memory/2416-69-0x0000000000770000-0x0000000000776000-memory.dmp

                                          Filesize

                                          24KB

                                          Download

                                        • memory/2864-91-0x00000000007A0000-0x00000000007A6000-memory.dmp

                                          Filesize

                                          24KB

                                          Download

                                        • memory/3452-158-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download

                                        • memory/3452-157-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download

                                        • memory/3452-152-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download

                                        • memory/3452-151-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download

                                        • memory/3452-150-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download

                                        • memory/3452-148-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download

                                        • memory/3452-147-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download

                                        • memory/3452-153-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download

                                        • memory/3452-155-0x0000023404890000-0x00000234048B0000-memory.dmp

                                          Filesize

                                          128KB

                                          Download

                                        • memory/3452-161-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download

                                        • memory/3452-156-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download

                                        • memory/3452-160-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download

                                        • memory/3452-159-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download

                                        • memory/3452-154-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download

                                        • memory/3968-54-0x00000151F8770000-0x00000151F8776000-memory.dmp

                                          Filesize

                                          24KB

                                          Download

                                        • memory/3968-53-0x00000151F8410000-0x00000151F8416000-memory.dmp

                                          Filesize

                                          24KB

                                          Download

                                        • memory/4120-141-0x0000000140000000-0x000000014000D000-memory.dmp

                                          Filesize

                                          52KB

                                          Download

                                        • memory/4120-142-0x0000000140000000-0x000000014000D000-memory.dmp

                                          Filesize

                                          52KB

                                          Download

                                        • memory/4120-149-0x0000000140000000-0x000000014000D000-memory.dmp

                                          Filesize

                                          52KB

                                          Download

                                        • memory/4120-144-0x0000000140000000-0x000000014000D000-memory.dmp

                                          Filesize

                                          52KB

                                          Download

                                        • memory/4120-140-0x0000000140000000-0x000000014000D000-memory.dmp

                                          Filesize

                                          52KB

                                          Download

                                        • memory/4120-143-0x0000000140000000-0x000000014000D000-memory.dmp

                                          Filesize

                                          52KB

                                          Download

                                        • memory/4140-76-0x00000000002D0000-0x00000000002D6000-memory.dmp

                                          Filesize

                                          24KB

                                          Download

                                        • memory/4688-60-0x0000000000230000-0x0000000000236000-memory.dmp

                                          Filesize

                                          24KB

                                          Download

                                        • memory/4968-204-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download

                                        • memory/4968-203-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download

                                        • memory/4968-202-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download

                                        • memory/4968-201-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download

                                        • memory/4968-200-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download

                                        • memory/4968-205-0x0000000140000000-0x0000000140835000-memory.dmp

                                          Filesize

                                          8.2MB

                                          Download