951c2f341e914601140aa9ead05895f6957d5cbfda80b81be99015d2be02d44f

Analysis

max time kernel
147s
max time network
126s
platform
windows7_x64
resource
win7-en-20211014
submitted
25-10-2021 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

download.dat.msi
Size

953KB
MD5

f2836216ca554dfdc8a300decb644911
SHA1

338829d2c88f430b0d00bfb03ad8a43649b4e1d8
SHA256

951c2f341e914601140aa9ead05895f6957d5cbfda80b81be99015d2be02d44f
SHA512

02148775c5db048566d0fb73e7d8da06597362a31934907ce356238bc1aa8ab4b319094d16d2a5881bf9b6797fde023c42a76846448a5436f4b72f067a668b1c

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

Processes:

MsiExec.exe

flow	pid	Process
5	596	MsiExec.exe
7	596	MsiExec.exe
9	596	MsiExec.exe
11	596	MsiExec.exe

Executes dropped EXE 1 IoCs

Processes:

lKGhCvzKoMrc.exe

pid	Process
1400	lKGhCvzKoMrc.exe

Loads dropped DLL 12 IoCs

Processes:

MsiExec.exelKGhCvzKoMrc.exe

pid	Process
596	MsiExec.exe
596	MsiExec.exe
596	MsiExec.exe
596	MsiExec.exe
596	MsiExec.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in Windows directory 11 IoCs

Processes:

msiexec.exe

description	ioc	Process
File opened for modification	C:\Windows\Installer\f75e5fb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE762.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF0F7.tmp	msiexec.exe
File created	C:\Windows\Installer\f75e5fb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBB8.tmp	msiexec.exe
File created	C:\Windows\Installer\f75e5fd.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF126.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF222.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f75e5fd.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEB4A.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exe

pid	Process
1784	schtasks.exe

Enumerates system info in registry 2 TTPs 32 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

csrss.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe

Modifies data under HKEY_USERS 9 IoCs

Processes:

winlogon.exe

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize"	winlogon.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	13	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 29 IoCs

Processes:

msiexec.exelKGhCvzKoMrc.exe

pid	Process
568	msiexec.exe
568	msiexec.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

lKGhCvzKoMrc.exe

pid	Process
1400	lKGhCvzKoMrc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exeWMIC.exe

description	pid	Process
Token: SeShutdownPrivilege	1668	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1668	msiexec.exe
Token: SeRestorePrivilege	568	msiexec.exe
Token: SeTakeOwnershipPrivilege	568	msiexec.exe
Token: SeSecurityPrivilege	568	msiexec.exe
Token: SeCreateTokenPrivilege	1668	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1668	msiexec.exe
Token: SeLockMemoryPrivilege	1668	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1668	msiexec.exe
Token: SeMachineAccountPrivilege	1668	msiexec.exe
Token: SeTcbPrivilege	1668	msiexec.exe
Token: SeSecurityPrivilege	1668	msiexec.exe
Token: SeTakeOwnershipPrivilege	1668	msiexec.exe
Token: SeLoadDriverPrivilege	1668	msiexec.exe
Token: SeSystemProfilePrivilege	1668	msiexec.exe
Token: SeSystemtimePrivilege	1668	msiexec.exe
Token: SeProfSingleProcessPrivilege	1668	msiexec.exe
Token: SeIncBasePriorityPrivilege	1668	msiexec.exe
Token: SeCreatePagefilePrivilege	1668	msiexec.exe
Token: SeCreatePermanentPrivilege	1668	msiexec.exe
Token: SeBackupPrivilege	1668	msiexec.exe
Token: SeRestorePrivilege	1668	msiexec.exe
Token: SeShutdownPrivilege	1668	msiexec.exe
Token: SeDebugPrivilege	1668	msiexec.exe
Token: SeAuditPrivilege	1668	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1668	msiexec.exe
Token: SeChangeNotifyPrivilege	1668	msiexec.exe
Token: SeRemoteShutdownPrivilege	1668	msiexec.exe
Token: SeUndockPrivilege	1668	msiexec.exe
Token: SeSyncAgentPrivilege	1668	msiexec.exe
Token: SeEnableDelegationPrivilege	1668	msiexec.exe
Token: SeManageVolumePrivilege	1668	msiexec.exe
Token: SeImpersonatePrivilege	1668	msiexec.exe
Token: SeCreateGlobalPrivilege	1668	msiexec.exe
Token: SeRestorePrivilege	568	msiexec.exe
Token: SeTakeOwnershipPrivilege	568	msiexec.exe
Token: SeRestorePrivilege	568	msiexec.exe
Token: SeTakeOwnershipPrivilege	568	msiexec.exe
Token: SeRestorePrivilege	568	msiexec.exe
Token: SeTakeOwnershipPrivilege	568	msiexec.exe
Token: SeRestorePrivilege	568	msiexec.exe
Token: SeTakeOwnershipPrivilege	568	msiexec.exe
Token: SeRestorePrivilege	568	msiexec.exe
Token: SeTakeOwnershipPrivilege	568	msiexec.exe
Token: SeRestorePrivilege	568	msiexec.exe
Token: SeTakeOwnershipPrivilege	568	msiexec.exe
Token: SeRestorePrivilege	568	msiexec.exe
Token: SeTakeOwnershipPrivilege	568	msiexec.exe
Token: SeRestorePrivilege	568	msiexec.exe
Token: SeTakeOwnershipPrivilege	568	msiexec.exe
Token: SeRestorePrivilege	568	msiexec.exe
Token: SeTakeOwnershipPrivilege	568	msiexec.exe
Token: SeRestorePrivilege	568	msiexec.exe
Token: SeTakeOwnershipPrivilege	568	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1956	WMIC.exe
Token: SeSecurityPrivilege	1956	WMIC.exe
Token: SeTakeOwnershipPrivilege	1956	WMIC.exe
Token: SeLoadDriverPrivilege	1956	WMIC.exe
Token: SeSystemProfilePrivilege	1956	WMIC.exe
Token: SeSystemtimePrivilege	1956	WMIC.exe
Token: SeProfSingleProcessPrivilege	1956	WMIC.exe
Token: SeIncBasePriorityPrivilege	1956	WMIC.exe
Token: SeCreatePagefilePrivilege	1956	WMIC.exe
Token: SeBackupPrivilege	1956	WMIC.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msiexec.exeMsiExec.exe

pid	Process
1668	msiexec.exe
596	MsiExec.exe
1668	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

lKGhCvzKoMrc.exe

pid	Process
1400	lKGhCvzKoMrc.exe
1400	lKGhCvzKoMrc.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

msiexec.exeMsiExec.exelKGhCvzKoMrc.execmd.execsrss.exewinlogon.exe

description	pid	Process	procid_target
PID 568 wrote to memory of 596	568	msiexec.exe	29
PID 568 wrote to memory of 596	568	msiexec.exe	29
PID 568 wrote to memory of 596	568	msiexec.exe	29
PID 568 wrote to memory of 596	568	msiexec.exe	29
PID 568 wrote to memory of 596	568	msiexec.exe	29
PID 568 wrote to memory of 596	568	msiexec.exe	29
PID 568 wrote to memory of 596	568	msiexec.exe	29
PID 596 wrote to memory of 1956	596	MsiExec.exe	32
PID 596 wrote to memory of 1956	596	MsiExec.exe	32
PID 596 wrote to memory of 1956	596	MsiExec.exe	32
PID 596 wrote to memory of 1956	596	MsiExec.exe	32
PID 1400 wrote to memory of 1000	1400	lKGhCvzKoMrc.exe	38
PID 1400 wrote to memory of 1000	1400	lKGhCvzKoMrc.exe	38
PID 1400 wrote to memory of 1000	1400	lKGhCvzKoMrc.exe	38
PID 1400 wrote to memory of 1000	1400	lKGhCvzKoMrc.exe	38
PID 1000 wrote to memory of 1784	1000	cmd.exe	40
PID 1000 wrote to memory of 1784	1000	cmd.exe	40
PID 1000 wrote to memory of 1784	1000	cmd.exe	40
PID 1000 wrote to memory of 1784	1000	cmd.exe	40
PID 1440 wrote to memory of 1912	1440	csrss.exe	48
PID 1440 wrote to memory of 1912	1440	csrss.exe	48
PID 1464 wrote to memory of 1912	1464	winlogon.exe	48
PID 1464 wrote to memory of 1912	1464	winlogon.exe	48
PID 1464 wrote to memory of 1912	1464	winlogon.exe	48
PID 1440 wrote to memory of 1912	1440	csrss.exe	48
PID 1440 wrote to memory of 1912	1440	csrss.exe	48
PID 1440 wrote to memory of 1912	1440	csrss.exe	48
PID 1440 wrote to memory of 1912	1440	csrss.exe	48
PID 1440 wrote to memory of 1912	1440	csrss.exe	48
PID 1440 wrote to memory of 1912	1440	csrss.exe	48
PID 1440 wrote to memory of 1912	1440	csrss.exe	48
PID 1440 wrote to memory of 1912	1440	csrss.exe	48
PID 1440 wrote to memory of 1912	1440	csrss.exe	48

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\download.dat.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1668

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:568
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A5E951C4B1DD54D434E13CCED01C46A0
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:596
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    "C:\Windows\System32\Wbem\WMIC.exe" process call create 'C:\Users\Admin\OlCZLjuyNteA\lKGhCvzKoMrc.exe'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1956

C:\Users\Admin\OlCZLjuyNteA\lKGhCvzKoMrc.exe
C:\Users\Admin\OlCZLjuyNteA\lKGhCvzKoMrc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C schtasks /CREATE /TN "visual-estudio " /TR C:\\Users\Admin\OlCZLjuyNteA\lKGhCvzKoMrc.exe /SC minute /MO 2 /IT /RU %USERNAME%
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "visual-estudio " /TR C:\\Users\Admin\OlCZLjuyNteA\lKGhCvzKoMrc.exe /SC minute /MO 2 /IT /RU Admin
    3⤵
    - Creates scheduled task(s)
    PID:1784

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x5b0
1⤵
PID:528

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1496

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2020

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1440

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\system32\LogonUI.exe
  "LogonUI.exe" /flags:0x0
  2⤵
  PID:1912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5
58dfae01aa00545d2234403fed2fe071

SHA1
39e0fec80455c172842ae29c6f32dfd9f9af6734

SHA256
b1b1fa0d5200580ae32fedbea71a1518bca977e854eb4c39cbfd6878533c4399

SHA512
02eddbbcc5bd98be2fa20fc509ba5822091a3bd3024f5ee0c5ff1fc9615a6406e698bdb536ab47f1cd5ec18d19c93e9ea86e27b33b72339d57b51d10143f0558

Download Submit
C:\Users\Admin\OlCZLjuyNteA\Core.dll

MD5
8198bb1b12b41a286c7bbfa51fc45e46

SHA1
6c954fea8676904c0999f179bab8067896e9a14a

SHA256
d37968ee7da25c83b9417218249d13a3cd177d8f30e012246a0ac4e32a307c77

SHA512
a385332fdfa5d032283624cbf2e56f9b3618bac3a6b2cd96a0ce3923ebde8db5e27694d25f6d0ff22c1baa2ad458c12584ca3e067762e021f99479f9e732d703

Download Submit
C:\Users\Admin\OlCZLjuyNteA\Host.hst

MD5
f005db88d45289a876e941615c171fd1

SHA1
8224657600e5d0997bb055be00b871cae82eff54

SHA256
1435322e9866f6654eaee12fdd8f9004c8e57654900671101f85501590b248df

SHA512
f262df6afa9d7474eb7db8b0805639f6642ff0900c02161ba46c235ec3144bcf0dcedac67f6a40577a42f28c5e218e46b90dea18e52f1e7661f04f8a95a5e3a6

Download Submit
C:\Users\Admin\OlCZLjuyNteA\VoiceRemover.dll

MD5
f82d4f0dae5b9fec3a2c9eda117a3e7d

SHA1
a85ecba1354fa9fe9c1df86ecd0f6c4f97fb55c5

SHA256
81f82b73951aadbf02acc849bf0f262e74c0b274db73a188e2016154f0bff0e5

SHA512
d2eb4b2d54666dada213fbd67ef92d980b180fc10f29e044fb1c0ff6adb74d7be412ef20a902a8c8deab5ba6dcf55c846de13cf40cd27f5baefac3663944c0cb

Download Submit
C:\Users\Admin\OlCZLjuyNteA\bass.dll

MD5
c0b11a7e60f69241ddcb278722ab962f

SHA1
ff855961eb5ed8779498915bab3d642044fc9bb1

SHA256
a8d979460e970e84eacce36b8a68ae5f6b9cc0fe16e05a6209b4ead52b81b021

SHA512
cb040aca6592310bffb72c898b8eb3ca8a46ff2df50212634c637593c58683c8ab62e0188da7aea362e1b063ae5db55cf4bf474295922af0ab94a526465cc472

Download Submit
C:\Users\Admin\OlCZLjuyNteA\bass_fx.dll

MD5
ea245b00b9d27ef2bd96548a50a9cc2c

SHA1
8463fdcdd5ced10c519ee0b406408ae55368e094

SHA256
4824a06b819cbe49c485d68a9802d9dae3e3c54d4c2d8b706c8a87b56ceefbf3

SHA512
ef1e107571402925ab5b1d9b096d7ceff39c1245a23692a3976164d0de0314f726cca0cb10246fe58a13618fd5629a92025628373b3264153fc1d79b0415d9a7

Download Submit
C:\Users\Admin\OlCZLjuyNteA\bassenc.dll

MD5
55bb778fba7c0e7680d9536c26faff11

SHA1
228b4cc2e25ab11d6d17511d2dcf54481589777c

SHA256
71b779210d17cb75342fd229c6355a833927a76a9de3face5b88b3b18c345133

SHA512
be4089ceb47469d1d89707eb5ae79fb474a505886bcd83c662ebd6ac9cae92cc03b9689cb937c5df5862e6c3f1e0495e5011d59521a910dd3277527ac424c155

Download Submit
C:\Users\Admin\OlCZLjuyNteA\bassmidi.dll

MD5
a80d21f0f613d193812852cabf188f21

SHA1
2b26a05410a244e0558f9b89f2bcd32fdb8eee98

SHA256
d6ad7018468d2a67b892077dbbc77d7d5b55fec2f1d8de15b4c414a29753fd33

SHA512
da4a7afe65f5adb5a1214d901bb7aa8c736ff7863a696963ef31585a11846bf246efc5bd6c6266bb98c5e1368691468ca4bc849ca2cc1fe1d578eead783204e7

Download Submit
C:\Users\Admin\OlCZLjuyNteA\bassmix.dll

MD5
2358e10faa66a1c38caf7c3bcecf3386

SHA1
17a05b02fbb619a874996c32267fb49a19335eb4

SHA256
b0197e1bae8448c4e334e1e8706be354d79b3a700860e9c2589905fb74b8672a

SHA512
6801931659430be3996686a7466bb9dc2692499521b6d165cd1002616609833d119d17c30b1ba7fae50e8ca95bda5961115eee4ed47db25e0e69f423562f2eeb

Download Submit
C:\Users\Admin\OlCZLjuyNteA\lKGhCvzKoMrc.exe

MD5
113badfe1404cd59640cad6b409acb98

SHA1
2621f79b2143ae3704e814756e01d326d5145a5a

SHA256
35a42f9ea63f72cda8a6c7af60a3fac081154128cba2bf7a7392d85383b6d18a

SHA512
f861e831b8311094e32071191585eaceaa512d2bc42096e243a1f94309546614cd788231ce08484039bc70c41824f6c6055b9add233b4793a79f3f399b3cbafb

Download Submit
C:\Users\Admin\OlCZLjuyNteA\lKGhCvzKoMrc.exe

MD5
113badfe1404cd59640cad6b409acb98

SHA1
2621f79b2143ae3704e814756e01d326d5145a5a

SHA256
35a42f9ea63f72cda8a6c7af60a3fac081154128cba2bf7a7392d85383b6d18a

SHA512
f861e831b8311094e32071191585eaceaa512d2bc42096e243a1f94309546614cd788231ce08484039bc70c41824f6c6055b9add233b4793a79f3f399b3cbafb

Download Submit
C:\Users\Admin\OlCZLjuyNteA\win_sparkle_check_update_with_ui_and_install

MD5
1c8fa0a3230525dd56e5c51243f96fef

SHA1
b995548f039250057d257107e858135d6502fb00

SHA256
a8211a5c9c3acb0bc6cf3c8da70039ef52da42b8730dc5f9997318b2e6110eca

SHA512
0e4622f20c6a2814979b01d883378e3b2087975b6c4e6bd1a88842727c351e11cead4d32d5e5d2c19e1acb2155ad4bcb191030347e70c495ab5a82832b41f11d

Download Submit
C:\Windows\Installer\MSIE762.tmp

MD5
d90ab57e6c584f90fbbea74b566216e3

SHA1
4616e59aed33848f5870e5e1fe865f932721a162

SHA256
44ffc4959be0ddb18b02d59c75e78e3e721992e362a2f90cae19adb3271886b9

SHA512
5b13fe1e34f4ec05ccacaf57fc67f49993e5d950e5396e715686749ddae0b18d5f2d70b3cd3a9ada3389db269213e915f19fd10a54330eaecd765475844e6695

Download Submit
C:\Windows\Installer\MSIEB4A.tmp

MD5
d90ab57e6c584f90fbbea74b566216e3

SHA1
4616e59aed33848f5870e5e1fe865f932721a162

SHA256
44ffc4959be0ddb18b02d59c75e78e3e721992e362a2f90cae19adb3271886b9

SHA512
5b13fe1e34f4ec05ccacaf57fc67f49993e5d950e5396e715686749ddae0b18d5f2d70b3cd3a9ada3389db269213e915f19fd10a54330eaecd765475844e6695

Download Submit
C:\Windows\Installer\MSIEBB8.tmp

MD5
d90ab57e6c584f90fbbea74b566216e3

SHA1
4616e59aed33848f5870e5e1fe865f932721a162

SHA256
44ffc4959be0ddb18b02d59c75e78e3e721992e362a2f90cae19adb3271886b9

SHA512
5b13fe1e34f4ec05ccacaf57fc67f49993e5d950e5396e715686749ddae0b18d5f2d70b3cd3a9ada3389db269213e915f19fd10a54330eaecd765475844e6695

Download Submit
C:\Windows\Installer\MSIF126.tmp

MD5
06bf05c1b207c1340db60571ee6ef552

SHA1
64b9ad03c6827a320633336c5e53c974d950ef67

SHA256
2ffdeb634dcd556e84b56d8546f5f4840b9b2c14706290230f37bb43b15da901

SHA512
a66bda9de66a30495bf592f80b8bdae1b1b6340c37a2f6eb3fabf881a1cf107b626968df42ae319cb0cd5e27b88f0c6fe753f2cc57637430b217855108bc9b81

Download Submit
C:\Windows\Installer\MSIF222.tmp

MD5
06bf05c1b207c1340db60571ee6ef552

SHA1
64b9ad03c6827a320633336c5e53c974d950ef67

SHA256
2ffdeb634dcd556e84b56d8546f5f4840b9b2c14706290230f37bb43b15da901

SHA512
a66bda9de66a30495bf592f80b8bdae1b1b6340c37a2f6eb3fabf881a1cf107b626968df42ae319cb0cd5e27b88f0c6fe753f2cc57637430b217855108bc9b81

Download Submit
\Users\Admin\OlCZLjuyNteA\Core.dll

MD5
8198bb1b12b41a286c7bbfa51fc45e46

SHA1
6c954fea8676904c0999f179bab8067896e9a14a

SHA256
d37968ee7da25c83b9417218249d13a3cd177d8f30e012246a0ac4e32a307c77

SHA512
a385332fdfa5d032283624cbf2e56f9b3618bac3a6b2cd96a0ce3923ebde8db5e27694d25f6d0ff22c1baa2ad458c12584ca3e067762e021f99479f9e732d703

Download Submit
\Users\Admin\OlCZLjuyNteA\VoiceRemover.dll

MD5
f82d4f0dae5b9fec3a2c9eda117a3e7d

SHA1
a85ecba1354fa9fe9c1df86ecd0f6c4f97fb55c5

SHA256
81f82b73951aadbf02acc849bf0f262e74c0b274db73a188e2016154f0bff0e5

SHA512
d2eb4b2d54666dada213fbd67ef92d980b180fc10f29e044fb1c0ff6adb74d7be412ef20a902a8c8deab5ba6dcf55c846de13cf40cd27f5baefac3663944c0cb

Download Submit
\Users\Admin\OlCZLjuyNteA\bass.dll

MD5
c0b11a7e60f69241ddcb278722ab962f

SHA1
ff855961eb5ed8779498915bab3d642044fc9bb1

SHA256
a8d979460e970e84eacce36b8a68ae5f6b9cc0fe16e05a6209b4ead52b81b021

SHA512
cb040aca6592310bffb72c898b8eb3ca8a46ff2df50212634c637593c58683c8ab62e0188da7aea362e1b063ae5db55cf4bf474295922af0ab94a526465cc472

Download Submit
\Users\Admin\OlCZLjuyNteA\bass_fx.dll

MD5
ea245b00b9d27ef2bd96548a50a9cc2c

SHA1
8463fdcdd5ced10c519ee0b406408ae55368e094

SHA256
4824a06b819cbe49c485d68a9802d9dae3e3c54d4c2d8b706c8a87b56ceefbf3

SHA512
ef1e107571402925ab5b1d9b096d7ceff39c1245a23692a3976164d0de0314f726cca0cb10246fe58a13618fd5629a92025628373b3264153fc1d79b0415d9a7

Download Submit
\Users\Admin\OlCZLjuyNteA\bassenc.dll

MD5
55bb778fba7c0e7680d9536c26faff11

SHA1
228b4cc2e25ab11d6d17511d2dcf54481589777c

SHA256
71b779210d17cb75342fd229c6355a833927a76a9de3face5b88b3b18c345133

SHA512
be4089ceb47469d1d89707eb5ae79fb474a505886bcd83c662ebd6ac9cae92cc03b9689cb937c5df5862e6c3f1e0495e5011d59521a910dd3277527ac424c155

Download Submit
\Users\Admin\OlCZLjuyNteA\bassmidi.dll

MD5
a80d21f0f613d193812852cabf188f21

SHA1
2b26a05410a244e0558f9b89f2bcd32fdb8eee98

SHA256
d6ad7018468d2a67b892077dbbc77d7d5b55fec2f1d8de15b4c414a29753fd33

SHA512
da4a7afe65f5adb5a1214d901bb7aa8c736ff7863a696963ef31585a11846bf246efc5bd6c6266bb98c5e1368691468ca4bc849ca2cc1fe1d578eead783204e7

Download Submit
\Users\Admin\OlCZLjuyNteA\bassmix.dll

MD5
2358e10faa66a1c38caf7c3bcecf3386

SHA1
17a05b02fbb619a874996c32267fb49a19335eb4

SHA256
b0197e1bae8448c4e334e1e8706be354d79b3a700860e9c2589905fb74b8672a

SHA512
6801931659430be3996686a7466bb9dc2692499521b6d165cd1002616609833d119d17c30b1ba7fae50e8ca95bda5961115eee4ed47db25e0e69f423562f2eeb

Download Submit
\Windows\Installer\MSIE762.tmp

MD5
d90ab57e6c584f90fbbea74b566216e3

SHA1
4616e59aed33848f5870e5e1fe865f932721a162

SHA256
44ffc4959be0ddb18b02d59c75e78e3e721992e362a2f90cae19adb3271886b9

SHA512
5b13fe1e34f4ec05ccacaf57fc67f49993e5d950e5396e715686749ddae0b18d5f2d70b3cd3a9ada3389db269213e915f19fd10a54330eaecd765475844e6695

Download Submit
\Windows\Installer\MSIEB4A.tmp

MD5
d90ab57e6c584f90fbbea74b566216e3

SHA1
4616e59aed33848f5870e5e1fe865f932721a162

SHA256
44ffc4959be0ddb18b02d59c75e78e3e721992e362a2f90cae19adb3271886b9

SHA512
5b13fe1e34f4ec05ccacaf57fc67f49993e5d950e5396e715686749ddae0b18d5f2d70b3cd3a9ada3389db269213e915f19fd10a54330eaecd765475844e6695

Download Submit
\Windows\Installer\MSIEBB8.tmp

MD5
d90ab57e6c584f90fbbea74b566216e3

SHA1
4616e59aed33848f5870e5e1fe865f932721a162

SHA256
44ffc4959be0ddb18b02d59c75e78e3e721992e362a2f90cae19adb3271886b9

SHA512
5b13fe1e34f4ec05ccacaf57fc67f49993e5d950e5396e715686749ddae0b18d5f2d70b3cd3a9ada3389db269213e915f19fd10a54330eaecd765475844e6695

Download Submit
\Windows\Installer\MSIF126.tmp

MD5
06bf05c1b207c1340db60571ee6ef552

SHA1
64b9ad03c6827a320633336c5e53c974d950ef67

SHA256
2ffdeb634dcd556e84b56d8546f5f4840b9b2c14706290230f37bb43b15da901

SHA512
a66bda9de66a30495bf592f80b8bdae1b1b6340c37a2f6eb3fabf881a1cf107b626968df42ae319cb0cd5e27b88f0c6fe753f2cc57637430b217855108bc9b81

Download Submit
\Windows\Installer\MSIF222.tmp

MD5
06bf05c1b207c1340db60571ee6ef552

SHA1
64b9ad03c6827a320633336c5e53c974d950ef67

SHA256
2ffdeb634dcd556e84b56d8546f5f4840b9b2c14706290230f37bb43b15da901

SHA512
a66bda9de66a30495bf592f80b8bdae1b1b6340c37a2f6eb3fabf881a1cf107b626968df42ae319cb0cd5e27b88f0c6fe753f2cc57637430b217855108bc9b81

Download Submit
memory/596-58-0x0000000075C21000-0x0000000075C23000-memory.dmp

Filesize
8KB

Download
memory/596-57-0x0000000000000000-mapping.dmp

Download
memory/596-69-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/1000-160-0x0000000000000000-mapping.dmp

Download
memory/1400-109-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-125-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-93-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-91-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Filesize
4KB

Download
memory/1400-94-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/1400-95-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-96-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

Filesize
4KB

Download
memory/1400-97-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-98-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-100-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-99-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

Filesize
4KB

Download
memory/1400-101-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-102-0x0000000000D00000-0x0000000000D01000-memory.dmp

Filesize
4KB

Download
memory/1400-103-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-104-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-105-0x0000000000D10000-0x0000000000D11000-memory.dmp

Filesize
4KB

Download
memory/1400-106-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-107-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-108-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/1400-79-0x0000000000E40000-0x00000000011E6000-memory.dmp

Filesize
3.6MB

Download
memory/1400-110-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-111-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/1400-112-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-113-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-114-0x0000000002730000-0x0000000002731000-memory.dmp

Filesize
4KB

Download
memory/1400-115-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-116-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-117-0x0000000002740000-0x0000000002741000-memory.dmp

Filesize
4KB

Download
memory/1400-118-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-119-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-120-0x0000000002750000-0x0000000002751000-memory.dmp

Filesize
4KB

Download
memory/1400-121-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-123-0x0000000002760000-0x0000000002761000-memory.dmp

Filesize
4KB

Download
memory/1400-124-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-122-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-92-0x0000000000280000-0x0000000000284000-memory.dmp

Filesize
16KB

Download
memory/1400-126-0x0000000002770000-0x0000000002771000-memory.dmp

Filesize
4KB

Download
memory/1400-127-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-128-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-129-0x00000000028F0000-0x00000000028F1000-memory.dmp

Filesize
4KB

Download
memory/1400-131-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-130-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-132-0x0000000002900000-0x0000000002901000-memory.dmp

Filesize
4KB

Download
memory/1400-133-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-134-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-135-0x0000000002910000-0x0000000002911000-memory.dmp

Filesize
4KB

Download
memory/1400-136-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-137-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-138-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/1400-139-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-140-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-141-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1400-142-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-143-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-144-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

Filesize
4KB

Download
memory/1400-145-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-146-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-147-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Filesize
4KB

Download
memory/1400-148-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-149-0x0000000002C90000-0x0000000002DD0000-memory.dmp

Filesize
1.2MB

Download
memory/1400-153-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1400-90-0x00000000752C0000-0x00000000752CC000-memory.dmp

Filesize
48KB

Download
memory/1400-89-0x0000000000270000-0x0000000000288000-memory.dmp

Filesize
96KB

Download
memory/1400-157-0x0000000004CA1000-0x00000000050DF000-memory.dmp

Filesize
4.2MB

Download
memory/1400-158-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1400-159-0x0000000003E90000-0x0000000003E91000-memory.dmp

Filesize
4KB

Download
memory/1400-88-0x0000000075370000-0x00000000753C0000-memory.dmp

Filesize
320KB

Download
memory/1668-55-0x000007FEFC481000-0x000007FEFC483000-memory.dmp

Filesize
8KB

Download
memory/1784-161-0x0000000000000000-mapping.dmp

Download
memory/1912-190-0x0000000000000000-mapping.dmp

Download
memory/1956-70-0x0000000000000000-mapping.dmp

Download
memory/2020-176-0x00000000028C0000-0x00000000028C1000-memory.dmp

Filesize
4KB

Download