quasar | fd413b5eafbaba0a52aa233cb407bc4492207cc84cd320b7110e0412e528fed6

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7c0af73c19bd8d1148bb8d506d00cc8f.exe
Size 798KB
Sample240128-d5kw2sade6
SHA256 fd413b5eafbaba0a52aa233cb407bc4492207cc84cd320b7110e0412e528fed6
MD5 7c0af73c19bd8d1148bb8d506d00cc8f
SHA1 f0d049209bee2c47a4f4918b597d53f39308f184
SHA512 b697914df39a74d6282147f1dc557971cecd0ed608aa60be67dbb9351dbc61d9d4a247e7cab6f5dd3ee199ccbaba91415e14ac89d41238c4eb8b71394880da9d
SSDEEP 24576:VajQoqr73xVgmgIesO9O2tyA19ESiWy9EFFTZdXTZdHXTZdXTZ5:V2QvvQuAZiSTZdXTZdHXTZdXTZ5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Office04

iphaibanam555.hopto.org:443

Mutex

QSR_MUTEX_ZPUYB8InwteGGftCVN

Attributes

encryption_key
01NksHoVautlxRcj7mAL
install_name
Microsoft ED.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Microsoft ED
subdirectory
SubDir

Signatures

Quasar RAT 4 IoCs

Quasar is an open source Remote Access Tool.

trojan spyware quasar

flow	ioc	pid	Process
		3436	schtasks.exe
14	ip-api.com		Process not Found
52	ip-api.com		Process not Found
68	ip-api.com		Process not Found

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/3612-6-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	Microsoft ED.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	Microsoft ED.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	Microsoft ED.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	Microsoft ED.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	Microsoft ED.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	Microsoft ED.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	Microsoft ED.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	Microsoft ED.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	Microsoft ED.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	Microsoft ED.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	Microsoft ED.exe

Executes dropped EXE 25 IoCs

pid	Process
1196	Microsoft ED.exe
4528	Microsoft ED.exe
1268	Microsoft ED.exe
3044	Microsoft ED.exe
4552	Microsoft ED.exe
3436	Microsoft ED.exe
384	Microsoft ED.exe
1456	Microsoft ED.exe
1576	Microsoft ED.exe
3672	Microsoft ED.exe
464	Microsoft ED.exe
1736	Microsoft ED.exe
764	Microsoft ED.exe
4392	Microsoft ED.exe
4860	Microsoft ED.exe
1988	Microsoft ED.exe
3348	Microsoft ED.exe
1268	Microsoft ED.exe
624	Microsoft ED.exe
2648	Microsoft ED.exe
2224	Microsoft ED.exe
1748	Microsoft ED.exe
4864	Microsoft ED.exe
3168	Microsoft ED.exe
1576	Microsoft ED.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	ip-api.com
52	ip-api.com
68	ip-api.com

Suspicious use of SetThreadContext 13 IoCs

description	pid	Process	procid_target
PID 2292 set thread context of 3612	2292	7c0af73c19bd8d1148bb8d506d00cc8f.exe	93
PID 1196 set thread context of 4528	1196	Microsoft ED.exe	98
PID 1268 set thread context of 4552	1268	Microsoft ED.exe	111
PID 3436 set thread context of 384	3436	Microsoft ED.exe	123
PID 1456 set thread context of 1576	1456	Microsoft ED.exe	133
PID 3672 set thread context of 464	3672	Microsoft ED.exe	143
PID 1736 set thread context of 764	1736	Microsoft ED.exe	153
PID 4392 set thread context of 4860	4392	Microsoft ED.exe	163
PID 1988 set thread context of 3348	1988	Microsoft ED.exe	173
PID 1268 set thread context of 624	1268	Microsoft ED.exe	183
PID 2648 set thread context of 2224	2648	Microsoft ED.exe	193
PID 1748 set thread context of 4864	1748	Microsoft ED.exe	203
PID 3168 set thread context of 1576	3168	Microsoft ED.exe	213

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 11 IoCs

pid	pid_target	Process	procid_target
1780	4528	WerFault.exe	98
2292	4552	WerFault.exe	111
3332	384	WerFault.exe	123
4032	1576	WerFault.exe	133
1124	464	WerFault.exe	143
4908	764	WerFault.exe	153
3364	4860	WerFault.exe	163
4292	3348	WerFault.exe	173
880	624	WerFault.exe	183
3648	2224	WerFault.exe	193
3956	4864	WerFault.exe	203

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1668	schtasks.exe
2264	schtasks.exe
2232	schtasks.exe
4376	schtasks.exe
4276	schtasks.exe
3436	schtasks.exe
1932	schtasks.exe
2432	schtasks.exe
2232	schtasks.exe
4836	schtasks.exe
3460	schtasks.exe
3264	schtasks.exe

Runs ping.exe 1 TTPs 11 IoCs

Remote System Discovery

T1018

pid	Process
3264	PING.EXE
2880	PING.EXE
3172	PING.EXE
4104	PING.EXE
4216	PING.EXE
2184	PING.EXE
1764	PING.EXE
2740	PING.EXE
4600	PING.EXE
4108	PING.EXE
2920	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1268	Microsoft ED.exe
1268	Microsoft ED.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	2292	7c0af73c19bd8d1148bb8d506d00cc8f.exe
Token: SeDebugPrivilege	3612	7c0af73c19bd8d1148bb8d506d00cc8f.exe
Token: SeDebugPrivilege	1196	Microsoft ED.exe
Token: SeDebugPrivilege	4528	Microsoft ED.exe
Token: SeDebugPrivilege	1268	Microsoft ED.exe
Token: SeDebugPrivilege	4552	Microsoft ED.exe
Token: SeDebugPrivilege	3436	Microsoft ED.exe
Token: SeDebugPrivilege	384	Microsoft ED.exe
Token: SeDebugPrivilege	1456	Microsoft ED.exe
Token: SeDebugPrivilege	1576	Microsoft ED.exe
Token: SeDebugPrivilege	3672	Microsoft ED.exe
Token: SeDebugPrivilege	464	Microsoft ED.exe
Token: SeDebugPrivilege	1736	Microsoft ED.exe
Token: SeDebugPrivilege	764	Microsoft ED.exe
Token: SeDebugPrivilege	4392	Microsoft ED.exe
Token: SeDebugPrivilege	4860	Microsoft ED.exe
Token: SeDebugPrivilege	1988	Microsoft ED.exe
Token: SeDebugPrivilege	3348	Microsoft ED.exe
Token: SeDebugPrivilege	1268	Microsoft ED.exe
Token: SeDebugPrivilege	624	Microsoft ED.exe
Token: SeDebugPrivilege	2648	Microsoft ED.exe
Token: SeDebugPrivilege	2224	Microsoft ED.exe
Token: SeDebugPrivilege	1748	Microsoft ED.exe
Token: SeDebugPrivilege	4864	Microsoft ED.exe
Token: SeDebugPrivilege	3168	Microsoft ED.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
4528	Microsoft ED.exe
4552	Microsoft ED.exe
384	Microsoft ED.exe
1576	Microsoft ED.exe
464	Microsoft ED.exe
764	Microsoft ED.exe
4860	Microsoft ED.exe
3348	Microsoft ED.exe
624	Microsoft ED.exe
2224	Microsoft ED.exe
4864	Microsoft ED.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 3612	2292	7c0af73c19bd8d1148bb8d506d00cc8f.exe	93
PID 2292 wrote to memory of 3612	2292	7c0af73c19bd8d1148bb8d506d00cc8f.exe	93
PID 2292 wrote to memory of 3612	2292	7c0af73c19bd8d1148bb8d506d00cc8f.exe	93
PID 2292 wrote to memory of 3612	2292	7c0af73c19bd8d1148bb8d506d00cc8f.exe	93
PID 2292 wrote to memory of 3612	2292	7c0af73c19bd8d1148bb8d506d00cc8f.exe	93
PID 2292 wrote to memory of 3612	2292	7c0af73c19bd8d1148bb8d506d00cc8f.exe	93
PID 2292 wrote to memory of 3612	2292	7c0af73c19bd8d1148bb8d506d00cc8f.exe	93
PID 2292 wrote to memory of 3612	2292	7c0af73c19bd8d1148bb8d506d00cc8f.exe	93
PID 3612 wrote to memory of 3436	3612	7c0af73c19bd8d1148bb8d506d00cc8f.exe	122
PID 3612 wrote to memory of 3436	3612	7c0af73c19bd8d1148bb8d506d00cc8f.exe	122
PID 3612 wrote to memory of 3436	3612	7c0af73c19bd8d1148bb8d506d00cc8f.exe	122
PID 3612 wrote to memory of 1196	3612	7c0af73c19bd8d1148bb8d506d00cc8f.exe	96
PID 3612 wrote to memory of 1196	3612	7c0af73c19bd8d1148bb8d506d00cc8f.exe	96
PID 3612 wrote to memory of 1196	3612	7c0af73c19bd8d1148bb8d506d00cc8f.exe	96
PID 1196 wrote to memory of 4528	1196	Microsoft ED.exe	98
PID 1196 wrote to memory of 4528	1196	Microsoft ED.exe	98
PID 1196 wrote to memory of 4528	1196	Microsoft ED.exe	98
PID 1196 wrote to memory of 4528	1196	Microsoft ED.exe	98
PID 1196 wrote to memory of 4528	1196	Microsoft ED.exe	98
PID 1196 wrote to memory of 4528	1196	Microsoft ED.exe	98
PID 1196 wrote to memory of 4528	1196	Microsoft ED.exe	98
PID 1196 wrote to memory of 4528	1196	Microsoft ED.exe	98
PID 4528 wrote to memory of 1932	4528	Microsoft ED.exe	99
PID 4528 wrote to memory of 1932	4528	Microsoft ED.exe	99
PID 4528 wrote to memory of 1932	4528	Microsoft ED.exe	99
PID 4528 wrote to memory of 5100	4528	Microsoft ED.exe	137
PID 4528 wrote to memory of 5100	4528	Microsoft ED.exe	137
PID 4528 wrote to memory of 5100	4528	Microsoft ED.exe	137
PID 5100 wrote to memory of 2920	5100	Conhost.exe	127
PID 5100 wrote to memory of 2920	5100	Conhost.exe	127
PID 5100 wrote to memory of 2920	5100	Conhost.exe	127
PID 5100 wrote to memory of 4600	5100	Conhost.exe	103
PID 5100 wrote to memory of 4600	5100	Conhost.exe	103
PID 5100 wrote to memory of 4600	5100	Conhost.exe	103
PID 5100 wrote to memory of 1268	5100	Conhost.exe	182
PID 5100 wrote to memory of 1268	5100	Conhost.exe	182
PID 5100 wrote to memory of 1268	5100	Conhost.exe	182
PID 1268 wrote to memory of 3044	1268	Microsoft ED.exe	112
PID 1268 wrote to memory of 3044	1268	Microsoft ED.exe	112
PID 1268 wrote to memory of 3044	1268	Microsoft ED.exe	112
PID 1268 wrote to memory of 4552	1268	Microsoft ED.exe	111
PID 1268 wrote to memory of 4552	1268	Microsoft ED.exe	111
PID 1268 wrote to memory of 4552	1268	Microsoft ED.exe	111
PID 1268 wrote to memory of 4552	1268	Microsoft ED.exe	111
PID 1268 wrote to memory of 4552	1268	Microsoft ED.exe	111
PID 1268 wrote to memory of 4552	1268	Microsoft ED.exe	111
PID 1268 wrote to memory of 4552	1268	Microsoft ED.exe	111
PID 1268 wrote to memory of 4552	1268	Microsoft ED.exe	111
PID 4552 wrote to memory of 2432	4552	Microsoft ED.exe	114
PID 4552 wrote to memory of 2432	4552	Microsoft ED.exe	114
PID 4552 wrote to memory of 2432	4552	Microsoft ED.exe	114
PID 4552 wrote to memory of 1736	4552	Microsoft ED.exe	152
PID 4552 wrote to memory of 1736	4552	Microsoft ED.exe	152
PID 4552 wrote to memory of 1736	4552	Microsoft ED.exe	152
PID 1736 wrote to memory of 4448	1736	Microsoft ED.exe	117
PID 1736 wrote to memory of 4448	1736	Microsoft ED.exe	117
PID 1736 wrote to memory of 4448	1736	Microsoft ED.exe	117
PID 1736 wrote to memory of 4108	1736	Microsoft ED.exe	119
PID 1736 wrote to memory of 4108	1736	Microsoft ED.exe	119
PID 1736 wrote to memory of 4108	1736	Microsoft ED.exe	119
PID 1736 wrote to memory of 3436	1736	Microsoft ED.exe	122
PID 1736 wrote to memory of 3436	1736	Microsoft ED.exe	122
PID 1736 wrote to memory of 3436	1736	Microsoft ED.exe	122
PID 3436 wrote to memory of 384	3436	Microsoft ED.exe	123

C:\Users\Admin\AppData\Local\Temp\7c0af73c19bd8d1148bb8d506d00cc8f.exe
"C:\Users\Admin\AppData\Local\Temp\7c0af73c19bd8d1148bb8d506d00cc8f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\7c0af73c19bd8d1148bb8d506d00cc8f.exe
  "C:\Users\Admin\AppData\Local\Temp\7c0af73c19bd8d1148bb8d506d00cc8f.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Microsoft ED" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\7c0af73c19bd8d1148bb8d506d00cc8f.exe" /rl HIGHEST /f
    3⤵
    - Quasar RAT
    - Creates scheduled task(s)
    PID:3436
- - C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1196
  - - C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4528
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Microsoft ED" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:1932
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 2224
        5⤵
        Program crash
        
        PID:1780
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nvnp54jypni3.bat" "
        5⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
        6⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Microsoft ED" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:2432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4FAEcuP0nJfF.bat" "
        8⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        9⤵
        Runs ping.exe
        
        PID:4108
        
        C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3436
        
        C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:384
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Microsoft ED" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe" /rl HIGHEST /f
        11⤵
        Creates scheduled task(s)
        
        PID:3460
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 2184
        11⤵
        Program crash
        
        PID:3332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3u9xiV5JIkXp.bat" "
        11⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:1456
        
        C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1576
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Microsoft ED" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe" /rl HIGHEST /f
        14⤵
        Creates scheduled task(s)
        
        PID:1668
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 2216
        14⤵
        Program crash
        
        PID:4032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B9eT2z37weMi.bat" "
        14⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:3672
        
        C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:464
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Microsoft ED" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe" /rl HIGHEST /f
        17⤵
        Creates scheduled task(s)
        
        PID:2264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 464 -s 2196
        17⤵
        Program crash
        
        PID:1124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0D8PuhRxIcH1.bat" "
        17⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1736
        
        C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:764
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Microsoft ED" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe" /rl HIGHEST /f
        20⤵
        Creates scheduled task(s)
        
        PID:2232
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 2184
        20⤵
        Program crash
        
        PID:4908
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IbFKKjTkh2um.bat" "
        20⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:4392
        
        C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4860
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Microsoft ED" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe" /rl HIGHEST /f
        23⤵
        Creates scheduled task(s)
        
        PID:3264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 2240
        23⤵
        Program crash
        
        PID:3364
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WNiPCACwYhJT.bat" "
        23⤵
        
        PID:316
        
        C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:1988
        
        C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3348
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Microsoft ED" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe" /rl HIGHEST /f
        26⤵
        Creates scheduled task(s)
        
        PID:4376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3348 -s 2240
        26⤵
        Program crash
        
        PID:4292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FuDmVwpNhuey.bat" "
        26⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1268
        
        C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:624
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Microsoft ED" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe" /rl HIGHEST /f
        29⤵
        Creates scheduled task(s)
        
        PID:4276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pMsGcLjbXTq9.bat" "
        29⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        30⤵
        Runs ping.exe
        
        PID:3172
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        30⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:2648
        
        C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2224
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Microsoft ED" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe" /rl HIGHEST /f
        32⤵
        Creates scheduled task(s)
        
        PID:2232
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6hFg9BQcU0oL.bat" "
        32⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        33⤵
        Runs ping.exe
        
        PID:4104
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        33⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:1748
        
        C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
        34⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4864
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Microsoft ED" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe" /rl HIGHEST /f
        35⤵
        Creates scheduled task(s)
        
        PID:4836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\je3z1nvv1XtR.bat" "
        35⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        36⤵
        Runs ping.exe
        
        PID:3264
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        36⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
        36⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:3168
        
        C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
        37⤵
        Executes dropped EXE
        
        PID:1576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 2264
        35⤵
        Program crash
        
        PID:3956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 2240
        32⤵
        Program crash
        
        PID:3648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 2220
        29⤵
        Program crash
        
        PID:880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 2244
        8⤵
        Program crash
        
        PID:2292
        
        C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe"
        7⤵
        Executes dropped EXE
        
        PID:3044

C:\Windows\SysWOW64\chcp.com
chcp 65001
1⤵
PID:2920

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
1⤵
- Runs ping.exe
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4528 -ip 4528
1⤵
PID:1336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4552 -ip 4552
1⤵
PID:4728

C:\Windows\SysWOW64\chcp.com
chcp 65001
1⤵
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 384 -ip 384
1⤵
PID:4700

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
1⤵
- Runs ping.exe
PID:2920

C:\Windows\SysWOW64\chcp.com
chcp 65001
1⤵
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1576 -ip 1576
1⤵
PID:4076

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of WriteProcessMemory
PID:5100

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
1⤵
- Runs ping.exe
PID:4216

C:\Windows\SysWOW64\chcp.com
chcp 65001
1⤵
PID:1044

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
1⤵
- Runs ping.exe
PID:2184

C:\Windows\SysWOW64\chcp.com
chcp 65001
1⤵
PID:924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 464 -ip 464
1⤵
PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 764 -ip 764
1⤵
PID:408

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
1⤵
- Runs ping.exe
PID:1764

C:\Windows\SysWOW64\chcp.com
chcp 65001
1⤵
PID:2224

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4860 -ip 4860
1⤵
PID:3228

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
1⤵
- Runs ping.exe
PID:2740

C:\Windows\SysWOW64\chcp.com
chcp 65001
1⤵
PID:2324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3348 -ip 3348
1⤵
PID:4844

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
1⤵
- Runs ping.exe
PID:2880

C:\Windows\SysWOW64\chcp.com
chcp 65001
1⤵
PID:4876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 624 -ip 624
1⤵
PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2224 -ip 2224
1⤵
PID:1300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4864 -ip 4864
1⤵
PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7c0af73c19bd8d1148bb8d506d00cc8f.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7c0af73c19bd8d1148bb8d506d00cc8f.exe.log
Size 617B
SHA256 a1bfa4a011b012ad137559e269309fa48ee7737d91af4320bd39e9ba5265779b
MD5 8da25da2cbfb7f01449bdce954580af2
SHA1 9bd252fd36f79c59ff0428b61c5d496c9e8c8afe
SHA512 22d86a6996f7b663e9da6a161de69cd260575c1f62cc025e1a6f05b8e3275b9a9930e2893faf07e3382129af83b497a72f2f91eed3db30d9dc12e3a21050f00a
MD5 SHA1 SHA512

Submit Download

0D8PuhRxIcH1.bat

Path C:\Users\Admin\AppData\Local\Temp\0D8PuhRxIcH1.bat
Size 213B
SHA256 3777d8c4fd6bb2a2403d5859f9215bb6adde17f7f6b823bf288a83576f020da2
MD5 8b9d750e687c675654adcb25a5cd743b
SHA1 132cfbeb05d1cf225d75ea02c88273a56f35d2d2
SHA512 010e99a8c581323465370f1d8368ba8d8227c1ec7d9fb606c94196ae3831f8bc7bd47523413cfbebfd5d2c22c35b4d7a4ebef0859f22f2cbfd26649ffa85e8d8
MD5 SHA1 SHA512

Submit Download

3u9xiV5JIkXp.bat

Path C:\Users\Admin\AppData\Local\Temp\3u9xiV5JIkXp.bat
Size 213B
SHA256 08651a992f4a7e1bc7ce8c2286d75a4ecd182b3c1ffc65ab5c1f0bc4c133c480
MD5 ee9901b3f388ce3cb3e88043823b210b
SHA1 d8784ab455d5f3b6b08deab22bdbf21764b162dc
SHA512 8a032d104115d43f968b51965a24eacfd908279e8e040c163a708a6ad45730a1cc0942e39096b9aa0f566519efcdad96de74dbad5761ad8aaf1f3ec38f1df049
MD5 SHA1 SHA512

Submit Download

4FAEcuP0nJfF.bat

Path C:\Users\Admin\AppData\Local\Temp\4FAEcuP0nJfF.bat
Size 213B
SHA256 2ab192ce43c66635e1f504a7937812bd78cfd42582d1fa620bc5d9e0aee4298e
MD5 c52507bb80b696eb4ff7976ff273c4c7
SHA1 e15aa9e5abf08f03b97f2ca33d665ac42292debc
SHA512 6d38125b8f705045f4d943cd6984fe0277e35e9f39a1f4ef35a2f4ae6193f9da268eff5c44f477694dd9bdbc8e23e78741a5535e2e7a04a99fac80fa53ab6fca
MD5 SHA1 SHA512

Submit Download

6hFg9BQcU0oL.bat

Path C:\Users\Admin\AppData\Local\Temp\6hFg9BQcU0oL.bat
Size 213B
SHA256 cf4665e80637ccb787250d3db607a04d41d5ffd3979efe016d14de64bd90bead
MD5 200423838873c7f82e26d3d6df22a459
SHA1 9f1005a72480cc7aa4c255a3d2bccfba87d8befc
SHA512 b61843e31edfab70c9ba04ea0f35972b1a32d87edde6d3bd1a2cdee70c707dd247ffef4d3328c8d0d118730bea19035b9abff7d2fa1ae6013ca0c732c6694293
MD5 SHA1 SHA512

Submit Download

B9eT2z37weMi.bat

Path C:\Users\Admin\AppData\Local\Temp\B9eT2z37weMi.bat
Size 213B
SHA256 ab3e0186ea96f760d14b4bc7b6e2d4d8147ec58c53aa103a7abd78dfd81e4216
MD5 ae216b347068f6b604e47d0fbc87b783
SHA1 ca081f4d4f3c79d085cc97e87563b83ceb05a87d
SHA512 6a277ed4d736f374199868f4e23a7c9f73e393dcd9f5245849e83db7e4460c5170d90b0b8a7a86bce80e8e264391c9b8bbb226888c4e0b6ca9f3f1a22247232c
MD5 SHA1 SHA512

Submit Download

FuDmVwpNhuey.bat

Path C:\Users\Admin\AppData\Local\Temp\FuDmVwpNhuey.bat
Size 213B
SHA256 2e2f1c7d41de51751da7847e62f458e61d0707c88198353120f85fd0f340e607
MD5 4106090619906dd20f1954498a3ce5b6
SHA1 13fb77e91298a0289657b89b0a8a831594ba9533
SHA512 7dbe0e9403a30598be6814f8eb4d82cb93faa1224486b8e602e5f33d4109e72942c6a3120799c497409ab762200cc5f6a385966d6d41086415ca7cf49cd370db
MD5 SHA1 SHA512

Submit Download

IbFKKjTkh2um.bat

Path C:\Users\Admin\AppData\Local\Temp\IbFKKjTkh2um.bat
Size 213B
SHA256 3a886cdcb42232a69a738debe6ae1290baeb70d3c75ef10fa25491eac6a53b45
MD5 bd42c3a42889b37082b84ea1d7a37d4f
SHA1 1d270390dc917e12ecbc33407071be0fc1933155
SHA512 2d7de91b2b0ef8149f0231f3b00ae9c1f0407b537a42ed80c36207121ad9f605f59d3260a9ce8c28746a628ac741247aecbf3e6de0aec12dad1c51f4405d3aef
MD5 SHA1 SHA512

Submit Download

WNiPCACwYhJT.bat

Path C:\Users\Admin\AppData\Local\Temp\WNiPCACwYhJT.bat
Size 213B
SHA256 03e3282f4d29a369c3d057b56c554388b2b5ba4532e41921f24c9aa85398c706
MD5 870b73467db9108009722c26e591028a
SHA1 fff25bd114b1551661cc4b89e94f8d9271fb025e
SHA512 6860ede62fb26ee9939992addf7014e5c4bc39dcd23feed25c8868861a691787de0a6e5a8196065d8ddee7f7a489cf9bd039b3c4e93e36d385bb4ae4b57a4647
MD5 SHA1 SHA512

Submit Download

je3z1nvv1XtR.bat

Path C:\Users\Admin\AppData\Local\Temp\je3z1nvv1XtR.bat
Size 213B
SHA256 05f1c434db5c3578fb7c4beefcc329a34a5a2f4cefe7a84cb39a67b5693a45cf
MD5 d1f8b25d6657d5c38a85da89ce9a8d03
SHA1 cc2f6ddc1df5e5a8e13f8c8622f67a5d38972956
SHA512 35aa348cf7467ea64c54f98dc3b769ef4b30b9ac083416727eebf54c1f30757cb7cc118fa7484565e59e930f80db93abc26a19ffbc3e8a565fd149fb2ffbfc8d
MD5 SHA1 SHA512

Submit Download

nvnp54jypni3.bat

Path C:\Users\Admin\AppData\Local\Temp\nvnp54jypni3.bat
Size 213B
SHA256 61947716f3e7abba1366886d260e1822fd48c2babe74285f68ca47196ab4e3ff
MD5 da2db4c71518d3545a9070726c88004b
SHA1 8e542096ca48c954e2ad7d8203d31233dba432ff
SHA512 39f92ed5fa34c42fb4f8389146610b2ed19c454f68572772e2af80f75ff5a4f171285cca8132776390b804cb44c194e60c0f92c280d8a29d48a0aaa4a43cb36a
MD5 SHA1 SHA512

Submit Download

pMsGcLjbXTq9.bat

Path C:\Users\Admin\AppData\Local\Temp\pMsGcLjbXTq9.bat
Size 213B
SHA256 c00e5d706de1a9a20a8d06489bae563d49980f7201bb60d4dfc7ca123dd09806
MD5 74c860ab88691f5903a34e03fb7ede03
SHA1 924827f0182de447392961b3ad9a5e0ee43fcdf6
SHA512 591276dd52ef0036617accce892b453d276fbe3cd8db0d3003cdc03c3822696dbfd95255d8536af0e0921b1a19fe826099369d7153b5fdcce9fbcc28ecb04b84
MD5 SHA1 SHA512

Submit Download

01-28-2024

Path C:\Users\Admin\AppData\Roaming\Logs\01-28-2024
Size 224B
SHA256 10bad6618f34402ad274266e6c9fcb47381c3be846f942422b4b1541de242f31
MD5 826b857a636bb92f6773eccfe0a32cfa
SHA1 6971606791fd73c11b4eb53b262b11bf1b57762f
SHA512 e8d12dcde4f6578205291428d2e0459cd04372d7aed8c84fa5bd73c37e7e0b91b0885d2fd9e2acf0464f996f114083b44a569811f89d549b9603455966b1bca0
MD5 SHA1 SHA512

Submit Download

01-28-2024

Path C:\Users\Admin\AppData\Roaming\Logs\01-28-2024
Size 224B
SHA256 34cb550de5e32635d086f9bb18e5e044d914f14bbca3c1a6deb6cac50e5e4d1c
MD5 13eee66e839c973c476f612d15ddb444
SHA1 e98add91579ad63cf0a8412dc1d2d5864513031d
SHA512 175b37bddb5df5835b6d0412538f7eaf542623fa8021bbf0f5217be9f6de5f278851bd9dee246cc3eca107f86365107a845ed37dab1529903dc0d62e8ace2aba
MD5 SHA1 SHA512

Submit Download

01-28-2024

Path C:\Users\Admin\AppData\Roaming\Logs\01-28-2024
Size 224B
SHA256 80725fd26019ba79a65e7358cdcd7c382fefec25f8c53f6eb4e091533966825f
MD5 5651d9e3a5e988084235db44edd13c73
SHA1 4d2e5c4ee4cc6f4ea2f691c92a0a97ea3f9a1af5
SHA512 1f2b47da2ec43d815209d277d309752df03bfdeadc607324a6063761c9b8374be95087e704d254c66b057ecf47be3c3daf89e0e48e6527e66766c7db51dc7056
MD5 SHA1 SHA512

Submit Download

01-28-2024

Path C:\Users\Admin\AppData\Roaming\Logs\01-28-2024
Size 224B
SHA256 a9d93acbf0dd74c5de900f9a350a52f1731b724d465558328e73a03a1abf2612
MD5 4aada3da522268f4b1f647cf755a480d
SHA1 18be5dc7eaf27fc7a7b81e813e5d9d2ce78c1825
SHA512 9c695d14147535d0977e6f0ef37cf0bd2d00c94172cd2339227eb578da65785795251eb1ac3bc6b2f0506ac64d959f72a553399eec3526a498f9d8e7391a863c
MD5 SHA1 SHA512

Submit Download

01-28-2024

Path C:\Users\Admin\AppData\Roaming\Logs\01-28-2024
Size 224B
SHA256 c917c3c2d03da940ecbdb9a400fde5f2ff7ccb0183239ebfc173e779ac8662ec
MD5 2d44a2fdcb268dc5173b8b2dfb6543b2
SHA1 b421e8c2f98c8ab3c377b39603e36544cec393d0
SHA512 c678116136a8cd5540d03efebff45cc212bc836f0c405aaf5d1e876e814a3ea7abef45be1f65e5a6391af5b77d4124103dbde328d172dcd8eb79c8f9b0155a52
MD5 SHA1 SHA512

Submit Download

01-28-2024

Path C:\Users\Admin\AppData\Roaming\Logs\01-28-2024
Size 224B
SHA256 36bedaeddd37dfc87c60e8c0e818514e9e9997cda39f958abfca570afd5f590a
MD5 50330f822ec99f751ca79ec5a1f392fa
SHA1 8ee00441816abbe21f92408ac7e8c022600e6c0d
SHA512 6e56f137ee43267786aee26457cedc5b40ccae30303a5d2f3a465ac723597b1823cf62cc18c9eddc9801a4a30f9de64f39c2469a3d7c57d720314bd76c1bc74b
MD5 SHA1 SHA512

Submit Download

01-28-2024

Path C:\Users\Admin\AppData\Roaming\Logs\01-28-2024
Size 224B
SHA256 d48aaed158e2c3a887cd784fbf5052c02f693fb1b4b81bf9587c6c2a8784e348
MD5 1bf41ab748925b8d983e83d6cd0dc54c
SHA1 0c8fc85a78e748780a7c59cff1080a6bb2f16a99
SHA512 844abdc48defaf1c5b2ec945415f4c87b2b8d1da8a14256c5be534d6eb9d8274af190967b283881e2a7228ef9664b5aad847d4199b75d1c86ca57f4ea0ee48a5
MD5 SHA1 SHA512

Submit Download

01-28-2024

Path C:\Users\Admin\AppData\Roaming\Logs\01-28-2024
Size 224B
SHA256 a1bf86239530b3757f10382f86473492fb2d152bd9737010c8692ecc85380798
MD5 c6085285f1fc8db72f319a82927813c8
SHA1 36adcbb64814c3f8544330680ed432e418f7189e
SHA512 d62ca5e0b82af459836cd5df1b88d319597f25a6d44e9734b08968558ca37fa61e1f4a4e9bcd1e1d13a8c052f3eb7e467f90c7a52145e84027fa612c7e1c2a41
MD5 SHA1 SHA512

Submit Download

01-28-2024

Path C:\Users\Admin\AppData\Roaming\Logs\01-28-2024
Size 224B
SHA256 4ffda607f65b3fc416fed27356a9530236173ce31777e6b8ab5c1ba1d0d56ca2
MD5 90cace703473ed7687a3b072c57c6cb1
SHA1 23f894f7cf8d09e4cd821ce02ff8cfe7b95b8203
SHA512 bcba65b44c9100871004519864707ad5d90082335bbb51c733667c86c17d97a2027fef445443d843baceb92fc781f79cf0144f91074a2ab79dc4aec91b1b6a8c
MD5 SHA1 SHA512

Submit Download

01-28-2024

Path C:\Users\Admin\AppData\Roaming\Logs\01-28-2024
Size 224B
SHA256 049fd6dd5cec1e2e52d9c1ee7af686d1e630523524f91621f693b96d726b7359
MD5 a3de22fd0ac6090b98ff1b7630cb83e9
SHA1 5e85f849e6b79b84f6a6848c7328d212f8ce1899
SHA512 495a028f648dbae8a12091930c4b754f9bbaf194c82ec34b6ff15d6306922ac7149b61902fe312ea9c81c3ac7cfa36ca1d154eaf431ac734c6058178278e0dc9
MD5 SHA1 SHA512

Submit Download

Microsoft ED.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
Size 194KB
SHA256 fe2a06a8528fc152dbb82af1e208806039e39a093b7c6d66046df404f5716a89
MD5 7d73308b1f802c81174b4d96f0ad9f0e
SHA1 9f94b729032b6fd64a29c7f4c3cf2ed2ab5d2e8b
SHA512 97a5d8e0df8345aa5a5c0a286936c11e963dc85ce5494307c3df4e2da19c7ebf87a5f9e9ded5c911ee9e2f625312bd3f43368aef2002db613d779bea27bcf459
SSDEEP 3072:HX4vWNheaWT66YQWd89XN1bkx5vz5TfRhP1qNHwezonxHKHdUvGuY9n:HIvueP66YQ7LBkxhz15hwHf0nIU+uOn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft ED.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
Size 45KB
SHA256 c281ef4e346b57c011ba89501cb36ce89d7641009be18e180c38a5d088f7b11e
MD5 5fef0b8bb2f2f60228a8431951b995bf
SHA1 9c6037ad33d178219425ceac7f34fc227848c55d
SHA512 284d6ed46e3a41591690960bf7cdc414a1b80b8c3ef6f6115372db2118465d3217562b3dbbd11c74f64ddaae1143b7b8e7a5bf56dc3946568b5f3c06de9acaf7
SSDEEP 192:iy7ywh0SWlem2KrOe+K6QAWn0PQ9hG+zctbdops/9EK+MQs:HOHle5KrOzQA3SzcZCnMQs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft ED.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
Size 663KB
SHA256 ec8335e515f697a2a7a7aa6a149ce31a5a697afed3ae181c7cf6caf4761f8d5a
MD5 6f473ae4e8b7e649ee81e88372759577
SHA1 8a3cf43998cf3aa4f8b7a452c97fcb255b305d44
SHA512 895ef9ca9e33909191ba6cdf54cbe3bbc0c5aa786312fe0b5cac1be072972e650435eb2746ca3c8e9f2fb3795bd7ce071b37fe073a5ff73cd8145d981c7ee601
SSDEEP 12288:uk7aH8ngusjGVtoGVr3Ke73xVYGemgZ7X+esmzVLvwo8H0tx9kG3y9:VajQoqr73xVgmgIesO9O2ty9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft ED.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
Size 160KB
SHA256 13921b001f8df8283d9c4a0cb96ad94ae9293887c8cbd95881de87d96ae9382f
MD5 20c1565d1b086ad8b270fecb421994a8
SHA1 9af7e6a4440ada56d18b810d1e8c62e0cee1f2fc
SHA512 d7e9d1de8ba0a45a36140ad36306d765a747fd9284e1fa0424fb091ff3935569f55d3f0aa42b0def57edcfd7b50fd0e534a7c56a8de10223da1fb956b70b01f4
SSDEEP 3072:HX4vWNheaWT66YQWd89XN1bkx5vz5TfRhP1qNHwezonxP:HIvueP66YQ7LBkxhz15hwHf0nJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft ED.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
Size 168KB
SHA256 0061b2b1666de0da5b20928f8245e7f0d6259a5751d77b0a079b4ba690293efe
MD5 0e7d47a0ac923d16e8aa212506fe8011
SHA1 fe722fff00bf8e04dd0ba787d14b50499f8de0f6
SHA512 f29c8b62dc0ed57295a52295e2419e3002b9b1a64e99c341c220faf3db5801eca694ca91fe9edb1f74c1bfe7cc48cdd73613fdd60e1194882215fff1b7a5a75a
SSDEEP 3072:HX4vWNheaWT66YQWd89XN1bkx5vz5TfRhP1qNHwezonxHKHd:HIvueP66YQ7LBkxhz15hwHf0nI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft ED.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
Size 105KB
SHA256 71c2dc63c425806c845f7eb8c7408bc96e84ca412a5cf71670c4a66c3abede65
MD5 c4e862ad31fafcc60b6c33defbebddd6
SHA1 5e29781b15cbcac5fd106d78753d1e0b5971e399
SHA512 ac73a1595018642035818af03ba36bf93a826c5cb0f30ceccaf708a52fd259cd0ba453f145545debabf79d9ef4cc0a027b5e29efb1a8be5e4133ad3693a16e0f
SSDEEP 1536:HX3EcFQvWNzteaWT66YxWWd8xDKg7d9+0/l71iyPkxL:HX4vWNheaWT66YQWd89XN1bk1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft ED.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
Size 358KB
SHA256 9e18fcf55d30fc032f07b887043d62d2efda863f471c2e720518ec11ec280e5e
MD5 f35aa2052e71e28124538912f72e67fd
SHA1 cc6b972bab6c014e963372ba7077a1b0b9fc93f5
SHA512 84ae641e5bcca61ff0f18eb009f7e66919035a265b3b76569f930372428b298ad5e7d9de5bc691ee332c118a82133eb69fffcdabfb06e9e6a6acee25a27b64ab
SSDEEP 6144:HIvueP66YQ7LBkxhz15hwHf0nIU+uO5jGV8soFtcJPVr1/lzKeto8k:uk7aH8ngusjGVtoGVr3Ke7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft ED.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
Size 340KB
SHA256 9696d2fbe7b6d53befd3ec8b4b733086cc047f2a0e051342716f1940594a90c0
MD5 c777524780e565e9483d1349a5f2b2fa
SHA1 85965a44f5d87aad7811b32fadeaaccce5f26e6f
SHA512 6730fc2bc92977770aad856542dcc26117cce738e67fe1e28c8da57412fc145c2f30d3157634f2605712dde4d72bede070fa808f7201b64cd1a3180264f9e679
SSDEEP 6144:HIvueP66YQ7LBkxhz15hwHf0nIU+uO5jGV8soFtcJPVr1/lzKeR:uk7aH8ngusjGVtoGVr3KeR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft ED.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
Size 277KB
SHA256 6f98f6e3fa4159732697118aa9d2496478c3c7129966456c4148da3f13615129
MD5 c665199dc0688a4d2515adab56410cbb
SHA1 b3bdb14cc35bcb7db087f23cf6d994eb302a5e47
SHA512 46ee3d47a78e2184908314c24218a2ed5ac99ec33374ee7f22d895fedc0e7a007e6d762f3a39ba889eee46172a7398a39b72be5d957cc0fa48392e95844d096f
SSDEEP 6144:HIvueP66YQ7LBkxhz15hwHf0nIU+uO5jGV8soFx:uk7aH8ngusjGVtoL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft ED.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
Size 216KB
SHA256 9fc888aef6ef1861cca6becb4a672a55969bca0ea8f6ff9825991a8236c4af1f
MD5 2bbb2ae89381a788015799c20aaacef7
SHA1 f749fec429104426045d42eb97e1c9cbf2a2436e
SHA512 70c719c039362d41abbf3613e35c88e071bfb5c5003f614538cfb083667826bce0149876960eb97f5d7fbfdd505d50cee02263a15d5c09469d4774dec5105cf6
SSDEEP 6144:HIvueP66YQ7LBkxhz15hwHf0nIU+uO5jw:uk7aH8ngusjw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft ED.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
Size 499KB
SHA256 0b02b913c7912249aa98f14a9de9fea78f4210568673252322c705bf47a53ccc
MD5 18915517b075b01fcdf2b80296e7c391
SHA1 64c7750bc6e9a79d4ff6c8e7b29c4a58059ecd9f
SHA512 20335697e65b9a2b6a9ecb97c0f66d96412926f1533e283746b4e1d56ae2d007055cb7a41478092ac6c1de907f583d7a2455de10084af7df5e3c0e9fd0387375
SSDEEP 12288:uk7aH8ngusjGVtoGVr3Ke73xVYGemgZ75:VajQoqr73xVgmgP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft ED.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
Size 277KB
SHA256 eaaf2a4f664b038155f625aa6e9003c137bcde29396c82fb340a571e8e809cb8
MD5 4f4de0c4ea4633fb24437a9b576a24df
SHA1 ca7aad29c58272b807c0a02cb2deadb199f14ed6
SHA512 6ad82400f4b1c68d547721d3f3d3931c12d1bb98e64170d0df7d508b870cfae164f959fbcb70c0d0763d2177e6dd9f9f0590723551caf27203408913aed5e75c
SSDEEP 6144:HIvueP66YQ7LBkxhz15hwHf0nIU+uO5jGV8soFE:uk7aH8ngusjGVto2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft ED.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
Size 269KB
SHA256 35812b7eaf8df20d34e1cfd31e76461970590ff2c728acae0e84c00c6ef0c8e2
MD5 be0d016fed1d45497110e00fcff78ad5
SHA1 58ac8cf5648886e61bab93758502c7879147eb94
SHA512 f727b90212a41835b06199eff3066029ca88edd077f78d1b6f634d460046d72c352710a168cf7f48452f893997fe54179727a896f06018ee06d6ff9290aa0950
SSDEEP 6144:HIvueP66YQ7LBkxhz15hwHf0nIU+uO5jGV8sI:uk7aH8ngusjGVtI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft ED.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
Size 114KB
SHA256 b5e788af26923792b04fd65e35ed2ee4a908fecae4c8a5095a37b58e5ded67cb
MD5 c55f64ba945e71d16a2cc97b0677fb84
SHA1 4175ac2334b40b094d2fada4f97f2700b6a917a3
SHA512 27ef9dbf30203aadf9dfb1b5f6e2ab5449165e38e0f2389089d37a7e711f12f0151f40dc2b046a2cad168038deacf63566b57edc0552844b847f13dd011116b5
SSDEEP 1536:HX3EcFQvWNzteaWT66YxWWd8xDKg7d9+0/l71iyPkxvqA+:HX4vWNheaWT66YQWd89XN1bkx5+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft ED.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
Size 640KB
SHA256 48a8284deeb7baf55eb2176c952d9bb74a173ebff4685626e65c94fd30732da1
MD5 e03621c7d05f77e0d9428bae6832ac02
SHA1 2366e782d57bf10629cfc5d85b639e4200f82e2d
SHA512 57f703f2e8fab8e08933a4b5552220ab757ed55d1707555592acf434a61b529dbb25a5202a303a24e85e3bcc72d2ac281a9702d91df01a6e4eeb0385a6a96ed4
SSDEEP 12288:uk7aH8ngusjGVtoGVr3Ke73xVYGemgZ7X+esmzVLvwo8H0tx9kp:VajQoqr73xVgmgIesO9O2Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft ED.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
Size 595KB
SHA256 9ec42d352b53f9ed1918fd4e9eb4d29f1d46d036b9398ac6cc43ec4ef04eec63
MD5 5753f1a59d4f94d699ee01822e206bc7
SHA1 ffc8bedbdd1ea14308a6de9e70c18c0e7af26275
SHA512 e31b8c3d6261fbbbbb9d3e43b0c825ec86ac37247802e32004247f3f582c3a4284cb3b48dc3f95f7c1de5a6c7dd7281baeca9d08f4b7b874298b007eda49e833
SSDEEP 12288:uk7aH8ngusjGVtoGVr3Ke73xVYGemgZ7X+esmzVLvwo8l:VajQoqr73xVgmgIesO9Ol
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft ED.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
Size 518KB
SHA256 4c889ec3079e73ba8d7d4b2925a1d604a3ba248a02412fe836e1f04f9980a670
MD5 511db49f16fb0834c2825543e02b53ce
SHA1 d74a6a97c16dd84a7db2fd589583a13a18f7bcc5
SHA512 7ef708f44849421dd1fa2cc4769855e97579985d896409144efbabb814581f497dc5c4086ae425c963f1c031916eb81416c6ba750cc91a8ff55a5104cb84f0ff
SSDEEP 12288:uk7aH8ngusjGVtoGVr3Ke73xVYGemgZ7X+eo:VajQoqr73xVgmgIeo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft ED.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
Size 289KB
SHA256 6c2ac9bbcd2dbc2bff2d84852140c767a8487017733e7204a95a944f2d4053f8
MD5 dbad7b7a143301b50ec8b74a6577fc08
SHA1 eb84f3944d0587e9b7c65ac8c2e896ffac42a4a1
SHA512 f950005b35b27e295f0c96cc3b0f0bd813b23988d5fe8533bef7a87c8868f647cacc2c678b53ceb73ea0e7c7d21ecb42a2a6f54803cfe022c8a2f6ee7e3d2f6c
SSDEEP 6144:HIvueP66YQ7LBkxhz15hwHf0nIU+uO5jGV8soFt6:uk7aH8ngusjGVtou
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft ED.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
Size 415KB
SHA256 7324463f5c68b9c5fb2e835747eb3feaa441ad6f6456024d43a73b9fa6b72877
MD5 d8612e0d0d003cea0c1ef55a6eee3b27
SHA1 9a5c837b76614be010017499503e12545d53166c
SHA512 5d8908bfb5cbad6be41d7a258b4c8be10b47a0640564e1261f45b8ccc104157a208373f91870a89487ec32fec4c44e8cd64ed560a9b8d6cca4103408f3aeb99d
SSDEEP 6144:HIvueP66YQ7LBkxhz15hwHf0nIU+uO5jGV8soFtcJPVr1/lzKeto8UPsv9vV4Lgp:uk7aH8ngusjGVtoGVr3Ke73xVN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft ED.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Microsoft ED.exe
Size 798KB
SHA256 fd413b5eafbaba0a52aa233cb407bc4492207cc84cd320b7110e0412e528fed6
MD5 7c0af73c19bd8d1148bb8d506d00cc8f
SHA1 f0d049209bee2c47a4f4918b597d53f39308f184
SHA512 b697914df39a74d6282147f1dc557971cecd0ed608aa60be67dbb9351dbc61d9d4a247e7cab6f5dd3ee199ccbaba91415e14ac89d41238c4eb8b71394880da9d
SSDEEP 24576:VajQoqr73xVgmgIesO9O2tyA19ESiWy9EFFTZdXTZdHXTZdXTZ5:V2QvvQuAZiSTZdXTZdHXTZdXTZ5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/384-59-0x0000000005500000-0x0000000005510000-memory.dmp

Download

memory/384-58-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/384-66-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/464-95-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/464-88-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/624-145-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/624-146-0x00000000054A0000-0x00000000054B0000-memory.dmp

Download

memory/764-102-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/764-103-0x00000000055F0000-0x0000000005600000-memory.dmp

Download

memory/764-110-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/1196-22-0x0000000004C60000-0x0000000004C70000-memory.dmp

Download

memory/1196-28-0x0000000074CD0000-0x0000000075480000-memory.dmp

Download

memory/1196-21-0x0000000074CD0000-0x0000000075480000-memory.dmp

Download

memory/1268-39-0x00000000054D0000-0x00000000054E0000-memory.dmp

Download

memory/1268-38-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/1268-141-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/1268-144-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/1268-43-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/1456-72-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/1456-69-0x0000000002960000-0x0000000002970000-memory.dmp

Download

memory/1456-68-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/1576-73-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/1576-81-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/1576-74-0x0000000004FF0000-0x0000000005000000-memory.dmp

Download

memory/1736-101-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/1736-98-0x00000000052D0000-0x00000000052E0000-memory.dmp

Download

memory/1736-97-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/1988-127-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/1988-131-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/1988-128-0x0000000005820000-0x0000000005830000-memory.dmp

Download

memory/2292-1-0x0000000074CD0000-0x0000000075480000-memory.dmp

Download

memory/2292-3-0x00000000056B0000-0x000000000574C000-memory.dmp

Download

memory/2292-0-0x0000000000940000-0x0000000000A10000-memory.dmp

Download

memory/2292-2-0x0000000005500000-0x0000000005510000-memory.dmp

Download

memory/2292-4-0x0000000005D00000-0x00000000062A4000-memory.dmp

Download

memory/2292-5-0x0000000005680000-0x0000000005698000-memory.dmp

Download

memory/2292-9-0x0000000074CD0000-0x0000000075480000-memory.dmp

Download

memory/3348-139-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/3348-132-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/3436-57-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/3436-53-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/3436-54-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Download

memory/3612-11-0x0000000005510000-0x00000000055A2000-memory.dmp

Download

memory/3612-20-0x0000000074CD0000-0x0000000075480000-memory.dmp

Download

memory/3612-12-0x00000000055D0000-0x00000000055E0000-memory.dmp

Download

memory/3612-13-0x00000000055E0000-0x0000000005646000-memory.dmp

Download

memory/3612-14-0x0000000006330000-0x0000000006342000-memory.dmp

Download

memory/3612-10-0x0000000074CD0000-0x0000000075480000-memory.dmp

Download

memory/3612-6-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/3612-15-0x00000000069B0000-0x00000000069EC000-memory.dmp

Download

memory/3672-87-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/3672-84-0x00000000052E0000-0x00000000052F0000-memory.dmp

Download

memory/3672-83-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/4392-113-0x0000000004F20000-0x0000000004F30000-memory.dmp

Download

memory/4392-116-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/4392-112-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/4528-31-0x0000000006740000-0x000000000674A000-memory.dmp

Download

memory/4528-36-0x0000000074CD0000-0x0000000075480000-memory.dmp

Download

memory/4528-29-0x0000000004F40000-0x0000000004F50000-memory.dmp

Download

memory/4528-27-0x0000000074CD0000-0x0000000075480000-memory.dmp

Download

memory/4552-51-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/4552-44-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/4860-117-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/4860-125-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/4860-118-0x0000000005560000-0x0000000005570000-memory.dmp

Download