zgrat | e0aa620a8b2b7688482b39a6fafabe217fa4d774ce7441721e42b6bfdc88c450

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/02/2024, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
03AA7A6EE5B0FB49D3CFEBB6FC21D393.exe
Size 377KB
Sample240206-2fc2xabfdq
SHA256 e0aa620a8b2b7688482b39a6fafabe217fa4d774ce7441721e42b6bfdc88c450
MD5 03aa7a6ee5b0fb49d3cfebb6fc21d393
SHA1 c3b96bd8b624dbf4f2cf7a15bb4c54b78d8f57be
SHA512 3a6ee0fd4d4671ad947f55f97289521794ba0cef69c73ef575fe5344860d3acab410f1f62f888901531b34ce181e3c9ab070fb2b233fe9cd6ab745724c255e28
SSDEEP 6144:FmQfXZRlEkTnh3PFKY3b1+H2DCiRMZkS11zGdo9s5h3/7m+A0jH8z31mgjilbyi:FhvHTbb1+WDzRsvzGde0P7m+JjcObyi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat evasion persistence rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 8 IoCs

resource	yara_rule
behavioral1/files/0x0037000000014823-54.dat	family_zgrat_v1
behavioral1/files/0x0037000000014823-55.dat	family_zgrat_v1
behavioral1/files/0x0037000000014823-56.dat	family_zgrat_v1
behavioral1/files/0x0037000000014823-57.dat	family_zgrat_v1
behavioral1/memory/1088-58-0x00000000010E0000-0x0000000001478000-memory.dmp	family_zgrat_v1
behavioral1/files/0x0006000000015c75-135.dat	family_zgrat_v1
behavioral1/files/0x000900000001530d-204.dat	family_zgrat_v1
behavioral1/files/0x000900000001530d-205.dat	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ja-JP\\csrss.exe\""	cs2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ja-JP\\csrss.exe\", \"C:\\Program Files (x86)\\Common Files\\DESIGNER\\cs2.exe\""	cs2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ja-JP\\csrss.exe\", \"C:\\Program Files (x86)\\Common Files\\DESIGNER\\cs2.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\lsm.exe\""	cs2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ja-JP\\csrss.exe\", \"C:\\Program Files (x86)\\Common Files\\DESIGNER\\cs2.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\Recovery\\7fa09f22-9ba8-11ee-8a6f-e96ea47544f1\\dwm.exe\""	cs2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ja-JP\\csrss.exe\", \"C:\\Program Files (x86)\\Common Files\\DESIGNER\\cs2.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\Recovery\\7fa09f22-9ba8-11ee-8a6f-e96ea47544f1\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\csrss.exe\""	cs2.exe

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	1216	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	1216	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	1216	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	300	1216	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1880	1216	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	1216	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	1216	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	436	1216	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	1216	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	1216	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	680	1216	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	1216	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	1216	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	1216	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	1216	schtasks.exe	34

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
2680	Everything2.exe
1088	cs2.exe
2596	cs2.exe

Loads dropped DLL 2 IoCs

pid	Process
1640	cmd.exe
1640	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\ja-JP\\csrss.exe\""	cs2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\cs2 = "\"C:\\Program Files (x86)\\Common Files\\DESIGNER\\cs2.exe\""	cs2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cs2 = "\"C:\\Program Files (x86)\\Common Files\\DESIGNER\\cs2.exe\""	cs2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\lsm.exe\""	cs2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\7fa09f22-9ba8-11ee-8a6f-e96ea47544f1\\dwm.exe\""	cs2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\csrss.exe\""	cs2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\ja-JP\\csrss.exe\""	cs2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\7fa09f22-9ba8-11ee-8a6f-e96ea47544f1\\dwm.exe\""	cs2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\csrss.exe\""	cs2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\lsm.exe\""	cs2.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\fbfjrg.exe	csc.exe
File created	\??\c:\Windows\System32\CSCBEA2AA715DB0488B858DE6DA77C761D9.TMP	csc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\DESIGNER\cs2.exe	cs2.exe
File created	C:\Program Files (x86)\Common Files\DESIGNER\0a3e888dd97522	cs2.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\ja-JP\csrss.exe	cs2.exe
File opened for modification	C:\Windows\ja-JP\csrss.exe	cs2.exe
File created	C:\Windows\ja-JP\886983d96e3d3e	cs2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1948	schtasks.exe
2344	schtasks.exe
2472	schtasks.exe
2068	schtasks.exe
2436	schtasks.exe
1880	schtasks.exe
1936	schtasks.exe
1856	schtasks.exe
2948	schtasks.exe
1368	schtasks.exe
1852	schtasks.exe
2332	schtasks.exe
300	schtasks.exe
436	schtasks.exe
680	schtasks.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1900	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2804	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe
1088	cs2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2596	cs2.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2132	03AA7A6EE5B0FB49D3CFEBB6FC21D393.exe
Token: SeDebugPrivilege	1088	cs2.exe
Token: SeDebugPrivilege	320	powershell.exe
Token: SeDebugPrivilege	888	powershell.exe
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeDebugPrivilege	872	powershell.exe
Token: SeDebugPrivilege	2596	cs2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2596	cs2.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2680	2132	03AA7A6EE5B0FB49D3CFEBB6FC21D393.exe	28
PID 2132 wrote to memory of 2680	2132	03AA7A6EE5B0FB49D3CFEBB6FC21D393.exe	28
PID 2132 wrote to memory of 2680	2132	03AA7A6EE5B0FB49D3CFEBB6FC21D393.exe	28
PID 2132 wrote to memory of 2680	2132	03AA7A6EE5B0FB49D3CFEBB6FC21D393.exe	28
PID 2680 wrote to memory of 2644	2680	Everything2.exe	29
PID 2680 wrote to memory of 2644	2680	Everything2.exe	29
PID 2680 wrote to memory of 2644	2680	Everything2.exe	29
PID 2680 wrote to memory of 2644	2680	Everything2.exe	29
PID 2644 wrote to memory of 1640	2644	WScript.exe	30
PID 2644 wrote to memory of 1640	2644	WScript.exe	30
PID 2644 wrote to memory of 1640	2644	WScript.exe	30
PID 2644 wrote to memory of 1640	2644	WScript.exe	30
PID 1640 wrote to memory of 1900	1640	cmd.exe	32
PID 1640 wrote to memory of 1900	1640	cmd.exe	32
PID 1640 wrote to memory of 1900	1640	cmd.exe	32
PID 1640 wrote to memory of 1900	1640	cmd.exe	32
PID 1640 wrote to memory of 1088	1640	cmd.exe	33
PID 1640 wrote to memory of 1088	1640	cmd.exe	33
PID 1640 wrote to memory of 1088	1640	cmd.exe	33
PID 1640 wrote to memory of 1088	1640	cmd.exe	33
PID 1088 wrote to memory of 2976	1088	cs2.exe	38
PID 1088 wrote to memory of 2976	1088	cs2.exe	38
PID 1088 wrote to memory of 2976	1088	cs2.exe	38
PID 2976 wrote to memory of 2376	2976	csc.exe	40
PID 2976 wrote to memory of 2376	2976	csc.exe	40
PID 2976 wrote to memory of 2376	2976	csc.exe	40
PID 1088 wrote to memory of 320	1088	cs2.exe	61
PID 1088 wrote to memory of 320	1088	cs2.exe	61
PID 1088 wrote to memory of 320	1088	cs2.exe	61
PID 1088 wrote to memory of 2488	1088	cs2.exe	60
PID 1088 wrote to memory of 2488	1088	cs2.exe	60
PID 1088 wrote to memory of 2488	1088	cs2.exe	60
PID 1088 wrote to memory of 1724	1088	cs2.exe	59
PID 1088 wrote to memory of 1724	1088	cs2.exe	59
PID 1088 wrote to memory of 1724	1088	cs2.exe	59
PID 1088 wrote to memory of 888	1088	cs2.exe	58
PID 1088 wrote to memory of 888	1088	cs2.exe	58
PID 1088 wrote to memory of 888	1088	cs2.exe	58
PID 1088 wrote to memory of 872	1088	cs2.exe	57
PID 1088 wrote to memory of 872	1088	cs2.exe	57
PID 1088 wrote to memory of 872	1088	cs2.exe	57
PID 1088 wrote to memory of 2192	1088	cs2.exe	63
PID 1088 wrote to memory of 2192	1088	cs2.exe	63
PID 1088 wrote to memory of 2192	1088	cs2.exe	63
PID 2192 wrote to memory of 2792	2192	cmd.exe	65
PID 2192 wrote to memory of 2792	2192	cmd.exe	65
PID 2192 wrote to memory of 2792	2192	cmd.exe	65
PID 2192 wrote to memory of 2804	2192	cmd.exe	66
PID 2192 wrote to memory of 2804	2192	cmd.exe	66
PID 2192 wrote to memory of 2804	2192	cmd.exe	66
PID 2192 wrote to memory of 2596	2192	cmd.exe	67
PID 2192 wrote to memory of 2596	2192	cmd.exe	67
PID 2192 wrote to memory of 2596	2192	cmd.exe	67

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\03AA7A6EE5B0FB49D3CFEBB6FC21D393.exe
"C:\Users\Admin\AppData\Local\Temp\03AA7A6EE5B0FB49D3CFEBB6FC21D393.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Local\Temp\Everything2.exe
  "C:\Users\Admin\AppData\Local\Temp\Everything2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\cs2\TytzVEVfFcNs0HDfAJ4LWeBnBaMf.vbe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Roaming\cs2\mUIe5kBMcLtyyRfVNE6smXkJvw6d4pdtgx5QPUAHzK9h0eXdEXMeamhYXU.bat" "
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1640
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:1900
    - - C:\Users\Admin\AppData\Roaming\cs2\cs2.exe
        
        "C:\Users\Admin\AppData\Roaming\cs2/cs2.exe"
        5⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1088
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ul0rcfnt\ul0rcfnt.cmdline"
        6⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2976
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES79C2.tmp" "c:\Windows\System32\CSCBEA2AA715DB0488B858DE6DA77C761D9.TMP"
        7⤵
        
        PID:2376
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe'
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:872
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\7fa09f22-9ba8-11ee-8a6f-e96ea47544f1\dwm.exe'
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:888
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsm.exe'
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1724
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\DESIGNER\cs2.exe'
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2488
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ja-JP\csrss.exe'
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:320
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ynctZNZmZU.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2792
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:2804
        
        C:\Program Files (x86)\Common Files\DESIGNER\cs2.exe
        
        "C:\Program Files (x86)\Common Files\DESIGNER\cs2.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\ja-JP\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\ja-JP\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cs2c" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\DESIGNER\cs2.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cs2" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\DESIGNER\cs2.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cs2c" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Common Files\DESIGNER\cs2.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\7fa09f22-9ba8-11ee-8a6f-e96ea47544f1\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\7fa09f22-9ba8-11ee-8a6f-e96ea47544f1\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\7fa09f22-9ba8-11ee-8a6f-e96ea47544f1\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsm.exe

Path C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsm.exe
Size 3.6MB
SHA256 219ab09067082702c4523f10ecc545652a7bc44872cc28174dc3096a81f94ee9
MD5 4031efeca3f6ddd65bec1e3c29cf89c8
SHA1 76f53e05465833e9e0a664411809cc4ca1f140a9
SHA512 0eed6f6517ee68303cd1bcbcb78cba09fb929248b8bd0e8e596da3e4838500971bc535ff84fa6da78c52773fa8a4f91b90d3c10775e5dc8ea5c4c0fc6de09e90
SSDEEP 98304:Ls9HA1AKGRDnhLsAp2Tdywk+8EI2IVayd0DEsyTabO:LH1AhJs82fkw7lEJTcO
MD5 SHA1 SHA512 SSDEEP

Submit Download

cs2.exe

Path C:\Program Files (x86)\Common Files\DESIGNER\cs2.exe
Size 704KB
SHA256 d632802176738ebabd55b1dd9327045352499da0f2ca1dc85f38943ac5a1c635
MD5 57757908ecc076ab39e2a878fdc6418d
SHA1 5b6a4d923914779b9268e9440926eb2833fb6668
SHA512 07222510a57a602fcbb129ae83356b9486fb9a7a69048d735c35dbf70a3d5f0aa46f50afed17dd519a42bc6a60bc911beae20d1e49b7f71119186ad8a5735013
SSDEEP 12288:f50s/kq1zjoGsVCUrASL9txAxefK1ER9w29B:LqIaA0oi9z9B
MD5 SHA1 SHA512 SSDEEP

Submit Download

cs2.exe

Path C:\Program Files (x86)\Common Files\DESIGNER\cs2.exe
Size 305KB
SHA256 23176aa004b015e00cd0bfe977f5e672bd702adab3354788563e3c75046bab7c
MD5 10dd216f80d5809e3bf3fc841a934092
SHA1 1ae89301f125a9028713798790f9052177217de2
SHA512 9e6f7a982f087fb8283dbba0be538d33aaf2ae210de5abee7f8c5cd8d7072fe5bbe16c07e38dc13bc25f50b6130175ea5966cf0892d58ec002f173ec53bdf588
SSDEEP 3072:f5mGTKs/hDSvqNCuOiTFw0/dHoTiamcHd75kof8jedsByQ8ioNthsZ6Tougllwic:f50s/kq1OiFT/doUC75PrTz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cab4BB2.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab4BB2.tmp
Size 65KB
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Everything2.exe

Path C:\Users\Admin\AppData\Local\Temp\Everything2.exe
Size 1.9MB
SHA256 22059add02fb2f7495a032dcb47a14103abe1c2e77db533af08ac914e82c341d
MD5 767f3d126a538132e026fafc2d4fe9a6
SHA1 303429d66be729b48efd95d1536728a1844c4aa6
SHA512 41960109387d77864248bf89e10627c2254aad0745f4962a52aa35bcb7dfd8568ce4d69782f41c304c1b2f45b6281fc831436860da69473440d25a480757962d
SSDEEP 49152:IBJgreRSQdPM/vUhVEypAgFKd4LAGEFjtP3g:ya8SQd3hVEcNC4LAFFjtPg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Everything2.exe

Path C:\Users\Admin\AppData\Local\Temp\Everything2.exe
Size 759KB
SHA256 172cb03cf53b27a29bb5bfaae15e0138a78264a945db1b85e411d2919d4f7a1c
MD5 2a3d1d62d04901e4581545c41ee825ad
SHA1 456d7946d4139a12761da5cbccf24b7b2547773f
SHA512 533b7fe24442760ab20f74e9b8eeb01a9e5f250c8ce2e891fb5c017f28d87bcfeb0fe71000b32c299053e007047b290f5a7dce18dce5cdc462f68276d6b8c8d5
SSDEEP 12288:2ToPWBv/cpGrU3yVtX+t4VgmN/m6gyDuUhOSBEEhNcXu1UlURt99PVMzlLvRSLz:2TbBv5rUyXVgreRLP212RtHPVoRG
MD5 SHA1 SHA512 SSDEEP

Submit Download

RES79C2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES79C2.tmp
Size 1KB
SHA256 3ead79c9279df9277f13431ee345d62c3501897959149213ea3b31fd04d3f5e7
MD5 3b36af9b85e4a6b0e7f3ec312e7899f7
SHA1 ac9e6de41c87705f129a10df736a3c829d2fc49a
SHA512 e7eec6502e8c347b36806e72cf3b6008aee5210c8fdbad35f90e352a63fa220db96d9760d3f42ff0b619e96da7a4334e0a42cedf13c6de9fc77ff2f90a220abc
MD5 SHA1 SHA512

Submit Download

Tar4BF3.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar4BF3.tmp
Size 171KB
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
MD5 SHA1 SHA512 SSDEEP

Submit Download

ynctZNZmZU.bat

Path C:\Users\Admin\AppData\Local\Temp\ynctZNZmZU.bat
Size 180B
SHA256 4f512f3d34798cdc83d606a479acae6a57df848a930e73fec79f9c25d0ed17ac
MD5 57b03895f7855ae38e6925b6de31732b
SHA1 c82bf1e39075ac71c1a180ef91e20a735ba53a0f
SHA512 7c3609d28b8ee8aeeefa6b1956d247d983a0d3123aae9a3932eb45634ddf2e5be43918ef11debc7fcaf366b8e7ace7e582b47995c23e8a97e4c9e3671ab1692d
MD5 SHA1 SHA512

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 ac22c645d446a17435630efdd15a302b30c48550cf30c80f77a129a8a36db6e9
MD5 b79ae87f02224a7613997d854ef7af17
SHA1 76e870cb8165ef6bb5b6c0711aa0d4bd9aac85d8
SHA512 92b9458483899648aead7ef0d87e7233540b2265822ef167a85210add5cac8bb82198b4d32d214babd5859ec3668a77036c3bac13fd47511e1af745d808756ea
SSDEEP 96:YnliCkn5OM8anqvsqvJCwoSexnliCkn5OM8anqvsEHyqvJCworIeqJ2GQHL8E87p:Ylm5O2UoRlm5O2AHnorghd772AP
MD5 SHA1 SHA512 SSDEEP

Submit Download

TytzVEVfFcNs0HDfAJ4LWeBnBaMf.vbe

Path C:\Users\Admin\AppData\Roaming\cs2\TytzVEVfFcNs0HDfAJ4LWeBnBaMf.vbe
Size 246B
SHA256 c0c91fb31d5cccd628afa1623f701b2058a7dd9c2225cc22c770ce93714778fe
MD5 dc68d3733288fd94929ec51922ab3234
SHA1 9b7da3f29502de9393cead313813c69525baed4f
SHA512 eb221bf530386b89ee19a60102d98750c11de514f8befda5d3575588c5c7467b82cae13421d24c6b2d945247ac640991563215251b80cafb2ab5cc688a65c5c8
MD5 SHA1 SHA512

Submit Download

cs2.exe

Path C:\Users\Admin\AppData\Roaming\cs2\cs2.exe
Size 1.2MB
SHA256 8c342d9ab28ede0286d6145c8a689e2bed0cd2bbd4f6928bf2a4489cb245ea3d
MD5 02e5585cf41c69abdab7b726a37b0e66
SHA1 9e8874fe18f2fd4d2e19f47b7fe5504eb4d2724c
SHA512 65c8ba14dadcaf4ccd9982e4b8e08765c766e64a4399b8e8734e3689d1b5e1850fc525b8be11b3175433c439422b47fc7eed5b57fdd5ba5360ed9861fe0f4527
SSDEEP 24576:LqIaA0oi9z9GK6fmbd9Mz3FAKGNfzNzRb4amiR:Ldu9Hl3Mz1AKGNrN5miR
MD5 SHA1 SHA512 SSDEEP

Submit Download

cs2.exe

Path C:\Users\Admin\AppData\Roaming\cs2\cs2.exe
Size 985KB
SHA256 c55276e70c789d540d9a6c228bd53cffb5dca7df56b9336ae874ca86f6f878e0
MD5 43bf2e93c631ac85ecb5c1c958ac01e7
SHA1 630b8dc945b55565c2a8c5d32fe53daeafd8617c
SHA512 af38cb6d2345c13cba2485ff7d123db20e8a91e76dca8eff902f9b2d8e0ffd64f141eaaec7b29905f8957acb43acc717f49fc86580e3af768086527ccebc900c
SSDEEP 12288:f50s/kq1zjoGsVCUrASL9txAxefK1ER9w29ONDyDPgBfejbd9M8ZJm3FAGZ:LqIaA0oi9z9GK6fmbd9Mz3FA4
MD5 SHA1 SHA512 SSDEEP

Submit Download

mUIe5kBMcLtyyRfVNE6smXkJvw6d4pdtgx5QPUAHzK9h0eXdEXMeamhYXU.bat

Path C:\Users\Admin\AppData\Roaming\cs2\mUIe5kBMcLtyyRfVNE6smXkJvw6d4pdtgx5QPUAHzK9h0eXdEXMeamhYXU.bat
Size 180B
SHA256 0b168c8959a886cb7d229a5e6b5e120feb1955b2afc676dd583d38f05664b8a2
MD5 18e352de3392a28ddefd1c6b371c2ad9
SHA1 63024f7900a999db403e8680ca17635b20109a62
SHA512 48302d33e20c78ea41d7aaa68e5db1e6aa4a395c341f7fce727291bb62bcdb1dc82bf63d41791661f5c63ebb4e127b8dc7cc1a7f527e675d14a4c64247f846c6
MD5 SHA1 SHA512

Submit Download

ul0rcfnt.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ul0rcfnt\ul0rcfnt.0.cs
Size 358B
SHA256 a07aaabecc0b955a9fbac09a7c24047a8f0c0c86c1ee03dac397c7bf7a92aa68
MD5 948d3bc2dc388b34275bda05d6dd6156
SHA1 06112dc7ca99d77471d5c61fbb27668a36c6f858
SHA512 241d247b8db9add59d3c1fb2795f99de7ab652187f482a9d6a118dbd0f0909fab78c81a869f478f87e58da86970589f918b6931ffa0321ee2be151b651a0b5aa
MD5 SHA1 SHA512

Submit Download

ul0rcfnt.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ul0rcfnt\ul0rcfnt.cmdline
Size 235B
SHA256 a57ccba1788c3d3f65e9b55434c60dce13c32914bb6ae5c79709fe2106f3908a
MD5 60a10f0f7e1cd264993a13c8d9a62a57
SHA1 37e5a5687b8dd05e03d80fc20c123772589709bd
SHA512 45d6f8135ba47231fe7e44cf5a762de933dd4743169608478f51b71d0d20394d9a293834af3e1948f23fa7be0de212a0d67452b64f83dbe13b28d9d8797b1951
MD5 SHA1 SHA512

Submit Download

CSCBEA2AA715DB0488B858DE6DA77C761D9.TMP

Path \??\c:\Windows\System32\CSCBEA2AA715DB0488B858DE6DA77C761D9.TMP
Size 1KB
SHA256 eee9beb7acf4ae34d0b4bc1c136a9abd1c625d5a2c1eccdb14ceedab91adca3a
MD5 be2c0c12ae0811c909259a9ef7faaac6
SHA1 002bac0233c2db332d9e2b17fdc32dc8e6139350
SHA512 db719e3a4f86d6384d31cecc0c1ce4525690d2cdbd315a699dbba6481a55c3b60cdb4f07029f956c4f1f116c1a2b72191036c7c5da8a07d9a12606e69b1eec88
MD5 SHA1 SHA512

Submit Download

cs2.exe

Path \Users\Admin\AppData\Roaming\cs2\cs2.exe
Size 700KB
SHA256 7996f025a891cd8ad799c4b2d718fc2305b0cd2200c7f6bda17a109054c2e7bc
MD5 bc4ed4c8ee2dd697448e3b5a0563b607
SHA1 0d84f5cf229f912924232046962f45347332491a
SHA512 539c1741f472dbfead79fd8fb6cb4564849c5fc82661e8f34a388da6d333aa0f286023dca7af65dd2416c7378b13b68c3ecc50663c478d3a5e963fd26bd3a7a1
SSDEEP 12288:f50s/kq1zjoGsVCUrASL9txAxefK1ER9w298:LqIaA0oi9z98
MD5 SHA1 SHA512 SSDEEP

Submit Download

cs2.exe

Path \Users\Admin\AppData\Roaming\cs2\cs2.exe
Size 1.4MB
SHA256 9d5bec244cc25e50d5448234693b3150edd5c79004ad41adffe4cbac46299add
MD5 5dbd34f4cbcca193a9a3356269d8ccc8
SHA1 7948bf6455796580749a33af22afe7738f1df794
SHA512 c396e9ec9c8007da1b7e9393cda3ee8be725c3681038f195508636394b256e0634293718afe66d133610b0a078bc8eea2b868e287d8a74871ebe3629d80d0d06
SSDEEP 24576:LqIaA0oi9z9GK6fmbd9Mz3FAKGNfzNzRb4amihaL:Ldu9Hl3Mz1AKGNrN5mihC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/320-188-0x000007FEEC6C0000-0x000007FEED05D000-memory.dmp

Download

memory/320-184-0x0000000002230000-0x0000000002238000-memory.dmp

Download

memory/888-185-0x0000000002524000-0x0000000002527000-memory.dmp

Download

memory/888-186-0x000000000252B000-0x0000000002592000-memory.dmp

Download

memory/888-189-0x000007FEEC6C0000-0x000007FEED05D000-memory.dmp

Download

memory/1088-93-0x000000001B490000-0x000000001B510000-memory.dmp

Download

memory/1088-115-0x0000000000560000-0x0000000000570000-memory.dmp

Download

memory/1088-71-0x00000000002F0000-0x000000000030C000-memory.dmp

Download

memory/1088-78-0x0000000000490000-0x00000000004A8000-memory.dmp

Download

memory/1088-77-0x0000000076BA0000-0x0000000076BA1000-memory.dmp

Download

memory/1088-81-0x0000000076B90000-0x0000000076B91000-memory.dmp

Download

memory/1088-80-0x00000000002C0000-0x00000000002D0000-memory.dmp

Download

memory/1088-83-0x00000000002D0000-0x00000000002E0000-memory.dmp

Download

memory/1088-84-0x000007FEF46A0000-0x000007FEF508C000-memory.dmp

Download

memory/1088-88-0x00000000004B0000-0x00000000004BE000-memory.dmp

Download

memory/1088-86-0x0000000076B70000-0x0000000076B71000-memory.dmp

Download

memory/1088-90-0x0000000076B60000-0x0000000076B61000-memory.dmp

Download

memory/1088-89-0x000000001B490000-0x000000001B510000-memory.dmp

Download

memory/1088-85-0x0000000076B80000-0x0000000076B81000-memory.dmp

Download

memory/1088-92-0x00000000004E0000-0x00000000004F2000-memory.dmp

Download

memory/1088-94-0x0000000076B50000-0x0000000076B51000-memory.dmp

Download

memory/1088-75-0x0000000000280000-0x0000000000290000-memory.dmp

Download

memory/1088-96-0x00000000004C0000-0x00000000004CC000-memory.dmp

Download

memory/1088-99-0x000000001B490000-0x000000001B510000-memory.dmp

Download

memory/1088-98-0x00000000004D0000-0x00000000004E0000-memory.dmp

Download

memory/1088-100-0x0000000076B40000-0x0000000076B41000-memory.dmp

Download

memory/1088-103-0x0000000000520000-0x0000000000536000-memory.dmp

Download

memory/1088-101-0x0000000076B30000-0x0000000076B31000-memory.dmp

Download

memory/1088-104-0x0000000076B20000-0x0000000076B21000-memory.dmp

Download

memory/1088-106-0x0000000000540000-0x0000000000552000-memory.dmp

Download

memory/1088-109-0x0000000000500000-0x000000000050E000-memory.dmp

Download

memory/1088-107-0x0000000076B10000-0x0000000076B11000-memory.dmp

Download

memory/1088-110-0x0000000076B00000-0x0000000076B01000-memory.dmp

Download

memory/1088-112-0x0000000000510000-0x0000000000520000-memory.dmp

Download

memory/1088-73-0x0000000076BB0000-0x0000000076BB1000-memory.dmp

Download

memory/1088-113-0x0000000076AF0000-0x0000000076AF1000-memory.dmp

Download

memory/1088-116-0x0000000076AE0000-0x0000000076AE1000-memory.dmp

Download

memory/1088-118-0x00000000005E0000-0x000000000063A000-memory.dmp

Download

memory/1088-120-0x0000000000580000-0x000000000058E000-memory.dmp

Download

memory/1088-122-0x0000000000590000-0x00000000005A0000-memory.dmp

Download

memory/1088-124-0x00000000005A0000-0x00000000005AE000-memory.dmp

Download

memory/1088-126-0x0000000000D80000-0x0000000000D98000-memory.dmp

Download

memory/1088-128-0x00000000005B0000-0x00000000005BC000-memory.dmp

Download

memory/1088-130-0x0000000001070000-0x00000000010BE000-memory.dmp

Download

memory/1088-72-0x0000000076BC0000-0x0000000076BC1000-memory.dmp

Download

memory/1088-69-0x0000000076BD0000-0x0000000076BD1000-memory.dmp

Download

memory/1088-68-0x0000000000270000-0x000000000027E000-memory.dmp

Download

memory/1088-64-0x000000001B490000-0x000000001B510000-memory.dmp

Download

memory/1088-66-0x0000000000290000-0x00000000002B6000-memory.dmp

Download

memory/1088-63-0x0000000076BE0000-0x0000000076BE1000-memory.dmp

Download

memory/1088-62-0x000000001B490000-0x000000001B510000-memory.dmp

Download

memory/1088-58-0x00000000010E0000-0x0000000001478000-memory.dmp

Download

memory/1088-59-0x000007FEF46A0000-0x000007FEF508C000-memory.dmp

Download

memory/1088-60-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/1088-61-0x000000001B490000-0x000000001B510000-memory.dmp

Download

memory/1088-183-0x000007FEF46A0000-0x000007FEF508C000-memory.dmp

Download

memory/1724-187-0x000007FEEC6C0000-0x000007FEED05D000-memory.dmp

Download

memory/1724-190-0x0000000002694000-0x0000000002697000-memory.dmp

Download

memory/2132-43-0x000007FEF5090000-0x000007FEF5A7C000-memory.dmp

Download

memory/2132-3-0x0000000000240000-0x0000000000241000-memory.dmp

Download

memory/2132-2-0x000000001B1F0000-0x000000001B270000-memory.dmp

Download

memory/2132-1-0x000007FEF5090000-0x000007FEF5A7C000-memory.dmp

Download

memory/2132-0-0x00000000010F0000-0x0000000001154000-memory.dmp

Download

memory/2488-182-0x000000001B2C0000-0x000000001B5A2000-memory.dmp

Download