zgrat | e0aa620a8b2b7688482b39a6fafabe217fa4d774ce7441721e42b6bfdc88c450

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/02/2024, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
03AA7A6EE5B0FB49D3CFEBB6FC21D393.exe
Size 377KB
Sample240206-2fc2xabfdq
SHA256 e0aa620a8b2b7688482b39a6fafabe217fa4d774ce7441721e42b6bfdc88c450
MD5 03aa7a6ee5b0fb49d3cfebb6fc21d393
SHA1 c3b96bd8b624dbf4f2cf7a15bb4c54b78d8f57be
SHA512 3a6ee0fd4d4671ad947f55f97289521794ba0cef69c73ef575fe5344860d3acab410f1f62f888901531b34ce181e3c9ab070fb2b233fe9cd6ab745724c255e28
SSDEEP 6144:FmQfXZRlEkTnh3PFKY3b1+H2DCiRMZkS11zGdo9s5h3/7m+A0jH8z31mgjilbyi:FhvHTbb1+WDzRsvzGde0P7m+JjcObyi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat evasion persistence rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 6 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023209-25.dat	family_zgrat_v1
behavioral2/memory/2712-26-0x00000000001A0000-0x0000000000538000-memory.dmp	family_zgrat_v1
behavioral2/files/0x0008000000023209-24.dat	family_zgrat_v1
behavioral2/files/0x000700000002321a-113.dat	family_zgrat_v1
behavioral2/files/0x000600000002322e-219.dat	family_zgrat_v1
behavioral2/files/0x000600000002322e-218.dat	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\TextInputHost.exe\""	cs2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\TextInputHost.exe\", \"C:\\Program Files\\7-Zip\\Lang\\SppExtComObj.exe\""	cs2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\TextInputHost.exe\", \"C:\\Program Files\\7-Zip\\Lang\\SppExtComObj.exe\", \"C:\\Program Files\\Internet Explorer\\en-US\\unsecapp.exe\""	cs2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\TextInputHost.exe\", \"C:\\Program Files\\7-Zip\\Lang\\SppExtComObj.exe\", \"C:\\Program Files\\Internet Explorer\\en-US\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\dllhost.exe\""	cs2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\TextInputHost.exe\", \"C:\\Program Files\\7-Zip\\Lang\\SppExtComObj.exe\", \"C:\\Program Files\\Internet Explorer\\en-US\\unsecapp.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\dllhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\WmiPrvSE.exe\""	cs2.exe

Process spawned unexpected child process 13 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	4292	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	772	4292	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	4292	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4008	4292	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4152	4292	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	4292	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	4292	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	4292	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3340	4292	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5108	4292	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	4292	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4864	4292	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	4292	schtasks.exe	93

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	cs2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	03AA7A6EE5B0FB49D3CFEBB6FC21D393.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	Everything2.exe

Executes dropped EXE 3 IoCs

pid	Process
2844	Everything2.exe
2712	cs2.exe
3600	WmiPrvSE.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\WmiPrvSE.exe\""	cs2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files\\7-Zip\\Lang\\SppExtComObj.exe\""	cs2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files\\7-Zip\\Lang\\SppExtComObj.exe\""	cs2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files\\Internet Explorer\\en-US\\unsecapp.exe\""	cs2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\WmiPrvSE.exe\""	cs2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\dllhost.exe\""	cs2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\odt\\TextInputHost.exe\""	cs2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\odt\\TextInputHost.exe\""	cs2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files\\Internet Explorer\\en-US\\unsecapp.exe\""	cs2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\dllhost.exe\""	cs2.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC78AB8597DE01486597E41B2E1E39335E.TMP	csc.exe
File created	\??\c:\Windows\System32\pxpabj.exe	csc.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\SppExtComObj.exe	cs2.exe
File created	C:\Program Files\7-Zip\Lang\e1ef82546f0b02	cs2.exe
File created	C:\Program Files\Internet Explorer\en-US\unsecapp.exe	cs2.exe
File created	C:\Program Files\Internet Explorer\en-US\29c1c3cc0f7685	cs2.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\dllhost.exe	cs2.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\5940a34987c991	cs2.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\WmiPrvSE.exe	cs2.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\24dbde2999530e	cs2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Boot\DVD\conhost.exe	cs2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2580	schtasks.exe
5108	schtasks.exe
4620	schtasks.exe
4864	schtasks.exe
1772	schtasks.exe
2976	schtasks.exe
772	schtasks.exe
4572	schtasks.exe
1560	schtasks.exe
2544	schtasks.exe
4152	schtasks.exe
3340	schtasks.exe
2452	schtasks.exe
4008	schtasks.exe
1740	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings	Everything2.exe
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings	cs2.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1908	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1356	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe
2712	cs2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3600	WmiPrvSE.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	03AA7A6EE5B0FB49D3CFEBB6FC21D393.exe
Token: SeDebugPrivilege	2712	cs2.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeDebugPrivilege	1952	powershell.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	4988	powershell.exe
Token: SeDebugPrivilege	4940	powershell.exe
Token: SeDebugPrivilege	3600	WmiPrvSE.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3600	WmiPrvSE.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2844	3004	03AA7A6EE5B0FB49D3CFEBB6FC21D393.exe	85
PID 3004 wrote to memory of 2844	3004	03AA7A6EE5B0FB49D3CFEBB6FC21D393.exe	85
PID 3004 wrote to memory of 2844	3004	03AA7A6EE5B0FB49D3CFEBB6FC21D393.exe	85
PID 2844 wrote to memory of 3608	2844	Everything2.exe	86
PID 2844 wrote to memory of 3608	2844	Everything2.exe	86
PID 2844 wrote to memory of 3608	2844	Everything2.exe	86
PID 3608 wrote to memory of 4516	3608	WScript.exe	88
PID 3608 wrote to memory of 4516	3608	WScript.exe	88
PID 3608 wrote to memory of 4516	3608	WScript.exe	88
PID 4516 wrote to memory of 1908	4516	cmd.exe	89
PID 4516 wrote to memory of 1908	4516	cmd.exe	89
PID 4516 wrote to memory of 1908	4516	cmd.exe	89
PID 4516 wrote to memory of 2712	4516	cmd.exe	90
PID 4516 wrote to memory of 2712	4516	cmd.exe	90
PID 2712 wrote to memory of 4472	2712	cs2.exe	94
PID 2712 wrote to memory of 4472	2712	cs2.exe	94
PID 4472 wrote to memory of 2060	4472	csc.exe	97
PID 4472 wrote to memory of 2060	4472	csc.exe	97
PID 2712 wrote to memory of 4940	2712	cs2.exe	111
PID 2712 wrote to memory of 4940	2712	cs2.exe	111
PID 2712 wrote to memory of 2196	2712	cs2.exe	110
PID 2712 wrote to memory of 2196	2712	cs2.exe	110
PID 2712 wrote to memory of 2832	2712	cs2.exe	109
PID 2712 wrote to memory of 2832	2712	cs2.exe	109
PID 2712 wrote to memory of 1952	2712	cs2.exe	108
PID 2712 wrote to memory of 1952	2712	cs2.exe	108
PID 2712 wrote to memory of 4988	2712	cs2.exe	107
PID 2712 wrote to memory of 4988	2712	cs2.exe	107
PID 2712 wrote to memory of 4436	2712	cs2.exe	105
PID 2712 wrote to memory of 4436	2712	cs2.exe	105
PID 4436 wrote to memory of 2524	4436	cmd.exe	116
PID 4436 wrote to memory of 2524	4436	cmd.exe	116
PID 4436 wrote to memory of 1356	4436	cmd.exe	123
PID 4436 wrote to memory of 1356	4436	cmd.exe	123
PID 4436 wrote to memory of 3600	4436	cmd.exe	130
PID 4436 wrote to memory of 3600	4436	cmd.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\03AA7A6EE5B0FB49D3CFEBB6FC21D393.exe
"C:\Users\Admin\AppData\Local\Temp\03AA7A6EE5B0FB49D3CFEBB6FC21D393.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Local\Temp\Everything2.exe
  "C:\Users\Admin\AppData\Local\Temp\Everything2.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\cs2\TytzVEVfFcNs0HDfAJ4LWeBnBaMf.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\cs2\mUIe5kBMcLtyyRfVNE6smXkJvw6d4pdtgx5QPUAHzK9h0eXdEXMeamhYXU.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4516
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:1908
    - - C:\Users\Admin\AppData\Roaming\cs2\cs2.exe
        
        "C:\Users\Admin\AppData\Roaming\cs2/cs2.exe"
        5⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2712
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\op4x4hf5\op4x4hf5.cmdline"
        6⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4472
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5D72.tmp" "c:\Windows\System32\CSC78AB8597DE01486597E41B2E1E39335E.TMP"
        7⤵
        
        PID:2060
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ILTe0wXL8v.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4436
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2524
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:1356
        
        C:\Program Files\Windows Security\BrowserCore\en-US\WmiPrvSE.exe
        
        "C:\Program Files\Windows Security\BrowserCore\en-US\WmiPrvSE.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3600
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\BrowserCore\en-US\WmiPrvSE.exe'
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4988
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\dllhost.exe'
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1952
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\en-US\unsecapp.exe'
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2832
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\SppExtComObj.exe'
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2196
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\TextInputHost.exe'
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\odt\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Creates scheduled task(s)
PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\odt\TextInputHost.exe'" /f
1⤵
- Creates scheduled task(s)
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\odt\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files\7-Zip\Lang\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\en-US\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\en-US\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Program Files\Internet Explorer\en-US\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SppExtComObj.exe

Path C:\Program Files\7-Zip\Lang\SppExtComObj.exe
Size 180KB
SHA256 1583c59538674d90bcd43f57d58834942b32e79c18a5d372ac56914d27cdaa2b
MD5 60aa19a16df699aa6b638fd3545b54b1
SHA1 824e958aa104a840216023b55a17768d907382b9
SHA512 40f06c2890de8a1925fb8903320e940bfaff139817b5a22026c0ed72d43b9840182e2becaf85e0955192755c471615090455418f21033e5db3d3fde141000f6a
SSDEEP 1536:f9fDKjIZTJgs55DdDwjXfcRnNCt0OittCo1iai3SJIwzTVWPsRKgu:f5mGTKs/hDSvqNCuOiTFw0/u
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiPrvSE.exe

Path C:\Program Files\Windows Security\BrowserCore\en-US\WmiPrvSE.exe
Size 1.5MB
SHA256 70039d1b021c1bb1a1a17407cf423996a429b284c158088f26148b029b2de24e
MD5 7253b9bc133e4d83600919604cbaf33d
SHA1 3f582f55d3b5ea35fd446482266bc2968e670c2b
SHA512 d054ba15441d510a3b8f0761802b5fd44bbe0ca1ce6ea6385337d0d992adffed94fd7f17b96c875a7ac45712f8064d4cc2c03689eb1ef18d920a500224e32037
SSDEEP 24576:LqIaA0oi9z9GK6fmbd9Mz3FAKGNfzNzRb4amiha0cTQx2ozoZs:Ldu9Hl3Mz1AKGNrN5mihLbgAas
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiPrvSE.exe

Path C:\Program Files\Windows Security\BrowserCore\en-US\WmiPrvSE.exe
Size 1.4MB
SHA256 3947e550b4397e50d260a43376326c014f78431e494dbd9600ff939ce6ba2798
MD5 e1b9edcc4f2473eb7137543134b7d074
SHA1 36d2f7ccbe7f932edcfab1e97079bc81e507d4c4
SHA512 68d4aa2f60666feb09adaaf1c208347765e7af97b3bc77de1951a73158d90938ea3ea5dd05ecf725d9a04505efd0d691cf0331326fe30b916036513a10d8a953
SSDEEP 24576:LqIaA0oi9z9GK6fmbd9Mz3FAKGNfzNzRb4amiha0cTb:Ldu9Hl3Mz1AKGNrN5mihL8
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
MD5 6d42b6da621e8df5674e26b799c8e2aa
SHA1 ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA512 53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
MD5 SHA1 SHA512

Submit Download

Everything2.exe

Path C:\Users\Admin\AppData\Local\Temp\Everything2.exe
Size 1.3MB
SHA256 13feb3795b5d3d3b4c0b68bcb9f19f682b60e083c1d86827af4156de4d88f5b2
MD5 0b4af2ffb793443363025540b342557e
SHA1 ae171bca7296787e4b38de9214be1f7cc63aef23
SHA512 f0ed1ad9c193beb4bceeb5d28f2ee6d266ade772ee7ecd75dd8a297faebf498a183f8523a559f7c8ad363e7023b383245cc01f0dac3ee040a85615bf68d5fa28
SSDEEP 24576:2TbBv5rUyXVgreRLP212RtHPVoRwcnk9mUhVzsRNgj9Agl7LKASGw4Lk3:IBJgreRSQdPM/vUhVEypAgFKd4Lu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Everything2.exe

Path C:\Users\Admin\AppData\Local\Temp\Everything2.exe
Size 722KB
SHA256 0876038072e4efd4829c6a1517f899160defba167f913602885e420143877f18
MD5 f519009551c5cf9043e87ef990e97c06
SHA1 f5da41fad3770cfbf0a6786abb3de9b86465a13a
SHA512 5208c2cae32ef1e55f61a40c921f61a945fda7bdb464d694381794d693bbd41205e87968b6e9b24aa30cbac7acf7f321c7e6cea753edf6d1efe913aff9ef5f74
SSDEEP 12288:2ToPWBv/cpGrU3yVtX+t4VgmN/m6gyDuUhOSBEEhNcXu1UlURt99PVMz6:2TbBv5rUyXVgreRLP212RtHPVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Everything2.exe

Path C:\Users\Admin\AppData\Local\Temp\Everything2.exe
Size 1.1MB
SHA256 f48e6f38e69330f421641c617068e2566435102b68f3c2c49aab289caaa714f6
MD5 cf7b34a56b44f259b73b16544e21e5c2
SHA1 ee1d29d04045c6f055d7366c6fe3de8fb313cab7
SHA512 875fa0e5111659f35e983a06ad61a7d3977f7ab9df332ee073f72a47a432f3dd916d9b250e52e884bc0b3aa7bd6d308d903492d212b22e991bc8b1207b1f7a0a
SSDEEP 24576:2TbBv5rUyXVgreRLP212RtHPVoRwcnk9mUhVzsRNgj9Agl7n:IBJgreRSQdPM/vUhVEypAg9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ILTe0wXL8v.bat

Path C:\Users\Admin\AppData\Local\Temp\ILTe0wXL8v.bat
Size 192B
SHA256 dcb9c5e464f8c544e007b56a400234d784f7502214024ea1ccc83f753467a6b1
MD5 55419a2d9d9d41deeab53036fbdee904
SHA1 8cae57796c58d0d76a589bd8c7e0b4542918efc7
SHA512 61543a5705560c662b1f1b955ef772d467d94704005b1e02c30005b2f04d9619c751b544e5b1a48a0a49106fee66cf9f40e39cc2ee80ba81040d3911ce4f26f4
MD5 SHA1 SHA512

Submit Download

RES5D72.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5D72.tmp
Size 1KB
SHA256 172a20eccce19c2d0e085651ba23bbe2597eef1d705d591e7698a65a96ca4bfa
MD5 6ba0e48e7c852c3636b67ab51ca92487
SHA1 619100c6b2cb451cc2470e33742848a18d5187eb
SHA512 0efb1e618d6d1782382b3959fb0daa41d7c12ed76c8407148dfcffec0f3cc87be6fa94473122df3dd9ec96e60bca8e5d2992bab5906fdb345eb077c19d859373
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_iejsey5x.hy5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iejsey5x.hy5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

TytzVEVfFcNs0HDfAJ4LWeBnBaMf.vbe

Path C:\Users\Admin\AppData\Roaming\cs2\TytzVEVfFcNs0HDfAJ4LWeBnBaMf.vbe
Size 246B
SHA256 c0c91fb31d5cccd628afa1623f701b2058a7dd9c2225cc22c770ce93714778fe
MD5 dc68d3733288fd94929ec51922ab3234
SHA1 9b7da3f29502de9393cead313813c69525baed4f
SHA512 eb221bf530386b89ee19a60102d98750c11de514f8befda5d3575588c5c7467b82cae13421d24c6b2d945247ac640991563215251b80cafb2ab5cc688a65c5c8
MD5 SHA1 SHA512

Submit Download

cs2.exe

Path C:\Users\Admin\AppData\Roaming\cs2\cs2.exe
Size 183KB
SHA256 120e0a2298f7236139c62ba414538321cc2cdb33b74120c507027d12dfa94b24
MD5 cde06d1b7bfc6114161e33b1e9d5587d
SHA1 f83f614393479e98b74e8fdcfe821b4e5ae54be8
SHA512 cd53f59883bc3c80fc31ae1f015d2e9627e716e37a26337e3cef2f604c97adb5f6bed027a44dcf7359cbb35308db410739802c4dd59bf153443d1e85a618cb84
SSDEEP 1536:f9fDKjIZTJgs55DdDwjXfcRnNCt0OittCo1iai3SJIwzTVWPsRKgd:f5mGTKs/hDSvqNCuOiTFw0/d
MD5 SHA1 SHA512 SSDEEP

Submit Download

cs2.exe

Path C:\Users\Admin\AppData\Roaming\cs2\cs2.exe
Size 95KB
SHA256 a4bfdf2e76721383c0f7c18060076405a6314acb4abdf40ce055eb69b4db9bc1
MD5 9d6e702e5964146cfa27f19a02a68551
SHA1 4470ac655e8c94a27c56e5bdcf85f9b1fad4b60a
SHA512 10fd3cf26210f2ff18ef36acec3e90f955b20a079843aca30a0d64fa33bd927026e2e106ca35dca4bb6cb806611a0d2c188eca528a763ecf342c3ec08b3eae1d
SSDEEP 768:TzCuuODU89f4gsCfid4cJxf1S1KAukicJgCFU0p5DdDo1jXfcRnNTIZj+:f9fDKjIZTJgs55DdDwjXfcRnNCi
MD5 SHA1 SHA512 SSDEEP

Submit Download

mUIe5kBMcLtyyRfVNE6smXkJvw6d4pdtgx5QPUAHzK9h0eXdEXMeamhYXU.bat

Path C:\Users\Admin\AppData\Roaming\cs2\mUIe5kBMcLtyyRfVNE6smXkJvw6d4pdtgx5QPUAHzK9h0eXdEXMeamhYXU.bat
Size 180B
SHA256 0b168c8959a886cb7d229a5e6b5e120feb1955b2afc676dd583d38f05664b8a2
MD5 18e352de3392a28ddefd1c6b371c2ad9
SHA1 63024f7900a999db403e8680ca17635b20109a62
SHA512 48302d33e20c78ea41d7aaa68e5db1e6aa4a395c341f7fce727291bb62bcdb1dc82bf63d41791661f5c63ebb4e127b8dc7cc1a7f527e675d14a4c64247f846c6
MD5 SHA1 SHA512

Submit Download

op4x4hf5.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\op4x4hf5\op4x4hf5.0.cs
Size 356B
SHA256 7b974f7cb51ec3c7d9e65285d2379b24cd2ffed5067813ab2a9e2b5c5bb71918
MD5 30a29aa9ea789b74e5f043827946cde6
SHA1 8529fbd1507a2e66a3197407483eb7f0d285a9a9
SHA512 1d8bd33b10b6d51cc21916cd7d2921424bae6d0ec777118e25f5085a64e14c0ed98a604b710fa4803531d1ef2f69444dbdb6a2b8b8530047607061a58cd702fa
MD5 SHA1 SHA512

Submit Download

op4x4hf5.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\op4x4hf5\op4x4hf5.cmdline
Size 235B
SHA256 144d710a9da5f743e735beecb7179fc335bb09168faee61e74615aa9c1f5d481
MD5 e25978010bc164343ae5a6ad7f4009a8
SHA1 9ad5045e090f0ac7b2e2624a42a7f08aa624a7fb
SHA512 dd48bdca26e03dc88dcaf5fac21e45c538e878f4df03caacf1b44f09765eccd538ce1ccb7db04c452b2c841d2ffe34863304f2b09cc62ab994b15b635e00e3af
MD5 SHA1 SHA512

Submit Download

CSC78AB8597DE01486597E41B2E1E39335E.TMP

Path \??\c:\Windows\System32\CSC78AB8597DE01486597E41B2E1E39335E.TMP
Size 1KB
SHA256 7b0c8a48155667eb6517bb56ffb39a0bfcd0411b249c2f1662eeac13d5ffe80a
MD5 b1efbcad9468891f8c6da3d9c37fa5af
SHA1 09fd33993de57be2cf59bedbbc8e7196959ea8ba
SHA512 e932c51f5a8cdb39eae7c765f27b1d70ac0ffb7b1bd396986aa0f2c3f7e457ba5c17f1d667a7b291a5a9b67c08b49bb8425cd63de3ff36ccdc69f64d45383cc5
MD5 SHA1 SHA512

Submit Download

memory/2712-48-0x00007FF87B810000-0x00007FF87B811000-memory.dmp

Download

memory/2712-95-0x00007FF87B730000-0x00007FF87B731000-memory.dmp

Download

memory/2712-47-0x00007FF85DD80000-0x00007FF85E841000-memory.dmp

Download

memory/2712-46-0x000000001C4A0000-0x000000001C4B8000-memory.dmp

Download

memory/2712-49-0x00007FF87B800000-0x00007FF87B801000-memory.dmp

Download

memory/2712-56-0x0000000000E50000-0x0000000000E60000-memory.dmp

Download

memory/2712-58-0x0000000002690000-0x000000000269E000-memory.dmp

Download

memory/2712-63-0x00007FF87B7D0000-0x00007FF87B7D1000-memory.dmp

Download

memory/2712-67-0x00007FF87B850000-0x00007FF87B90E000-memory.dmp

Download

memory/2712-68-0x00007FF87B7B0000-0x00007FF87B7B1000-memory.dmp

Download

memory/2712-69-0x00007FF87B850000-0x00007FF87B90E000-memory.dmp

Download

memory/2712-72-0x00007FF87B7A0000-0x00007FF87B7A1000-memory.dmp

Download

memory/2712-75-0x00007FF87B850000-0x00007FF87B90E000-memory.dmp

Download

memory/2712-79-0x000000001C5A0000-0x000000001C5B2000-memory.dmp

Download

memory/2712-77-0x00007FF87B780000-0x00007FF87B781000-memory.dmp

Download

memory/2712-76-0x00007FF87B790000-0x00007FF87B791000-memory.dmp

Download

memory/2712-74-0x000000001C580000-0x000000001C596000-memory.dmp

Download

memory/2712-83-0x00007FF87B770000-0x00007FF87B771000-memory.dmp

Download

memory/2712-84-0x00007FF87B760000-0x00007FF87B761000-memory.dmp

Download

memory/2712-82-0x000000001C4E0000-0x000000001C4EE000-memory.dmp

Download

memory/2712-86-0x000000001C560000-0x000000001C570000-memory.dmp

Download

memory/2712-80-0x000000001CAF0000-0x000000001D018000-memory.dmp

Download

memory/2712-71-0x000000001C4D0000-0x000000001C4E0000-memory.dmp

Download

memory/2712-88-0x000000001C570000-0x000000001C580000-memory.dmp

Download

memory/2712-90-0x00007FF87B740000-0x00007FF87B741000-memory.dmp

Download

memory/2712-92-0x000000001C620000-0x000000001C67A000-memory.dmp

Download

memory/2712-97-0x000000001C5D0000-0x000000001C5E0000-memory.dmp

Download

memory/2712-101-0x00007FF87B710000-0x00007FF87B711000-memory.dmp

Download

memory/2712-105-0x00007FF87B6F0000-0x00007FF87B6F1000-memory.dmp

Download

memory/2712-104-0x00007FF87B700000-0x00007FF87B701000-memory.dmp

Download

memory/2712-103-0x000000001C680000-0x000000001C698000-memory.dmp

Download

memory/2712-100-0x000000001C5E0000-0x000000001C5EE000-memory.dmp

Download

memory/2712-98-0x00007FF87B720000-0x00007FF87B721000-memory.dmp

Download

memory/2712-30-0x000000001B1E0000-0x000000001B1F0000-memory.dmp

Download

memory/2712-42-0x000000001C4F0000-0x000000001C540000-memory.dmp

Download

memory/2712-94-0x000000001C5C0000-0x000000001C5CE000-memory.dmp

Download

memory/2712-44-0x0000000000E30000-0x0000000000E40000-memory.dmp

Download

memory/2712-37-0x0000000000E10000-0x0000000000E1E000-memory.dmp

Download

memory/2712-89-0x00007FF87B750000-0x00007FF87B751000-memory.dmp

Download

memory/2712-35-0x00007FF87B850000-0x00007FF87B90E000-memory.dmp

Download

memory/2712-66-0x000000001C4C0000-0x000000001C4CC000-memory.dmp

Download

memory/2712-31-0x00007FF87B850000-0x00007FF87B90E000-memory.dmp

Download

memory/2712-156-0x000000001D320000-0x000000001D3ED000-memory.dmp

Download

memory/2712-29-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Download

memory/2712-28-0x000000001B1E0000-0x000000001B1F0000-memory.dmp

Download

memory/2712-64-0x00007FF87B7C0000-0x00007FF87B7C1000-memory.dmp

Download

memory/2712-61-0x000000001C540000-0x000000001C552000-memory.dmp

Download

memory/2712-27-0x00007FF85DD80000-0x00007FF85E841000-memory.dmp

Download

memory/2712-26-0x00000000001A0000-0x0000000000538000-memory.dmp

Download

memory/2712-33-0x00007FF87B840000-0x00007FF87B841000-memory.dmp

Download

memory/2712-34-0x000000001B190000-0x000000001B1B6000-memory.dmp

Download

memory/2712-62-0x000000001B1E0000-0x000000001B1F0000-memory.dmp

Download

memory/2712-59-0x000000001B1E0000-0x000000001B1F0000-memory.dmp

Download

memory/2712-54-0x00007FF87B7E0000-0x00007FF87B7E1000-memory.dmp

Download

memory/2712-53-0x00007FF87B7F0000-0x00007FF87B7F1000-memory.dmp

Download

memory/2712-52-0x0000000000E40000-0x0000000000E50000-memory.dmp

Download

memory/2712-50-0x000000001B1E0000-0x000000001B1F0000-memory.dmp

Download

memory/2712-41-0x000000001B1C0000-0x000000001B1DC000-memory.dmp

Download

memory/2712-39-0x00007FF87B820000-0x00007FF87B821000-memory.dmp

Download

memory/2712-38-0x00007FF87B830000-0x00007FF87B831000-memory.dmp

Download

memory/3004-3-0x0000000002C50000-0x0000000002C51000-memory.dmp

Download

memory/3004-12-0x00007FF85DD80000-0x00007FF85E841000-memory.dmp

Download

memory/3004-0-0x0000000000B90000-0x0000000000BF4000-memory.dmp

Download

memory/3004-2-0x000000001B930000-0x000000001B940000-memory.dmp

Download

memory/3004-1-0x00007FF85DD80000-0x00007FF85E841000-memory.dmp

Download

memory/3600-277-0x000000001D390000-0x000000001D4A5000-memory.dmp

Download

memory/3600-276-0x000000001C530000-0x000000001C5FD000-memory.dmp

Download