bb1d3df26a6c9f8b1ec1608e1d177a2407ddc0efa7455ba7a68ab2f50f5381f6

Analysis

max time kernel
1800s
max time network
1563s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17/09/2022, 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bad (2).js
Size

16.9MB
MD5

0a1eb91d290587e3f154e85a83d1b222
SHA1

417386e69759d61b9b3db947ffacc2dd192c7740
SHA256

bb1d3df26a6c9f8b1ec1608e1d177a2407ddc0efa7455ba7a68ab2f50f5381f6
SHA512

cad902e0d8bd106707247197907d72eb9a2cf19ed6a99ccb3a41af5fbc9569fedfe2f228b5d2a39e6f551a1eccca01d1bf8a00f1c2583ee70b90c8e5d77d0820
SSDEEP

49152:vvMl5ImrlOdPoXywnePgUfhZIc0fRGlMtz2nexWlgMrZiQGP:i

Score

8^/10

discovery persistence spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
36	2620	wscript.exe
38	2620	wscript.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eecbefbcae57030 = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass -windowstyle hidden -Command \"IEX([Environment]::GetEnvironmentVariable('57030eecbefbcae', 'User'))\""	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	cscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\64673eecbefbcae = "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass -windowstyle hidden -Command \"IEX([Environment]::GetEnvironmentVariable('64673eecbefbcae', 'User'))\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\10528eecbefbcae = "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass -windowstyle hidden -Command \"IEX([Environment]::GetEnvironmentVariable('10528eecbefbcae', 'User'))\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eecbefbcae93424 = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass -windowstyle hidden -Command \"IEX([Environment]::GetEnvironmentVariable('93424eecbefbcae', 'User'))\""	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eecbefbcae4460 = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass -windowstyle hidden -Command \"IEX([Environment]::GetEnvironmentVariable('4460eecbefbcae', 'User'))\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\57030eecbefbcae = "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass -windowstyle hidden -Command \"IEX([Environment]::GetEnvironmentVariable('57030eecbefbcae', 'User'))\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eecbefbcae41070 = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass -windowstyle hidden -Command \"IEX([Environment]::GetEnvironmentVariable('41070eecbefbcae', 'User'))\""	cscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eecbefbcae10528 = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass -windowstyle hidden -Command \"IEX([Environment]::GetEnvironmentVariable('10528eecbefbcae', 'User'))\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\93424eecbefbcae = "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass -windowstyle hidden -Command \"IEX([Environment]::GetEnvironmentVariable('93424eecbefbcae', 'User'))\""	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eecbefbcae64673 = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass -windowstyle hidden -Command \"IEX([Environment]::GetEnvironmentVariable('64673eecbefbcae', 'User'))\""	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4460eecbefbcae = "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass -windowstyle hidden -Command \"IEX([Environment]::GetEnvironmentVariable('4460eecbefbcae', 'User'))\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\41070eecbefbcae = "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Bypass -windowstyle hidden -Command \"IEX([Environment]::GetEnvironmentVariable('41070eecbefbcae', 'User'))\""	cscript.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1124	336	WerFault.exe	7
3708	4492	WerFault.exe	115

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	Process not Found

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	wscript.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2620	wscript.exe
916	powershell.exe
4816	powershell.exe
4276	powershell.exe
1116	powershell.exe
4492	powershell.exe
1556	powershell.exe
460	powershell.exe
4792	powershell.exe
2016	powershell.exe
2016	powershell.exe
4768	powershell.exe
916	powershell.exe
916	powershell.exe
4816	powershell.exe
4816	powershell.exe
4276	powershell.exe
4276	powershell.exe
1116	powershell.exe
1116	powershell.exe
4792	powershell.exe
4792	powershell.exe
1556	powershell.exe
1556	powershell.exe
4492	powershell.exe
4492	powershell.exe
460	powershell.exe
460	powershell.exe
2016	powershell.exe
4768	powershell.exe
4768	powershell.exe
4320	powershell.exe
4320	powershell.exe
5056	powershell.exe
5056	powershell.exe
4320	Process not Found
5056	Process not Found

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
4460	Process not Found
916	Process not Found
3520	Process not Found
1056	Process not Found
4216	Process not Found
2404	Process not Found
1500	Process not Found
2020	Process not Found
2324	Process not Found
2932	Process not Found
696	Process not Found
3756	Process not Found
2396	Process not Found
3380	Process not Found
3976	Process not Found
3172	Process not Found
4300	Process not Found
2660	Process not Found
3552	Process not Found
5052	Process not Found
1124	Process not Found
1264	Process not Found
4936	Process not Found
2708	Process not Found
2204	Process not Found
1104	Process not Found
1212	Process not Found
1208	Process not Found
1252	Process not Found
1484	Process not Found
1260	Process not Found
1120	Process not Found
4372	Process not Found
4636	Process not Found
4264	Process not Found
2356	Process not Found
2132	Process not Found
3852	Process not Found
3548	Process not Found
4708	Process not Found
3524	Process not Found
4940	Process not Found
4960	Process not Found
4136	Process not Found
1084	Process not Found
4664	Process not Found
4524	Process not Found
4548	Process not Found
3972	Process not Found
4268	Process not Found
4188	Process not Found
3036	Process not Found
1476	Process not Found
1016	Process not Found
644	Process not Found
2968	Process not Found
1236	Process not Found
5072	Process not Found
3120	Process not Found
3236	Process not Found
2308	Process not Found
4040	Process not Found
3312	Process not Found
2628	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2620	wscript.exe
Token: SeDebugPrivilege	916	powershell.exe
Token: SeDebugPrivilege	4816	powershell.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeDebugPrivilege	4492	powershell.exe
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeDebugPrivilege	460	powershell.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeDebugPrivilege	4320	powershell.exe
Token: SeDebugPrivilege	5056	powershell.exe
Token: SeCreateGlobalPrivilege	2956	Process not Found
Token: SeChangeNotifyPrivilege	2956	Process not Found
Token: 33	2956	Process not Found
Token: SeIncBasePriorityPrivilege	2956	Process not Found
Token: SeCreateGlobalPrivilege	384	Process not Found
Token: SeChangeNotifyPrivilege	384	Process not Found
Token: 33	384	Process not Found
Token: SeIncBasePriorityPrivilege	384	Process not Found

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 4820	2620	wscript.exe	88
PID 2620 wrote to memory of 4820	2620	wscript.exe	88
PID 2620 wrote to memory of 64	2620	wscript.exe	89
PID 2620 wrote to memory of 64	2620	wscript.exe	89
PID 2620 wrote to memory of 4728	2620	wscript.exe	90
PID 2620 wrote to memory of 4728	2620	wscript.exe	90
PID 2620 wrote to memory of 4984	2620	wscript.exe	91
PID 2620 wrote to memory of 4984	2620	wscript.exe	91
PID 2620 wrote to memory of 2900	2620	wscript.exe	92
PID 2620 wrote to memory of 2900	2620	wscript.exe	92
PID 2620 wrote to memory of 3536	2620	wscript.exe	93
PID 2620 wrote to memory of 3536	2620	wscript.exe	93
PID 2620 wrote to memory of 4204	2620	wscript.exe	94
PID 2620 wrote to memory of 4204	2620	wscript.exe	94
PID 2620 wrote to memory of 3236	2620	wscript.exe	95
PID 2620 wrote to memory of 3236	2620	wscript.exe	95
PID 2620 wrote to memory of 2472	2620	wscript.exe	96
PID 2620 wrote to memory of 2472	2620	wscript.exe	96
PID 2620 wrote to memory of 2708	2620	wscript.exe	97
PID 2620 wrote to memory of 2708	2620	wscript.exe	97
PID 2620 wrote to memory of 4168	2620	wscript.exe	98
PID 2620 wrote to memory of 4168	2620	wscript.exe	98
PID 2620 wrote to memory of 2612	2620	wscript.exe	99
PID 2620 wrote to memory of 2612	2620	wscript.exe	99
PID 2620 wrote to memory of 1696	2620	wscript.exe	100
PID 2620 wrote to memory of 1696	2620	wscript.exe	100
PID 2620 wrote to memory of 4500	2620	wscript.exe	101
PID 2620 wrote to memory of 4500	2620	wscript.exe	101
PID 4984 wrote to memory of 2040	4984	WScript.exe	102
PID 4984 wrote to memory of 2040	4984	WScript.exe	102
PID 4728 wrote to memory of 4816	4728	WScript.exe	104
PID 4728 wrote to memory of 4816	4728	WScript.exe	104
PID 4728 wrote to memory of 4816	4728	WScript.exe	104
PID 4728 wrote to memory of 916	4728	WScript.exe	106
PID 4728 wrote to memory of 916	4728	WScript.exe	106
PID 4168 wrote to memory of 1116	4168	WScript.exe	108
PID 4168 wrote to memory of 1116	4168	WScript.exe	108
PID 4168 wrote to memory of 1116	4168	WScript.exe	108
PID 4168 wrote to memory of 4276	4168	WScript.exe	110
PID 4168 wrote to memory of 4276	4168	WScript.exe	110
PID 1696 wrote to memory of 4492	1696	WScript.exe	115
PID 1696 wrote to memory of 4492	1696	WScript.exe	115
PID 1696 wrote to memory of 4492	1696	WScript.exe	115
PID 2612 wrote to memory of 460	2612	WScript.exe	114
PID 2612 wrote to memory of 460	2612	WScript.exe	114
PID 2612 wrote to memory of 460	2612	WScript.exe	114
PID 1696 wrote to memory of 1556	1696	WScript.exe	113
PID 1696 wrote to memory of 1556	1696	WScript.exe	113
PID 2612 wrote to memory of 4792	2612	WScript.exe	116
PID 2612 wrote to memory of 4792	2612	WScript.exe	116
PID 4500 wrote to memory of 4768	4500	WScript.exe	119
PID 4500 wrote to memory of 4768	4500	WScript.exe	119
PID 4500 wrote to memory of 4768	4500	WScript.exe	119
PID 4500 wrote to memory of 2016	4500	WScript.exe	122
PID 4500 wrote to memory of 2016	4500	WScript.exe	122
PID 2040 wrote to memory of 4320	2040	cscript.exe	124
PID 2040 wrote to memory of 4320	2040	cscript.exe	124
PID 2040 wrote to memory of 4320	2040	cscript.exe	124
PID 2040 wrote to memory of 5056	2040	cscript.exe	126
PID 2040 wrote to memory of 5056	2040	cscript.exe	126
PID 4792 wrote to memory of 4388	4792	Process not Found	131
PID 4792 wrote to memory of 4388	4792	Process not Found	131

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\bad (2).js"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\unimcumbern.js"
  2⤵
  PID:4820
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\unimcumbern2.js"
  2⤵
  PID:64
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ascjkncaskew.js"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "IEX([Environment]::GetEnvironmentVariable('64673eecbefbcae', 'User'))"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "IEX([Environment]::GetEnvironmentVariable('64673eecbefbcae', 'User'))"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:916
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ackjbasdcbjkdebfeq.js"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\System32\cscript.exe
    "C:\Windows\System32\cscript.exe" -e:{F414C262-6AC0-11CF-B6D1-00AA00BBBB58} C:\Users\Admin\AppData\Local\Temp\ackjbasdcbjkdebfeq.js
    3⤵
    - Checks computer location settings
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "IEX([Environment]::GetEnvironmentVariable('41070eecbefbcae', 'User'))"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4320
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "IEX([Environment]::GetEnvironmentVariable('41070eecbefbcae', 'User'))"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5056
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\By0HWwdJuVCpJZLGG6K0.js"
  2⤵
  PID:2900
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fyTBNtRD86e7YxN8Bg6Z.js"
  2⤵
  PID:3536
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\v8UTQInQ4riGEfymPOY1.js"
  2⤵
  PID:4204
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Y6hq6beYYNKAKtLs9nWi.js"
  2⤵
  PID:3236
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\S6XogndmP4wJ0Y8A5mWI.js"
  2⤵
  PID:2472
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\j5XLkEMI6Ab4MCTMsiUJ.js"
  2⤵
  PID:2708
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\q2EoIIRtkGyoNzBV67pp.js"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "IEX([Environment]::GetEnvironmentVariable('10528eecbefbcae', 'User'))"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "IEX([Environment]::GetEnvironmentVariable('10528eecbefbcae', 'User'))"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\JeW9i6W4h48g7O8SFLO4.js"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "IEX([Environment]::GetEnvironmentVariable('57030eecbefbcae', 'User'))"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "IEX([Environment]::GetEnvironmentVariable('57030eecbefbcae', 'User'))"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4792
  - - C:\Windows\system32\wermgr.exe
      "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4792" "2436" "2392" "2440" "0" "0" "2444" "0" "0" "0" "0" "0"
      4⤵
      PID:4388
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\gMCQWlAtqIVyVUSXns2r.js"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "IEX([Environment]::GetEnvironmentVariable('93424eecbefbcae', 'User'))"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1556
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "IEX([Environment]::GetEnvironmentVariable('93424eecbefbcae', 'User'))"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4492
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 2156
      4⤵
      Program crash
      PID:3708
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\QH5Jj9d3Q8if2PHKUeOg.js"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "IEX([Environment]::GetEnvironmentVariable('4460eecbefbcae', 'User'))"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -Command "IEX([Environment]::GetEnvironmentVariable('4460eecbefbcae', 'User'))"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2016

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 336 -ip 336
1⤵
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4492 -ip 4492
1⤵
PID:1500

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 336 -s 4084
1⤵
- Program crash
PID:1124

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:2956

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:384

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1388

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
556084f2c6d459c116a69d6fedcc4105

SHA1
633e89b9a1e77942d822d14de6708430a3944dbc

SHA256
88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8

SHA512
0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
712a00a9d8164b3b6795c4e11800d2f1

SHA1
82952ef15a2e4e2b06cb149d3b206d11135128b5

SHA256
2a3b20384f9ce1100ea1c1d3fc24b874446506c627102da75ace1e7bcac4a052

SHA512
ab87d76996cf96e76f9182f72ffe16b1e014ac1ccbe2991a6cd85309622365fbf4a6e79023e616c529640f626cd3943bab9338816bf6ce6831cf5696d28ecd17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
d4d8cef58818612769a698c291ca3b37

SHA1
54e0a6e0c08723157829cea009ec4fe30bea5c50

SHA256
98fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0

SHA512
f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
d4d8cef58818612769a698c291ca3b37

SHA1
54e0a6e0c08723157829cea009ec4fe30bea5c50

SHA256
98fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0

SHA512
f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
d4d8cef58818612769a698c291ca3b37

SHA1
54e0a6e0c08723157829cea009ec4fe30bea5c50

SHA256
98fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0

SHA512
f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
110714a1de8d353f69c36b17ca94728c

SHA1
2fe806755bf807215b4d2955c7e4adf8f9a8f4bf

SHA256
672feca32b521913c2eaf71bc7ad4f7b8acc82a7f2468920650c91091aba3e3d

SHA512
d210a158140738197e90243e91e3c98ec170991f55769ee6920b5d17f815a97e852e13a924dbf9b38488e0681720dda0098043e89256d90b58af1202692f24c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
20KB

MD5
8adbcdba34ad463f05bac47141529448

SHA1
6fad6203b9e34a53143b6d71b3d93b5aa2fb6ddb

SHA256
4fa97bf0487fac408c35b14857753535a8fa3a4e86b43d7e4ca876347aa64127

SHA512
a4cd92c7519da62ecdfa7c09d3c45d354192ea5d85d0daf1ac227674eec3e7a978c0c3edeaed57a8f9fbe485749672cff75cf6e95240e05703e8ee642821c174

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
38ff886c4f3aa5161bbec30f07d48db5

SHA1
f8e175b912fc2e2bde2691d2400d277b27cd54be

SHA256
31be50cd66a3809de0192b9ae5e89a0ee556765b5c468bbb509a5a10c4133ee7

SHA512
0c6774db041ba7bb63078e4125a9a957a3fe26d412598e70903f4cdef79c50885754c332fa7582d849dea987ec40393d3157f168dec027b2748c1f7f2233b20a

Download Submit
C:\Users\Admin\AppData\Local\Temp\By0HWwdJuVCpJZLGG6K0.js

Filesize
16.5MB

MD5
d447e3dcdac667ada7145c58fb42b0dc

SHA1
2c1b54997822a92fdd81c1091f779dfe41aa8d51

SHA256
a1d213d51ebba599f3f3b86c63f8bc0ac3ef1fba052acaba3e141f7cab34d07c

SHA512
b9595fda19ae47ed396cae76bc45abf1cb332032710f1ab2e6e3bb85e32fd8cd561680ba6a6e6f879fae54da88b36e2369c81b257a6daa0d5a728b2d62bb7f7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\JeW9i6W4h48g7O8SFLO4.js

Filesize
211KB

MD5
748d757540bca88f79aa391291c3133d

SHA1
6d3c40adeb42ff2c9acb900911c66729e40a12a7

SHA256
17033f49578eb20c10cd492ff72b05bdd7eab17b8caa04d00e0777ade93ffcc3

SHA512
94201037ed8d254966577a4b7180c7023823a5d6a25172288bf8ffcefb543ad3f29102bc092e1f169b81a4ee9eede4fc380800fb4dbbf64377c78e42a2d0205c

Download Submit
C:\Users\Admin\AppData\Local\Temp\QH5Jj9d3Q8if2PHKUeOg.js

Filesize
214KB

MD5
67ae3798c0e6a512c3dd0d202b2bfa17

SHA1
ac9ea30ccb51e486635abe57ef4d00628a13dea7

SHA256
1dd705f06b3ecb7528d6fc15a3ddef17fa89c3a44f24b46f62bb4e55f7132d88

SHA512
d32114d5a0d261e1d119adf5ef406759516102192e4ce81a5791ad027903c55a74f110a80b1002332a5bc22509f68f89b34f3b38d02049e160169b5229458eab

Download Submit
C:\Users\Admin\AppData\Local\Temp\S6XogndmP4wJ0Y8A5mWI.js

Filesize
9.2MB

MD5
edc6877808b8532ec36dd967c57b31de

SHA1
852a5a91e0c9a3472a5c89aae2c421d920a8acde

SHA256
ca52043bdf4904b34e2a69aed0be4d77fa1b24c7caa2f4265292ef0677e0d49c

SHA512
3e7af7fe93f25ba95661ac0ddd7b278009ca44c6934707b9073a96f19693f12d5883eddcff0717c1a17fb4b58283e0770f7d581b1bc4143f1a0857d05a82c20c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Y6hq6beYYNKAKtLs9nWi.js

Filesize
9.2MB

MD5
63ad6f493f5c59783bc47316ef3b92af

SHA1
c305e179439a10794fdf2f268fe1e3ab645d5983

SHA256
67cbe3781f6f76624b4aa0190e5291be65126c254879bc301727d4407326a32a

SHA512
bde7492e1a50f685158545557e978691055c83152fd6b72f32ac0bf393c727ceba24f6fe705fff632524ef9cd24a7e0f32e9f307387b43d214047b7e0a04f993

Download Submit
C:\Users\Admin\AppData\Local\Temp\ackjbasdcbjkdebfeq.js

Filesize
206KB

MD5
721271c51c6611c82c7d1d335c01b92c

SHA1
e0021c9fe85517ae724f4584bca19e6e392c5197

SHA256
f09227bb0197b6b20409c4a7e6dacb5662d594b6e54a12421bb90cb9ac9680cb

SHA512
a800aa46ea268cea016b53054baedf46371da3db3443669d06d30d2ea20c99a21f1130fddc03499815fa14a6a1082bb22fb9d557d70b18751eb1fd890f9771b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ascjkncaskew.js

Filesize
205KB

MD5
1631086ce2efffca6ffab9ae97b8f3ff

SHA1
75ca403dd06a741af86b109c0b720d33c0af4b71

SHA256
5bfdb3c2a9763232dde5f3fce4646d7688fe1f70598ca94fa13c29a1c7273510

SHA512
ced54d2e3d99218e3b3024dce627e495a6f688a41580cd1bfcb14bb9ea5c1614a3516fbb27bac284bc2fd618cd912a859326f3e839ddeceb2ebbe7cab8511254

Download Submit
C:\Users\Admin\AppData\Local\Temp\fyTBNtRD86e7YxN8Bg6Z.js

Filesize
12.5MB

MD5
93da6927a8d751ee017242a470d9b7da

SHA1
30aaa5686e10174b7925c3f1db372f006b771c58

SHA256
1003bdb0c719dd600468cf91fceea53f110830fa8888f48755efcdd6b0b08ccc

SHA512
89731aeda0dd6c0c05a98b4291b731dff60f182f6651a3ddcb01b4187f0b76dc0472999f270daa68393be32441338a8734a25eb9a31974386761f809d31b1666

Download Submit
C:\Users\Admin\AppData\Local\Temp\gMCQWlAtqIVyVUSXns2r.js

Filesize
208KB

MD5
724aac2641b067d08e6cf9370d86273e

SHA1
2dc6fd3d9433f6ff2cfb1e25ee7b4543db8a1529

SHA256
8a8e43a32b5f80a79b2352afa9eac07dfd49d55cb6263538212e6cbe41d7db0f

SHA512
49b7b588b2acd2416c5a6aabec583b88e683ec1f66ee4b5bd3ae51720756eb5a91d33e0f266e4b823aa87f01804245807577b26c31ae92705f810d10fc83ef57

Download Submit
C:\Users\Admin\AppData\Local\Temp\j5XLkEMI6Ab4MCTMsiUJ.js

Filesize
9.2MB

MD5
a7a3245cb1379140e6d83c3935098a13

SHA1
a19b46abe6e48f80806dfd84e59b9eece8d1de82

SHA256
aa5d60235c292f3935ffa7ed8c18d7583c79363b1f72ca4fd2ba2d394a1367d5

SHA512
063f5a15c06d4a681ca47dbd781fc851fd703ab8a5c4df0993732be3c2ceecd69bee2104917cdd6572750d1fe48d281a462274acf80e22489d42a23e714522c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\q2EoIIRtkGyoNzBV67pp.js

Filesize
208KB

MD5
8ac34eab182f9ff242fa0fa7f141b6a2

SHA1
864c2bcc37392141fe520bf825a7003ba1056eb4

SHA256
d5b3e3d59ce04590d5a621288b8615a2d26acc73bdbccde347af9e88115796fc

SHA512
bb81fc9b75875251a44747ea358b48a1d5c22ec173b3f31aaaf3dd5cf0a620aeae0b99ed52f7c37f7c69c1b128a4451ad512d94a2dfc7d3d3dd86da8685edbe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\unimcumbern.js

Filesize
16.2MB

MD5
c0f2e303dd3ed98a3c87db633daf3c3b

SHA1
2d0b1123bf586cc6e2e5ca69603224c7f6a74825

SHA256
ab607c2f6794fde7454be02b77627c3e4c68831c7f31c0925cb165c97ea32231

SHA512
ff4ef8d079aa9eaa225b864ad4924d52db3e6a9a0bd02a07f4ff0cbf304e8c342d70e589ec818090890347c0dad68fe9e15a10b78c7f24c82671a882e951ca53

Download Submit
C:\Users\Admin\AppData\Local\Temp\unimcumbern2.js

Filesize
14.3MB

MD5
fe4ff2491a8e61f9d64b583a6fecba7a

SHA1
040cf16a2ddb6deb561406507d35f7a5f3fae51a

SHA256
4736b0dd694e384230f6385f920a76d40da44af8f8e047c9c75cb41f0be5a897

SHA512
620c8c85c75b6b8131cf2afad712b9e00b3767a35025372100e848acfd6601da30fcd12375099d85e0aa2262d7eea103e24a5f07cac3ef31c988fd734792f3e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\v8UTQInQ4riGEfymPOY1.js

Filesize
10.7MB

MD5
4cfc15db60ca867669359829c71cbd07

SHA1
850697050b30f28c86888e1613a331852642c55f

SHA256
701402fd306b645e0e4cf9b49eba5c921cbfbe38416a8d29c2085166205f57f1

SHA512
b67e357812e5f5668fc393c5d2694f77570bcf8a7145e77164f36273a706b59d8d634c8d730beed0d398e9beb7ceaf5787403e6674341ee415f266acbb3bf497

Download Submit
memory/916-213-0x00007FFE4EC90000-0x00007FFE4F751000-memory.dmp

Filesize
10.8MB

Download
memory/916-178-0x00000258EF140000-0x00000258EF162000-memory.dmp

Filesize
136KB

Download
memory/916-175-0x00007FFE4EC90000-0x00007FFE4F751000-memory.dmp

Filesize
10.8MB

Download
memory/916-193-0x00007FFE4EC90000-0x00007FFE4F751000-memory.dmp

Filesize
10.8MB

Download
memory/1116-219-0x0000000008660000-0x00000000086FC000-memory.dmp

Filesize
624KB

Download
memory/1556-220-0x00007FFE4EC90000-0x00007FFE4F751000-memory.dmp

Filesize
10.8MB

Download
memory/1556-190-0x00007FFE4EC90000-0x00007FFE4F751000-memory.dmp

Filesize
10.8MB

Download
memory/1556-197-0x00007FFE4EC90000-0x00007FFE4F751000-memory.dmp

Filesize
10.8MB

Download
memory/2016-202-0x00007FFE4EC90000-0x00007FFE4F751000-memory.dmp

Filesize
10.8MB

Download
memory/2016-192-0x00007FFE4EC90000-0x00007FFE4F751000-memory.dmp

Filesize
10.8MB

Download
memory/2016-221-0x00007FFE4EC90000-0x00007FFE4F751000-memory.dmp

Filesize
10.8MB

Download
memory/2620-132-0x000001D03C100000-0x000001D03C27E000-memory.dmp

Filesize
1.5MB

Download
memory/2620-135-0x000001D03FF40000-0x000001D04004A000-memory.dmp

Filesize
1.0MB

Download
memory/2620-136-0x000001D003070000-0x000001D003082000-memory.dmp

Filesize
72KB

Download
memory/2620-170-0x00007FFE4EC90000-0x00007FFE4F751000-memory.dmp

Filesize
10.8MB

Download
memory/2620-134-0x000001D040070000-0x000001D040598000-memory.dmp

Filesize
5.2MB

Download
memory/2620-133-0x00007FFE4EC90000-0x00007FFE4F751000-memory.dmp

Filesize
10.8MB

Download
memory/2620-137-0x000001D03AC30000-0x000001D03AC6C000-memory.dmp

Filesize
240KB

Download
memory/2620-138-0x000001D042180000-0x000001D042342000-memory.dmp

Filesize
1.8MB

Download
memory/2620-139-0x00007FFE4EC90000-0x00007FFE4F751000-memory.dmp

Filesize
10.8MB

Download
memory/2620-140-0x000001D03EAA0000-0x000001D03EB16000-memory.dmp

Filesize
472KB

Download
memory/2620-141-0x000001D03ACE0000-0x000001D03AD30000-memory.dmp

Filesize
320KB

Download
memory/4276-188-0x00007FFE4EC90000-0x00007FFE4F751000-memory.dmp

Filesize
10.8MB

Download
memory/4276-222-0x00007FFE4EC90000-0x00007FFE4F751000-memory.dmp

Filesize
10.8MB

Download
memory/4276-195-0x00007FFE4EC90000-0x00007FFE4F751000-memory.dmp

Filesize
10.8MB

Download
memory/4792-199-0x00007FFE4EC90000-0x00007FFE4F751000-memory.dmp

Filesize
10.8MB

Download
memory/4792-215-0x00007FFE4EC90000-0x00007FFE4F751000-memory.dmp

Filesize
10.8MB

Download
memory/4792-191-0x00007FFE4EC90000-0x00007FFE4F751000-memory.dmp

Filesize
10.8MB

Download
memory/4816-205-0x00000000074F0000-0x0000000007512000-memory.dmp

Filesize
136KB

Download
memory/4816-181-0x0000000005E30000-0x0000000005E96000-memory.dmp

Filesize
408KB

Download
memory/4816-180-0x0000000005560000-0x0000000005582000-memory.dmp

Filesize
136KB

Download
memory/4816-206-0x0000000008890000-0x0000000008E34000-memory.dmp

Filesize
5.6MB

Download
memory/4816-176-0x0000000005700000-0x0000000005D28000-memory.dmp

Filesize
6.2MB

Download
memory/4816-204-0x00000000077E0000-0x0000000007876000-memory.dmp

Filesize
600KB

Download
memory/4816-174-0x0000000002BF0000-0x0000000002C26000-memory.dmp

Filesize
216KB

Download
memory/4816-194-0x00000000064A0000-0x00000000064BE000-memory.dmp

Filesize
120KB

Download
memory/4816-182-0x0000000005F10000-0x0000000005F76000-memory.dmp

Filesize
408KB

Download
memory/4816-201-0x00000000069C0000-0x00000000069DA000-memory.dmp

Filesize
104KB

Download
memory/4816-200-0x0000000007C60000-0x00000000082DA000-memory.dmp

Filesize
6.5MB

Download
memory/5056-207-0x00007FFE4EC90000-0x00007FFE4F751000-memory.dmp

Filesize
10.8MB

Download
memory/5056-203-0x00007FFE4EC90000-0x00007FFE4F751000-memory.dmp

Filesize
10.8MB

Download
memory/5056-223-0x00007FFE4EC90000-0x00007FFE4F751000-memory.dmp

Filesize
10.8MB

Download