imminent | 064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c

Analysis

max time kernel
205s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 00:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
Size

397KB
MD5

7fbb9b5360de87624a11a32b78bc1ce7
SHA1

375566ac72b2766dc2f2fccf6a60a834de376417
SHA256

064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c
SHA512

68b0fd1930accb47adb1357894da9f81bd4a7bf94d1e2b1b2fd1293c9e575dd0ad5057f1ddd8a4b9595f3cfb5ba712b9558f0f1a664a0013cd11a5c643d932d4
SSDEEP

6144:qbT4pTgVIpXp9Xa3ANTLrJ1Q9O6Zs5TBXyAPjvUoprtv0gkGcXEKjEvDv:U4+6XDYANT0A6AIAPj8opBeKvDv

Score

10^/10

imminent persistence spyware trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent

Executes dropped EXE 15 IoCs

pid	Process
4220	WUDHost.exe
3048	Acctres.exe
3028	Acctres.exe
4892	WUDHost.exe
3632	Acctres.exe
3296	Acctres.exe
1452	Acctres.exe
1496	Acctres.exe
2556	Acctres.exe
1612	Acctres.exe
4440	Acctres.exe
3352	Acctres.exe
4604	Acctres.exe
1344	Acctres.exe
4344	WUDHost.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	WUDHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	Acctres.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	takshost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Boot File Servicing Utility = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WUDHost.exe"	WUDHost.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\Desktop.ini	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
File created	C:\Windows\assembly\Desktop.ini	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe

Suspicious use of SetThreadContext 34 IoCs

description	pid	Process	procid_target
PID 848 set thread context of 4492	848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe	81
PID 3048 set thread context of 3028	3048	Acctres.exe	90
PID 3048 set thread context of 3632	3048	Acctres.exe	93
PID 3048 set thread context of 3296	3048	Acctres.exe	94
PID 3048 set thread context of 1452	3048	Acctres.exe	96
PID 3048 set thread context of 1496	3048	Acctres.exe	97
PID 3048 set thread context of 2556	3048	Acctres.exe	98
PID 3048 set thread context of 1612	3048	Acctres.exe	99
PID 3048 set thread context of 4440	3048	Acctres.exe	100
PID 3048 set thread context of 3352	3048	Acctres.exe	101
PID 3048 set thread context of 4604	3048	Acctres.exe	102
PID 3048 set thread context of 1344	3048	Acctres.exe	103
PID 3500 set thread context of 4368	3500	takshost.exe	106
PID 3500 set thread context of 2552	3500	takshost.exe	107
PID 3500 set thread context of 1196	3500	takshost.exe	108
PID 3500 set thread context of 4220	3500	takshost.exe	112
PID 3500 set thread context of 3824	3500	takshost.exe	113
PID 3500 set thread context of 2472	3500	takshost.exe	115
PID 3500 set thread context of 852	3500	takshost.exe	116
PID 3500 set thread context of 1464	3500	takshost.exe	117
PID 3500 set thread context of 3448	3500	takshost.exe	118
PID 3500 set thread context of 1676	3500	takshost.exe	119
PID 3500 set thread context of 2560	3500	takshost.exe	120
PID 3500 set thread context of 4256	3500	takshost.exe	121
PID 3500 set thread context of 4908	3500	takshost.exe	122
PID 3500 set thread context of 3540	3500	takshost.exe	123
PID 3500 set thread context of 1452	3500	takshost.exe	124
PID 3500 set thread context of 4632	3500	takshost.exe	125
PID 3500 set thread context of 1440	3500	takshost.exe	126
PID 3500 set thread context of 2568	3500	takshost.exe	127
PID 3500 set thread context of 3616	3500	takshost.exe	128
PID 3500 set thread context of 4184	3500	takshost.exe	129
PID 3500 set thread context of 4976	3500	takshost.exe	131
PID 3500 set thread context of 64	3500	takshost.exe	132

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
File created	C:\Windows\assembly\Desktop.ini	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2104	1344	WerFault.exe	103

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4492	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
Token: SeDebugPrivilege	4492	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
Token: SeDebugPrivilege	4220	WUDHost.exe
Token: SeDebugPrivilege	3048	Acctres.exe
Token: SeDebugPrivilege	3500	takshost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4492	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 4492	848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe	81
PID 848 wrote to memory of 4492	848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe	81
PID 848 wrote to memory of 4492	848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe	81
PID 848 wrote to memory of 4492	848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe	81
PID 848 wrote to memory of 4492	848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe	81
PID 848 wrote to memory of 4492	848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe	81
PID 848 wrote to memory of 4492	848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe	81
PID 848 wrote to memory of 4492	848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe	81
PID 848 wrote to memory of 4220	848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe	82
PID 848 wrote to memory of 4220	848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe	82
PID 848 wrote to memory of 4220	848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe	82
PID 4220 wrote to memory of 3048	4220	WUDHost.exe	85
PID 4220 wrote to memory of 3048	4220	WUDHost.exe	85
PID 4220 wrote to memory of 3048	4220	WUDHost.exe	85
PID 848 wrote to memory of 3500	848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe	89
PID 848 wrote to memory of 3500	848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe	89
PID 848 wrote to memory of 3500	848	064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe	89
PID 3048 wrote to memory of 3028	3048	Acctres.exe	90
PID 3048 wrote to memory of 3028	3048	Acctres.exe	90
PID 3048 wrote to memory of 3028	3048	Acctres.exe	90
PID 3048 wrote to memory of 3028	3048	Acctres.exe	90
PID 3048 wrote to memory of 3028	3048	Acctres.exe	90
PID 3048 wrote to memory of 3028	3048	Acctres.exe	90
PID 3048 wrote to memory of 3028	3048	Acctres.exe	90
PID 3048 wrote to memory of 3028	3048	Acctres.exe	90
PID 3048 wrote to memory of 4892	3048	Acctres.exe	92
PID 3048 wrote to memory of 4892	3048	Acctres.exe	92
PID 3048 wrote to memory of 4892	3048	Acctres.exe	92
PID 3048 wrote to memory of 3632	3048	Acctres.exe	93
PID 3048 wrote to memory of 3632	3048	Acctres.exe	93
PID 3048 wrote to memory of 3632	3048	Acctres.exe	93
PID 3048 wrote to memory of 3632	3048	Acctres.exe	93
PID 3048 wrote to memory of 3632	3048	Acctres.exe	93
PID 3048 wrote to memory of 3632	3048	Acctres.exe	93
PID 3048 wrote to memory of 3632	3048	Acctres.exe	93
PID 3048 wrote to memory of 3632	3048	Acctres.exe	93
PID 3048 wrote to memory of 3296	3048	Acctres.exe	94
PID 3048 wrote to memory of 3296	3048	Acctres.exe	94
PID 3048 wrote to memory of 3296	3048	Acctres.exe	94
PID 3048 wrote to memory of 3296	3048	Acctres.exe	94
PID 3048 wrote to memory of 3296	3048	Acctres.exe	94
PID 3048 wrote to memory of 3296	3048	Acctres.exe	94
PID 3048 wrote to memory of 3296	3048	Acctres.exe	94
PID 3048 wrote to memory of 3296	3048	Acctres.exe	94
PID 3048 wrote to memory of 1452	3048	Acctres.exe	96
PID 3048 wrote to memory of 1452	3048	Acctres.exe	96
PID 3048 wrote to memory of 1452	3048	Acctres.exe	96
PID 3048 wrote to memory of 1452	3048	Acctres.exe	96
PID 3048 wrote to memory of 1452	3048	Acctres.exe	96
PID 3048 wrote to memory of 1452	3048	Acctres.exe	96
PID 3048 wrote to memory of 1452	3048	Acctres.exe	96
PID 3048 wrote to memory of 1452	3048	Acctres.exe	96
PID 3048 wrote to memory of 1496	3048	Acctres.exe	97
PID 3048 wrote to memory of 1496	3048	Acctres.exe	97
PID 3048 wrote to memory of 1496	3048	Acctres.exe	97
PID 3048 wrote to memory of 1496	3048	Acctres.exe	97
PID 3048 wrote to memory of 1496	3048	Acctres.exe	97
PID 3048 wrote to memory of 1496	3048	Acctres.exe	97
PID 3048 wrote to memory of 1496	3048	Acctres.exe	97
PID 3048 wrote to memory of 1496	3048	Acctres.exe	97
PID 3048 wrote to memory of 2556	3048	Acctres.exe	98
PID 3048 wrote to memory of 2556	3048	Acctres.exe	98
PID 3048 wrote to memory of 2556	3048	Acctres.exe	98
PID 3048 wrote to memory of 2556	3048	Acctres.exe	98

C:\Users\Admin\AppData\Local\Temp\064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
"C:\Users\Admin\AppData\Local\Temp\064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848
- C:\Users\Admin\AppData\Local\Temp\064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe
  "C:\Users\Admin\AppData\Local\Temp\064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4492
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"
      4⤵
      Executes dropped EXE
      PID:3028
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"
      4⤵
      Executes dropped EXE
      PID:4892
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"
      4⤵
      Executes dropped EXE
      PID:3632
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"
      4⤵
      Executes dropped EXE
      PID:3296
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"
      4⤵
      Executes dropped EXE
      PID:1452
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"
      4⤵
      Executes dropped EXE
      PID:1496
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"
      4⤵
      Executes dropped EXE
      PID:2556
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"
      4⤵
      Executes dropped EXE
      PID:1612
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"
      4⤵
      Executes dropped EXE
      PID:4440
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"
      4⤵
      Executes dropped EXE
      PID:3352
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"
      4⤵
      Executes dropped EXE
      PID:4604
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"
      4⤵
      Executes dropped EXE
      PID:1344
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 420
        5⤵
        Program crash
        
        PID:2104
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:3500
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
    3⤵
    PID:4368
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
    3⤵
    PID:2552
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
    3⤵
    PID:1196
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"
    3⤵
    - Executes dropped EXE
    PID:4344
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
    3⤵
    PID:4220
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
    3⤵
    PID:3824
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
    3⤵
    PID:2472
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
    3⤵
    PID:852
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
    3⤵
    PID:1464
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
    3⤵
    PID:3448
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
    3⤵
    PID:1676
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
    3⤵
    PID:2560
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
    3⤵
    PID:4256
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
    3⤵
    PID:4908
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
    3⤵
    PID:3540
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
    3⤵
    PID:1452
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
    3⤵
    PID:4632
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
    3⤵
    PID:1440
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
    3⤵
    PID:2568
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
    3⤵
    PID:3616
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
    3⤵
    PID:4184
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
    3⤵
    PID:4976
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
    3⤵
    PID:64

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1344 -ip 1344
1⤵
PID:4508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Acctres.exe.log

Filesize
319B

MD5
da4fafeffe21b7cb3a8c170ca7911976

SHA1
50ef77e2451ab60f93f4db88325b897d215be5ad

SHA256
7341a4a13e81cbb5b7f39ec47bb45f84836b08b8d8e3ea231d2c7dad982094f7

SHA512
0bc24b69460f31a0ebc0628b99908d818ee85feb7e4b663271d9375b30cced0cd55a0bbf8edff1281a4c886ddf4476ffc989c283069cdcb1235ffcb265580fc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\WUDHost.exe.log

Filesize
128B

MD5
a5dcc7c9c08af7dddd82be5b036a4416

SHA1
4f998ca1526d199e355ffb435bae111a2779b994

SHA256
e24033ceec97fd03402b03acaaabd1d1e378e83bb1683afbccac760e00f8ead5

SHA512
56035de734836c0c39f0b48641c51c26adb6e79c6c65e23ca96603f71c95b8673e2ef853146e87efc899dd1878d0bbc2c82d91fbf0fce81c552048e986f9bb5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\takshost.exe.log

Filesize
319B

MD5
da4fafeffe21b7cb3a8c170ca7911976

SHA1
50ef77e2451ab60f93f4db88325b897d215be5ad

SHA256
7341a4a13e81cbb5b7f39ec47bb45f84836b08b8d8e3ea231d2c7dad982094f7

SHA512
0bc24b69460f31a0ebc0628b99908d818ee85feb7e4b663271d9375b30cced0cd55a0bbf8edff1281a4c886ddf4476ffc989c283069cdcb1235ffcb265580fc6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

Filesize
397KB

MD5
7fbb9b5360de87624a11a32b78bc1ce7

SHA1
375566ac72b2766dc2f2fccf6a60a834de376417

SHA256
064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c

SHA512
68b0fd1930accb47adb1357894da9f81bd4a7bf94d1e2b1b2fd1293c9e575dd0ad5057f1ddd8a4b9595f3cfb5ba712b9558f0f1a664a0013cd11a5c643d932d4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

Filesize
397KB

MD5
7fbb9b5360de87624a11a32b78bc1ce7

SHA1
375566ac72b2766dc2f2fccf6a60a834de376417

SHA256
064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c

SHA512
68b0fd1930accb47adb1357894da9f81bd4a7bf94d1e2b1b2fd1293c9e575dd0ad5057f1ddd8a4b9595f3cfb5ba712b9558f0f1a664a0013cd11a5c643d932d4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

Filesize
397KB

MD5
7fbb9b5360de87624a11a32b78bc1ce7

SHA1
375566ac72b2766dc2f2fccf6a60a834de376417

SHA256
064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c

SHA512
68b0fd1930accb47adb1357894da9f81bd4a7bf94d1e2b1b2fd1293c9e575dd0ad5057f1ddd8a4b9595f3cfb5ba712b9558f0f1a664a0013cd11a5c643d932d4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

Filesize
397KB

MD5
7fbb9b5360de87624a11a32b78bc1ce7

SHA1
375566ac72b2766dc2f2fccf6a60a834de376417

SHA256
064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c

SHA512
68b0fd1930accb47adb1357894da9f81bd4a7bf94d1e2b1b2fd1293c9e575dd0ad5057f1ddd8a4b9595f3cfb5ba712b9558f0f1a664a0013cd11a5c643d932d4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

Filesize
397KB

MD5
7fbb9b5360de87624a11a32b78bc1ce7

SHA1
375566ac72b2766dc2f2fccf6a60a834de376417

SHA256
064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c

SHA512
68b0fd1930accb47adb1357894da9f81bd4a7bf94d1e2b1b2fd1293c9e575dd0ad5057f1ddd8a4b9595f3cfb5ba712b9558f0f1a664a0013cd11a5c643d932d4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

Filesize
397KB

MD5
7fbb9b5360de87624a11a32b78bc1ce7

SHA1
375566ac72b2766dc2f2fccf6a60a834de376417

SHA256
064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c

SHA512
68b0fd1930accb47adb1357894da9f81bd4a7bf94d1e2b1b2fd1293c9e575dd0ad5057f1ddd8a4b9595f3cfb5ba712b9558f0f1a664a0013cd11a5c643d932d4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

Filesize
397KB

MD5
7fbb9b5360de87624a11a32b78bc1ce7

SHA1
375566ac72b2766dc2f2fccf6a60a834de376417

SHA256
064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c

SHA512
68b0fd1930accb47adb1357894da9f81bd4a7bf94d1e2b1b2fd1293c9e575dd0ad5057f1ddd8a4b9595f3cfb5ba712b9558f0f1a664a0013cd11a5c643d932d4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

Filesize
397KB

MD5
7fbb9b5360de87624a11a32b78bc1ce7

SHA1
375566ac72b2766dc2f2fccf6a60a834de376417

SHA256
064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c

SHA512
68b0fd1930accb47adb1357894da9f81bd4a7bf94d1e2b1b2fd1293c9e575dd0ad5057f1ddd8a4b9595f3cfb5ba712b9558f0f1a664a0013cd11a5c643d932d4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

Filesize
397KB

MD5
7fbb9b5360de87624a11a32b78bc1ce7

SHA1
375566ac72b2766dc2f2fccf6a60a834de376417

SHA256
064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c

SHA512
68b0fd1930accb47adb1357894da9f81bd4a7bf94d1e2b1b2fd1293c9e575dd0ad5057f1ddd8a4b9595f3cfb5ba712b9558f0f1a664a0013cd11a5c643d932d4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

Filesize
397KB

MD5
7fbb9b5360de87624a11a32b78bc1ce7

SHA1
375566ac72b2766dc2f2fccf6a60a834de376417

SHA256
064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c

SHA512
68b0fd1930accb47adb1357894da9f81bd4a7bf94d1e2b1b2fd1293c9e575dd0ad5057f1ddd8a4b9595f3cfb5ba712b9558f0f1a664a0013cd11a5c643d932d4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

Filesize
397KB

MD5
7fbb9b5360de87624a11a32b78bc1ce7

SHA1
375566ac72b2766dc2f2fccf6a60a834de376417

SHA256
064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c

SHA512
68b0fd1930accb47adb1357894da9f81bd4a7bf94d1e2b1b2fd1293c9e575dd0ad5057f1ddd8a4b9595f3cfb5ba712b9558f0f1a664a0013cd11a5c643d932d4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

Filesize
397KB

MD5
7fbb9b5360de87624a11a32b78bc1ce7

SHA1
375566ac72b2766dc2f2fccf6a60a834de376417

SHA256
064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c

SHA512
68b0fd1930accb47adb1357894da9f81bd4a7bf94d1e2b1b2fd1293c9e575dd0ad5057f1ddd8a4b9595f3cfb5ba712b9558f0f1a664a0013cd11a5c643d932d4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

Filesize
397KB

MD5
7fbb9b5360de87624a11a32b78bc1ce7

SHA1
375566ac72b2766dc2f2fccf6a60a834de376417

SHA256
064bfcb47b4c24478626f5ee4c31838ee9bdc2cac752e6d265338670a4b4607c

SHA512
68b0fd1930accb47adb1357894da9f81bd4a7bf94d1e2b1b2fd1293c9e575dd0ad5057f1ddd8a4b9595f3cfb5ba712b9558f0f1a664a0013cd11a5c643d932d4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe

Filesize
6KB

MD5
4eef4dcc0c4e2931ddafd6df4626ca1e

SHA1
d3272d601a1cb88bdc80cec9a8a40c5b53cc4b84

SHA256
e13868f7339a7c89916c5c5bfe7fec0b0781207a3c4d7b10c2ea054c64be5e7b

SHA512
61318b71899fc4cf702ba4b5498171d7090606bf603ac78f35d300e2efd4714f28efaf32ef9d22a1f3328b06fc6d8296be1ecc8b8a740b00388ba580abc3fd0d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe

Filesize
6KB

MD5
4eef4dcc0c4e2931ddafd6df4626ca1e

SHA1
d3272d601a1cb88bdc80cec9a8a40c5b53cc4b84

SHA256
e13868f7339a7c89916c5c5bfe7fec0b0781207a3c4d7b10c2ea054c64be5e7b

SHA512
61318b71899fc4cf702ba4b5498171d7090606bf603ac78f35d300e2efd4714f28efaf32ef9d22a1f3328b06fc6d8296be1ecc8b8a740b00388ba580abc3fd0d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe

Filesize
6KB

MD5
4eef4dcc0c4e2931ddafd6df4626ca1e

SHA1
d3272d601a1cb88bdc80cec9a8a40c5b53cc4b84

SHA256
e13868f7339a7c89916c5c5bfe7fec0b0781207a3c4d7b10c2ea054c64be5e7b

SHA512
61318b71899fc4cf702ba4b5498171d7090606bf603ac78f35d300e2efd4714f28efaf32ef9d22a1f3328b06fc6d8296be1ecc8b8a740b00388ba580abc3fd0d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe

Filesize
6KB

MD5
4eef4dcc0c4e2931ddafd6df4626ca1e

SHA1
d3272d601a1cb88bdc80cec9a8a40c5b53cc4b84

SHA256
e13868f7339a7c89916c5c5bfe7fec0b0781207a3c4d7b10c2ea054c64be5e7b

SHA512
61318b71899fc4cf702ba4b5498171d7090606bf603ac78f35d300e2efd4714f28efaf32ef9d22a1f3328b06fc6d8296be1ecc8b8a740b00388ba580abc3fd0d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe

Filesize
6KB

MD5
4eef4dcc0c4e2931ddafd6df4626ca1e

SHA1
d3272d601a1cb88bdc80cec9a8a40c5b53cc4b84

SHA256
e13868f7339a7c89916c5c5bfe7fec0b0781207a3c4d7b10c2ea054c64be5e7b

SHA512
61318b71899fc4cf702ba4b5498171d7090606bf603ac78f35d300e2efd4714f28efaf32ef9d22a1f3328b06fc6d8296be1ecc8b8a740b00388ba580abc3fd0d

Download Submit
memory/848-151-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/848-132-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/848-133-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/852-236-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/1196-222-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/1344-204-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/1440-268-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/1452-261-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/1452-175-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/1464-239-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/1496-179-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/1612-187-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/1676-246-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/2472-232-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/2472-233-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/2552-216-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/2552-215-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/2556-183-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/2560-249-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/2568-271-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/3028-205-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/3028-158-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/3048-147-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/3048-207-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/3048-146-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/3296-169-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/3296-170-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/3352-196-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/3448-242-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/3448-243-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/3500-174-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/3500-149-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/3540-258-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/3616-276-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/3616-275-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/3632-165-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/3632-164-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/3824-229-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/4184-279-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/4184-280-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/4220-226-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/4220-153-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/4220-140-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/4220-142-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/4256-252-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/4344-274-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/4344-225-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/4368-211-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/4440-192-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/4440-191-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/4492-139-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/4492-141-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/4492-135-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4604-200-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/4632-265-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/4632-264-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/4892-159-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/4892-206-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/4892-208-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/4908-255-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download
memory/4976-283-0x0000000075270000-0x0000000075821000-memory.dmp

Filesize
5.7MB

Download