Overview

overview

10

Static

static

8

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

8

ฺฺฺK...ฺฺ

windows10_x64

3

ฺฺฺK...ฺฺ

windows10_x64

3

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

8

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

8

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

3

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

3

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

8

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

Resubmissions

12-11-2021 18:04

211112-wnzb8aahhm 10

19-11-2020 10:08

201119-rhwlt38jrx 10

18-11-2020 17:26

201118-htd4fq29va 10

Analysis

  • max time kernel
    1690s
  • max time network
    1698s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    19-11-2020 10:08

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

Score
10/10
discoverypersistenceransomwareupx

Malware Config

Extracted

Path

C:\_readme.txt

Ransom Note
ATTENTION! Don't worry my friend, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-T9WE5uiVT6 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: blower@india.com Reserve e-mail address to contact us: blower@firemail.cc Your personal ID: 046Sdsd3273yifhsisySD60h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
Emails

blower@india.com

blower@firemail.cc

URLs

https://we.tl/t-T9WE5uiVT6

Signatures

  • Executes dropped EXE ⋅ 24 IoCs
  • Modifies Installed Components in the registry ⋅ 2 TTPs
    persistence
  • Modifies extensions of user files ⋅ 3 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • UPX packed file ⋅ 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Modifies file permissions ⋅ 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application ⋅ 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) ⋅ 34 IoCs
  • Looks up external IP address via web service ⋅ 30 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash ⋅ 2 IoCs
  • Modifies system certificate store ⋅ 2 TTPs 10 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses ⋅ 64 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 24 IoCs
  • Suspicious use of FindShellTrayWindow ⋅ 4 IoCs
  • Suspicious use of SendNotifyMessage ⋅ 8 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
    "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"
    Adds Run key to start application
    Modifies system certificate store
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:4076
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      Modifies file permissions
      PID:204
    • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
      "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Admin IsNotAutoStart IsNotTask
      Modifies extensions of user files
      Drops desktop.ini file(s)
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2576
      • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
        "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsNotTask
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        PID:480
        • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
          "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 480 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
          Suspicious behavior: EnumeratesProcesses
          PID:3932
      • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
        "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 2576 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
        Suspicious behavior: EnumeratesProcesses
        PID:1048
  • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
    C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task
    Executes dropped EXE
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:2476
    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
      "C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3828
      • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
        "C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 3828 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        PID:908
    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
      "C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 2476 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4028
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 3036 -s 6912
    Program crash
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    PID:3960
  • C:\Windows\explorer.exe
    explorer.exe
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of FindShellTrayWindow
    Suspicious use of SendNotifyMessage
    PID:3604
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3604 -s 2056
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3988
  • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
    C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task
    Executes dropped EXE
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:3808
    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
      "C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:428
      • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
        "C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 428 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        PID:3168
    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
      "C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 3808 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:3684
  • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
    C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task
    Executes dropped EXE
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:3228
    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
      "C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3916
      • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
        "C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 3916 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        PID:1860
    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
      "C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 3228 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2392
  • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
    C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task
    Executes dropped EXE
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
      "C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2504
      • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
        "C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 2504 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
        Executes dropped EXE
        PID:2268
    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
      "C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 2248 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
      Executes dropped EXE
      PID:3680
  • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
    C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task
    Executes dropped EXE
    Suspicious use of WriteProcessMemory
    PID:2816
    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
      "C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2056
      • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
        "C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 2056 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
        Executes dropped EXE
        PID:1992
    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
      "C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 2816 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
      Executes dropped EXE
      PID:2264
  • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
    C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe --Task
    Executes dropped EXE
    Suspicious use of WriteProcessMemory
    PID:3188
    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
      "C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsTask
      Executes dropped EXE
      PID:1268
      • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
        "C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 1268 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
        Executes dropped EXE
        PID:584
    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
      "C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 3188 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
      Executes dropped EXE
      PID:1516

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Discovery

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Persistence

                  Privilege Escalation

                    Replay Monitor

                    00:00 00:00

                    Downloads

                    • C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.kropun
                      Download Submit
                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                      Download Submit
                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\Admin\AppData\Local\226b110d-d0d5-4063-9bb2-475e8ab8c9cb\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
                      MD5

                      ead18f3a909685922d7213714ea9a183

                      SHA1

                      1270bd7fd62acc00447b30f066bb23f4745869bf

                      SHA256

                      5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

                      SHA512

                      6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

                      Download Submit
                    • C:\Users\All Users\Microsoft\Windows\Caches\cversions.2.db
                      Download Submit
                    • C:\Users\All Users\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db
                      Download Submit
                    • C:\Users\All Users\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_28cfa8b3d0f0ccca608b49d257b92547f98ab5ba_41822faa_cab_000eec50\Report.wer
                      Download Submit
                    • C:\Users\All Users\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_28cfa8b3d0f0ccca608b49d257b92547f98ab5ba_41822faa_cab_000eec50\WEREAF8.tmp.WERInternalMetadata.xml
                      Download Submit
                    • C:\Users\All Users\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_28cfa8b3d0f0ccca608b49d257b92547f98ab5ba_41822faa_cab_000eec50\WEREB17.tmp.csv
                      Download Submit
                    • C:\Users\All Users\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_28cfa8b3d0f0ccca608b49d257b92547f98ab5ba_41822faa_cab_000eec50\WEREB28.tmp.txt
                      Download Submit
                    • C:\Users\All Users\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_28cfa8b3d0f0ccca608b49d257b92547f98ab5ba_41822faa_cab_000eec50\WEREC04.tmp.appcompat.txt
                      Download Submit
                    • C:\Users\All Users\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_28cfa8b3d0f0ccca608b49d257b92547f98ab5ba_41822faa_cab_000eec50\memory.hdmp
                      Download Submit
                    • C:\Users\All Users\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_28cfa8b3d0f0ccca608b49d257b92547f98ab5ba_41822faa_cab_000eec50\minidump.mdmp
                      Download Submit
                    • \??\PIPE\wkssvc
                      Download Submit
                    • memory/204-2-0x0000000000000000-mapping.dmp
                      Download
                    • memory/428-67-0x00000000005D0000-0x0000000000610000-memory.dmp
                      Download
                    • memory/428-63-0x0000000002240000-0x0000000002241000-memory.dmp
                      Download
                    • memory/428-60-0x0000000000000000-mapping.dmp
                      Download
                    • memory/480-14-0x0000000000000000-mapping.dmp
                      Download
                    • memory/480-16-0x0000000002110000-0x0000000002111000-memory.dmp
                      Download
                    • memory/480-18-0x00000000006B0000-0x00000000006F0000-memory.dmp
                      Download
                    • memory/584-142-0x0000000000000000-mapping.dmp
                      Download
                    • memory/584-144-0x00000000022A0000-0x00000000022A1000-memory.dmp
                      Download
                    • memory/584-145-0x0000000000550000-0x0000000000590000-memory.dmp
                      Download
                    • memory/908-51-0x0000000000740000-0x0000000000780000-memory.dmp
                      Download
                    • memory/908-50-0x00000000023C0000-0x00000000023C1000-memory.dmp
                      Download
                    • memory/908-48-0x0000000000000000-mapping.dmp
                      Download
                    • memory/1048-19-0x0000000000670000-0x00000000006B0000-memory.dmp
                      Download
                    • memory/1048-15-0x0000000000000000-mapping.dmp
                      Download
                    • memory/1268-133-0x0000000000000000-mapping.dmp
                      Download
                    • memory/1268-136-0x0000000002180000-0x0000000002181000-memory.dmp
                      Download
                    • memory/1268-139-0x0000000000770000-0x00000000007B0000-memory.dmp
                      Download
                    • memory/1516-141-0x0000000000660000-0x00000000006A0000-memory.dmp
                      Download
                    • memory/1516-134-0x0000000000000000-mapping.dmp
                      Download
                    • memory/1516-138-0x0000000002280000-0x0000000002281000-memory.dmp
                      Download
                    • memory/1860-86-0x0000000000000000-mapping.dmp
                      Download
                    • memory/1860-88-0x0000000002060000-0x0000000002061000-memory.dmp
                      Download
                    • memory/1860-90-0x0000000000630000-0x0000000000670000-memory.dmp
                      Download
                    • memory/1992-127-0x0000000002130000-0x0000000002131000-memory.dmp
                      Download
                    • memory/1992-128-0x00000000007A0000-0x00000000007E0000-memory.dmp
                      Download
                    • memory/1992-125-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2056-117-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2056-124-0x0000000000620000-0x0000000000660000-memory.dmp
                      Download
                    • memory/2056-120-0x0000000002160000-0x0000000002161000-memory.dmp
                      Download
                    • memory/2248-92-0x0000000002300000-0x0000000002301000-memory.dmp
                      Download
                    • memory/2248-93-0x00000000005C0000-0x0000000000600000-memory.dmp
                      Download
                    • memory/2264-123-0x0000000000660000-0x00000000006A0000-memory.dmp
                      Download
                    • memory/2264-118-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2268-102-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2268-104-0x0000000002010000-0x0000000002011000-memory.dmp
                      Download
                    • memory/2268-105-0x00000000005C0000-0x0000000000600000-memory.dmp
                      Download
                    • memory/2392-85-0x0000000000870000-0x00000000008B0000-memory.dmp
                      Download
                    • memory/2392-77-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2476-25-0x000000000075A000-0x000000000079A000-memory.dmp
                      Download
                    • memory/2476-24-0x0000000002190000-0x0000000002191000-memory.dmp
                      Download
                    • memory/2504-101-0x00000000005D0000-0x0000000000610000-memory.dmp
                      Download
                    • memory/2504-94-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2504-99-0x00000000022B0000-0x00000000022B1000-memory.dmp
                      Download
                    • memory/2576-7-0x0000000002220000-0x0000000002221000-memory.dmp
                      Download
                    • memory/2576-6-0x0000000000780000-0x00000000007C0000-memory.dmp
                      Download
                    • memory/2576-5-0x0000000002220000-0x0000000002221000-memory.dmp
                      Download
                    • memory/2576-4-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2816-107-0x0000000002380000-0x0000000002381000-memory.dmp
                      Download
                    • memory/2816-108-0x00000000005C0000-0x0000000000600000-memory.dmp
                      Download
                    • memory/3168-70-0x00000000022D0000-0x00000000022D1000-memory.dmp
                      Download
                    • memory/3168-71-0x00000000007F0000-0x0000000000830000-memory.dmp
                      Download
                    • memory/3168-68-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3188-132-0x00000000005B1000-0x00000000005F1000-memory.dmp
                      Download
                    • memory/3188-131-0x0000000002250000-0x0000000002251000-memory.dmp
                      Download
                    • memory/3228-75-0x00000000020E0000-0x000000000213B000-memory.dmp
                      Download
                    • memory/3228-74-0x0000000000650000-0x0000000000690000-memory.dmp
                      Download
                    • memory/3228-73-0x00000000020E0000-0x00000000020E1000-memory.dmp
                      Download
                    • memory/3680-100-0x00000000007C0000-0x0000000000800000-memory.dmp
                      Download
                    • memory/3680-95-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3684-65-0x0000000002200000-0x0000000002201000-memory.dmp
                      Download
                    • memory/3684-61-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3684-66-0x0000000000690000-0x00000000006D0000-memory.dmp
                      Download
                    • memory/3808-59-0x00000000006D1000-0x0000000000711000-memory.dmp
                      Download
                    • memory/3808-58-0x0000000002340000-0x0000000002341000-memory.dmp
                      Download
                    • memory/3828-33-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3828-46-0x00000000005E0000-0x0000000000620000-memory.dmp
                      Download
                    • memory/3828-36-0x0000000002370000-0x0000000002371000-memory.dmp
                      Download
                    • memory/3916-76-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3916-84-0x0000000000520000-0x0000000000560000-memory.dmp
                      Download
                    • memory/3916-79-0x0000000002000000-0x0000000002001000-memory.dmp
                      Download
                    • memory/3932-22-0x00000000007C0000-0x0000000000800000-memory.dmp
                      Download
                    • memory/3932-21-0x0000000002390000-0x0000000002391000-memory.dmp
                      Download
                    • memory/3932-20-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3960-26-0x000001E3A6770000-0x000001E3A6771000-memory.dmp
                      Download
                    • memory/3960-32-0x000001E3B2DE0000-0x000001E3B2DE1000-memory.dmp
                      Download
                    • memory/3960-31-0x000001E3A8480000-0x000001E3A8481000-memory.dmp
                      Download
                    • memory/3960-30-0x000001E3A7DE0000-0x000001E3A7DE1000-memory.dmp
                      Download
                    • memory/3960-29-0x000001E3A7DE0000-0x000001E3A7DE1000-memory.dmp
                      Download
                    • memory/3960-27-0x000001E3A6770000-0x000001E3A6771000-memory.dmp
                      Download
                    • memory/3988-56-0x000001CD26B30000-0x000001CD26B31000-memory.dmp
                      Download
                    • memory/3988-53-0x000001CD25DC0000-0x000001CD25DC1000-memory.dmp
                      Download
                    • memory/4028-47-0x0000000000700000-0x0000000000740000-memory.dmp
                      Download
                    • memory/4028-34-0x0000000000000000-mapping.dmp
                      Download
                    • memory/4028-38-0x0000000002300000-0x0000000002301000-memory.dmp
                      Download
                    • memory/4076-0-0x0000000002240000-0x0000000002241000-memory.dmp
                      Download
                    • memory/4076-1-0x00000000006BA000-0x00000000006FA000-memory.dmp
                      Download