1a69f2fcfe5b35bf44ea42a1efe89f18f6b0d522cbbea5c51bae93aff7d3188b

max time kernel
599s
max time network
600s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07/04/2024, 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

5.3MB
MD5

5fe4ea367cee11e92ad4644d8ac3cef7
SHA1

44faea4a352b7860a9eafca82bd3c9b054b6db29
SHA256

1a69f2fcfe5b35bf44ea42a1efe89f18f6b0d522cbbea5c51bae93aff7d3188b
SHA512

1c4499eadaf44847a7a001c2622e558bc130c9ad608b4ec977480e002cf50c9eb36a65974b86a2db69e9bc43e7d239122389a6cf1ca2849c59bc137441fb0a4f
SSDEEP

98304:lgU5484Bq1qdguoOzv4I3KOn6Ka1uFof9Hn6sdw5yOc4:iU54mqL9zvH3qO

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 10 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2372	netsh.exe
2764	netsh.exe
1892	netsh.exe
1012	netsh.exe
696	netsh.exe
1908	netsh.exe
2692	netsh.exe
768	netsh.exe
1544	netsh.exe
1864	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
2524	svchost.exe
2184	~tl5C25.tmp
1652	svchost.exe
804	~tl34D6.tmp
592	svchost.exe
2728	~tlE1E6.tmp

Loads dropped DLL 11 IoCs

pid	Process
2180	tmp.exe
2180	tmp.exe
2524	svchost.exe
2524	svchost.exe
2184	~tl5C25.tmp
2184	~tl5C25.tmp
1652	svchost.exe
1652	svchost.exe
2376	taskeng.exe
592	svchost.exe
592	svchost.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	~tlE1E6.tmp
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\getlog[1].htm	~tlE1E6.tmp
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\getlog[1].htm	svchost.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\output1[1].jpg	svchost.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System\svchost.exe	tmp.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	~tl5C25.tmp
File opened for modification	C:\Windows\System\svchost.exe	~tl5C25.tmp
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	tmp.exe
File created	C:\Windows\System\svchost.exe	tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
936	schtasks.exe
2320	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{6C467336-8281-4E60-8204-430CED96822D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c0767ec42089da01	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	~tlE1E6.tmp
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-24-0f-a9-df-c2	~tlE1E6.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	~tlE1E6.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-24-0f-a9-df-c2\WpadDetectedUrl	~tlE1E6.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6B858B10-E090-44C0-8173-6A979A1DA93F}\WpadDecision = "0"	~tlE1E6.tmp
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6B858B10-E090-44C0-8173-6A979A1DA93F}\WpadDecision = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = e0a598c42089da01	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	~tlE1E6.tmp
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6B858B10-E090-44C0-8173-6A979A1DA93F}	~tlE1E6.tmp
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0"	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-24-0f-a9-df-c2\WpadDecision = "0"	~tlE1E6.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6B858B10-E090-44C0-8173-6A979A1DA93F}\WpadNetworkName = "Network 3"	~tlE1E6.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6B858B10-E090-44C0-8173-6A979A1DA93F}\WpadDecisionTime = 0026a2cf2089da01	~tlE1E6.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-24-0f-a9-df-c2\WpadDecisionReason = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	~tlE1E6.tmp
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6B858B10-E090-44C0-8173-6A979A1DA93F}	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-24-0f-a9-df-c2\WpadDecisionTime = 80b9fdba2089da01	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f003f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	~tlE1E6.tmp
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6B858B10-E090-44C0-8173-6A979A1DA93F}\5a-24-0f-a9-df-c2	~tlE1E6.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-24-0f-a9-df-c2\WpadDecisionTime = 0026a2cf2089da01	~tlE1E6.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	~tlE1E6.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	~tlE1E6.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6B858B10-E090-44C0-8173-6A979A1DA93F}\WpadDecisionTime = 80b9fdba2089da01	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-24-0f-a9-df-c2\WpadDecision = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-24-0f-a9-df-c2	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2212	powershell.exe
1520	powershell.exe
2180	tmp.exe
840	powershell.exe
1528	powershell.exe
2184	~tl5C25.tmp
280	powershell.exe
2920	powershell.exe
2184	~tl5C25.tmp
1652	svchost.exe
2700	powershell.exe
1084	powershell.exe
804	~tl34D6.tmp
640	powershell.exe
2668	powershell.exe
592	svchost.exe
2960	powershell.exe
2520	powershell.exe
2728	~tlE1E6.tmp
1492	powershell.exe
2132	powershell.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	840	powershell.exe
Token: SeDebugPrivilege	1528	powershell.exe
Token: SeDebugPrivilege	280	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	1084	powershell.exe
Token: SeDebugPrivilege	640	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	2132	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1520	2180	tmp.exe	32
PID 2180 wrote to memory of 1520	2180	tmp.exe	32
PID 2180 wrote to memory of 1520	2180	tmp.exe	32
PID 2180 wrote to memory of 2212	2180	tmp.exe	34
PID 2180 wrote to memory of 2212	2180	tmp.exe	34
PID 2180 wrote to memory of 2212	2180	tmp.exe	34
PID 2180 wrote to memory of 936	2180	tmp.exe	36
PID 2180 wrote to memory of 936	2180	tmp.exe	36
PID 2180 wrote to memory of 936	2180	tmp.exe	36
PID 2180 wrote to memory of 2524	2180	tmp.exe	38
PID 2180 wrote to memory of 2524	2180	tmp.exe	38
PID 2180 wrote to memory of 2524	2180	tmp.exe	38
PID 2524 wrote to memory of 840	2524	svchost.exe	40
PID 2524 wrote to memory of 840	2524	svchost.exe	40
PID 2524 wrote to memory of 840	2524	svchost.exe	40
PID 2524 wrote to memory of 1528	2524	svchost.exe	42
PID 2524 wrote to memory of 1528	2524	svchost.exe	42
PID 2524 wrote to memory of 1528	2524	svchost.exe	42
PID 2524 wrote to memory of 2184	2524	svchost.exe	44
PID 2524 wrote to memory of 2184	2524	svchost.exe	44
PID 2524 wrote to memory of 2184	2524	svchost.exe	44
PID 2184 wrote to memory of 3032	2184	~tl5C25.tmp	46
PID 2184 wrote to memory of 3032	2184	~tl5C25.tmp	46
PID 2184 wrote to memory of 3032	2184	~tl5C25.tmp	46
PID 2184 wrote to memory of 1544	2184	~tl5C25.tmp	48
PID 2184 wrote to memory of 1544	2184	~tl5C25.tmp	48
PID 2184 wrote to memory of 1544	2184	~tl5C25.tmp	48
PID 2184 wrote to memory of 1864	2184	~tl5C25.tmp	50
PID 2184 wrote to memory of 1864	2184	~tl5C25.tmp	50
PID 2184 wrote to memory of 1864	2184	~tl5C25.tmp	50
PID 2184 wrote to memory of 280	2184	~tl5C25.tmp	52
PID 2184 wrote to memory of 280	2184	~tl5C25.tmp	52
PID 2184 wrote to memory of 280	2184	~tl5C25.tmp	52
PID 2184 wrote to memory of 2920	2184	~tl5C25.tmp	54
PID 2184 wrote to memory of 2920	2184	~tl5C25.tmp	54
PID 2184 wrote to memory of 2920	2184	~tl5C25.tmp	54
PID 2184 wrote to memory of 2400	2184	~tl5C25.tmp	56
PID 2184 wrote to memory of 2400	2184	~tl5C25.tmp	56
PID 2184 wrote to memory of 2400	2184	~tl5C25.tmp	56
PID 2184 wrote to memory of 2320	2184	~tl5C25.tmp	58
PID 2184 wrote to memory of 2320	2184	~tl5C25.tmp	58
PID 2184 wrote to memory of 2320	2184	~tl5C25.tmp	58
PID 2184 wrote to memory of 1652	2184	~tl5C25.tmp	60
PID 2184 wrote to memory of 1652	2184	~tl5C25.tmp	60
PID 2184 wrote to memory of 1652	2184	~tl5C25.tmp	60
PID 1652 wrote to memory of 2788	1652	svchost.exe	62
PID 1652 wrote to memory of 2788	1652	svchost.exe	62
PID 1652 wrote to memory of 2788	1652	svchost.exe	62
PID 1652 wrote to memory of 1012	1652	svchost.exe	64
PID 1652 wrote to memory of 1012	1652	svchost.exe	64
PID 1652 wrote to memory of 1012	1652	svchost.exe	64
PID 1652 wrote to memory of 2764	1652	svchost.exe	66
PID 1652 wrote to memory of 2764	1652	svchost.exe	66
PID 1652 wrote to memory of 2764	1652	svchost.exe	66
PID 1652 wrote to memory of 2700	1652	svchost.exe	68
PID 1652 wrote to memory of 2700	1652	svchost.exe	68
PID 1652 wrote to memory of 2700	1652	svchost.exe	68
PID 1652 wrote to memory of 1084	1652	svchost.exe	70
PID 1652 wrote to memory of 1084	1652	svchost.exe	70
PID 1652 wrote to memory of 1084	1652	svchost.exe	70
PID 1652 wrote to memory of 804	1652	svchost.exe	72
PID 1652 wrote to memory of 804	1652	svchost.exe	72
PID 1652 wrote to memory of 804	1652	svchost.exe	72
PID 804 wrote to memory of 2124	804	~tl34D6.tmp	74

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2212
- C:\Windows\system32\schtasks.exe
  schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
  2⤵
  - Creates scheduled task(s)
  PID:936
- C:\Windows\System\svchost.exe
  "C:\Windows\System\svchost.exe" formal
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\~tl5C25.tmp
    C:\Users\Admin\AppData\Local\Temp\~tl5C25.tmp
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2184
  - - C:\Windows\system32\netsh.exe
      netsh int ipv4 set dynamicport tcp start=1025 num=64511
      4⤵
      PID:3032
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:1544
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:1864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:280
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2920
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /TN "Timer"
      4⤵
      PID:2400
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
      4⤵
      Creates scheduled task(s)
      PID:2320
  - - C:\Windows\System\svchost.exe
      "C:\Windows\System\svchost.exe" formal
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1652
    - - C:\Windows\system32\netsh.exe
        
        netsh int ipv4 set dynamicport tcp start=1025 num=64511
        5⤵
        
        PID:2788
    - - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:1012
    - - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:2764
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2700
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\~tl34D6.tmp
        
        C:\Users\Admin\AppData\Local\Temp\~tl34D6.tmp
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:804
      - C:\Windows\system32\netsh.exe
        
        netsh int ipv4 set dynamicport tcp start=1025 num=64511
        6⤵
        
        PID:2124
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:696
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:1908
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:640
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2668

C:\Windows\system32\taskeng.exe
taskeng.exe {A53CEB15-A0A6-4009-BA6B-1B94A231832D} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Loads dropped DLL
PID:2376
- \??\c:\windows\system\svchost.exe
  c:\windows\system\svchost.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:592
- - C:\Windows\system32\netsh.exe
    netsh int ipv4 set dynamicport tcp start=1025 num=64511
    3⤵
    - Modifies data under HKEY_USERS
    PID:1380
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Modifies data under HKEY_USERS
    PID:1892
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Modifies data under HKEY_USERS
    PID:2372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2520
- - C:\Windows\TEMP\~tlE1E6.tmp
    C:\Windows\TEMP\~tlE1E6.tmp
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2728
  - - C:\Windows\system32\netsh.exe
      netsh int ipv4 set dynamicport tcp start=1025 num=64511
      4⤵
      Modifies data under HKEY_USERS
      PID:2740
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Modifies data under HKEY_USERS
      PID:2692
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Modifies data under HKEY_USERS
      PID:768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      4⤵
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      4⤵
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~tl34D6.tmp

Filesize
393KB

MD5
9dbdd43a2e0b032604943c252eaf634a

SHA1
9584dc66f3c1cce4210fdf827a1b4e2bb22263af

SHA256
33c53cd5265502e7b62432dba0e1b5ed702b5007cc79973ccd1e71b2acc01e86

SHA512
b7b20b06dac952a96eda254bad29966fe7a4f827912beb0bc66d5af5b302d7c0282d70c1b01ff782507dd03a1d58706f05cb157521c7f2887a43085ffe5f94d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\~tl5C25.tmp

Filesize
385KB

MD5
e802c96760e48c5139995ffb2d891f90

SHA1
bba3d278c0eb1094a26e5d2f4c099ad685371578

SHA256
cb82ea45a37f8f79d10726a7c165aa5b392b68d5ac954141129c1762a539722c

SHA512
97300ac501be6b6ea3ac1915361dd472824fe612801cab8561a02c7df071b1534190d2d5ef872d89d24c8c915b88101e7315f948f53215c2538d661181e3a5f0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
5b2552aaf81141e87ac7b01dd713ea54

SHA1
257a4b96d9e3f05266421d08eaa6debafe49103a

SHA256
07b818bee2e27633af1baf484a1fdac649d9a5e8692a6f2204e473e6c525da06

SHA512
38fe03dee150f9e2a08dc489f8c866ff69c40e14f7ab9b1e48ae99f3e62584ddf8ae81303ab636bae2b6f4df2c648f6f86ada8968f583822e2a730b941873fe0

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp

Filesize
2.6MB

MD5
186867b003c626a127b4ddf25ebcd510

SHA1
86a350c0b5a82447649e94f5e4c815ffefb73d9f

SHA256
41930b530d84d1ab33258da71fbd8be5e54bd5ac071c3cc19ee49cf4791cc314

SHA512
6fb66b908ce7cbbd8c1f0586cbfb98a0e47771c0789e6f10e4f1d293dd24243372826f3046020dc61f1cd45da7a24e9d87e22a4ca7ac32099abe10bfd2869ac1

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

Filesize
5.3MB

MD5
40bd8f5df4fff1f1a37ead330d54c937

SHA1
fafad36a945eac0cac0872563f56cdb1a9dadece

SHA256
d3866d06b9d6aa4d8bf75cdc21c555069722c031b0934809caf223474ebf85ef

SHA512
7a0a39537892c2b34d0629422ab04b5c3c1913f92cb95290544da08aa5b87fd7784967ab63a7492af9b5a45a2646b9c7f6645fbf7eb0043b024222264a05d75a

Download Submit
C:\Windows\System\svchost.exe

Filesize
385KB

MD5
e0a5211e22aa205f5c5c5042b0a572e4

SHA1
f645ec5db1ce143b38b72bb27942f78a74640e64

SHA256
984d7da9ef6efe325c7216c9b3d731200865a0bff5f2a8f288ebc9a6e6c5de1f

SHA512
74d071590695fda8108083745015d1f8e1d6ae5f66701d3be8cdc096c0e62ee4ec52c489fda2b8060db87ee09800ba819e2bc44955ee3775cbfafef5529ebe45

Download Submit
C:\Windows\system\svchost.exe

Filesize
5.3MB

MD5
5fe4ea367cee11e92ad4644d8ac3cef7

SHA1
44faea4a352b7860a9eafca82bd3c9b054b6db29

SHA256
1a69f2fcfe5b35bf44ea42a1efe89f18f6b0d522cbbea5c51bae93aff7d3188b

SHA512
1c4499eadaf44847a7a001c2622e558bc130c9ad608b4ec977480e002cf50c9eb36a65974b86a2db69e9bc43e7d239122389a6cf1ca2849c59bc137441fb0a4f

Download Submit
memory/280-134-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/280-135-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download
memory/280-137-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download
memory/280-133-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Filesize
2.9MB

Download
memory/280-136-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/280-149-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/280-148-0x0000000002710000-0x0000000002790000-memory.dmp

Filesize
512KB

Download
memory/592-238-0x0000000140000000-0x000000014015E400-memory.dmp

Filesize
1.4MB

Download
memory/592-255-0x0000000140000000-0x000000014015E400-memory.dmp

Filesize
1.4MB

Download
memory/592-265-0x0000000140000000-0x000000014015E400-memory.dmp

Filesize
1.4MB

Download
memory/640-210-0x000007FEF52C0000-0x000007FEF5C5D000-memory.dmp

Filesize
9.6MB

Download
memory/640-209-0x0000000002D70000-0x0000000002DF0000-memory.dmp

Filesize
512KB

Download
memory/640-208-0x000007FEF52C0000-0x000007FEF5C5D000-memory.dmp

Filesize
9.6MB

Download
memory/804-200-0x0000000140000000-0x0000000140170400-memory.dmp

Filesize
1.4MB

Download
memory/804-226-0x0000000140000000-0x0000000140170400-memory.dmp

Filesize
1.4MB

Download
memory/804-202-0x0000000140000000-0x0000000140170400-memory.dmp

Filesize
1.4MB

Download
memory/804-201-0x0000000140000000-0x0000000140170400-memory.dmp

Filesize
1.4MB

Download
memory/840-64-0x0000000002D80000-0x0000000002E00000-memory.dmp

Filesize
512KB

Download
memory/840-50-0x0000000002970000-0x0000000002978000-memory.dmp

Filesize
32KB

Download
memory/840-57-0x0000000002D80000-0x0000000002E00000-memory.dmp

Filesize
512KB

Download
memory/840-49-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

Filesize
9.6MB

Download
memory/840-55-0x0000000002D80000-0x0000000002E00000-memory.dmp

Filesize
512KB

Download
memory/840-66-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

Filesize
9.6MB

Download
memory/840-56-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

Filesize
9.6MB

Download
memory/840-48-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/840-63-0x0000000002D80000-0x0000000002E00000-memory.dmp

Filesize
512KB

Download
memory/1084-186-0x00000000022EB000-0x0000000002352000-memory.dmp

Filesize
412KB

Download
memory/1084-184-0x00000000022E0000-0x0000000002360000-memory.dmp

Filesize
512KB

Download
memory/1084-185-0x000007FEF5200000-0x000007FEF5B9D000-memory.dmp

Filesize
9.6MB

Download
memory/1084-183-0x000007FEF5200000-0x000007FEF5B9D000-memory.dmp

Filesize
9.6MB

Download
memory/1084-182-0x00000000022E0000-0x0000000002360000-memory.dmp

Filesize
512KB

Download
memory/1520-16-0x000007FEF5AD0000-0x000007FEF646D000-memory.dmp

Filesize
9.6MB

Download
memory/1520-21-0x00000000029A4000-0x00000000029A7000-memory.dmp

Filesize
12KB

Download
memory/1520-18-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/1520-17-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/1520-22-0x00000000029AB000-0x0000000002A12000-memory.dmp

Filesize
412KB

Download
memory/1520-19-0x000007FEF5AD0000-0x000007FEF646D000-memory.dmp

Filesize
9.6MB

Download
memory/1528-60-0x0000000002CCB000-0x0000000002D32000-memory.dmp

Filesize
412KB

Download
memory/1528-61-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

Filesize
9.6MB

Download
memory/1528-59-0x0000000002CC0000-0x0000000002D40000-memory.dmp

Filesize
512KB

Download
memory/1528-58-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

Filesize
9.6MB

Download
memory/1528-62-0x0000000002CC4000-0x0000000002CC7000-memory.dmp

Filesize
12KB

Download
memory/1528-65-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

Filesize
9.6MB

Download
memory/1652-163-0x0000000140000000-0x000000014015E400-memory.dmp

Filesize
1.4MB

Download
memory/1652-199-0x0000000140000000-0x000000014015E400-memory.dmp

Filesize
1.4MB

Download
memory/1652-165-0x0000000140000000-0x000000014015E400-memory.dmp

Filesize
1.4MB

Download
memory/2180-0-0x0000000140000000-0x0000000140645400-memory.dmp

Filesize
6.3MB

Download
memory/2180-4-0x0000000140000000-0x0000000140645400-memory.dmp

Filesize
6.3MB

Download
memory/2180-3-0x0000000140000000-0x0000000140645400-memory.dmp

Filesize
6.3MB

Download
memory/2180-37-0x0000000140000000-0x0000000140645400-memory.dmp

Filesize
6.3MB

Download
memory/2180-1-0x0000000140000000-0x0000000140645400-memory.dmp

Filesize
6.3MB

Download
memory/2184-125-0x0000000140000000-0x000000014015E400-memory.dmp

Filesize
1.4MB

Download
memory/2184-127-0x0000000140000000-0x000000014015E400-memory.dmp

Filesize
1.4MB

Download
memory/2184-164-0x0000000140000000-0x000000014015E400-memory.dmp

Filesize
1.4MB

Download
memory/2184-124-0x0000000140000000-0x000000014015E400-memory.dmp

Filesize
1.4MB

Download
memory/2184-126-0x0000000140000000-0x000000014015E400-memory.dmp

Filesize
1.4MB

Download
memory/2212-25-0x0000000002B84000-0x0000000002B87000-memory.dmp

Filesize
12KB

Download
memory/2212-14-0x000000001B790000-0x000000001BA72000-memory.dmp

Filesize
2.9MB

Download
memory/2212-15-0x0000000002390000-0x0000000002398000-memory.dmp

Filesize
32KB

Download
memory/2212-23-0x000007FEF5AD0000-0x000007FEF646D000-memory.dmp

Filesize
9.6MB

Download
memory/2212-26-0x0000000002B80000-0x0000000002C00000-memory.dmp

Filesize
512KB

Download
memory/2212-24-0x000007FEF5AD0000-0x000007FEF646D000-memory.dmp

Filesize
9.6MB

Download
memory/2212-20-0x0000000002B80000-0x0000000002C00000-memory.dmp

Filesize
512KB

Download
memory/2524-123-0x0000000140000000-0x0000000140645400-memory.dmp

Filesize
6.3MB

Download
memory/2524-40-0x0000000140000000-0x0000000140645400-memory.dmp

Filesize
6.3MB

Download
memory/2524-67-0x000000001EA30000-0x000000001EF2C000-memory.dmp

Filesize
5.0MB

Download
memory/2700-173-0x0000000002CF0000-0x0000000002D70000-memory.dmp

Filesize
512KB

Download
memory/2700-180-0x0000000002CF0000-0x0000000002D70000-memory.dmp

Filesize
512KB

Download
memory/2700-172-0x000007FEF5200000-0x000007FEF5B9D000-memory.dmp

Filesize
9.6MB

Download
memory/2700-188-0x000007FEF5200000-0x000007FEF5B9D000-memory.dmp

Filesize
9.6MB

Download
memory/2700-175-0x000007FEF5200000-0x000007FEF5B9D000-memory.dmp

Filesize
9.6MB

Download
memory/2700-187-0x0000000002CF0000-0x0000000002D70000-memory.dmp

Filesize
512KB

Download
memory/2700-181-0x0000000002CF0000-0x0000000002D70000-memory.dmp

Filesize
512KB

Download
memory/2728-270-0x0000000140000000-0x0000000140170400-memory.dmp

Filesize
1.4MB

Download
memory/2728-290-0x0000000140000000-0x0000000140170400-memory.dmp

Filesize
1.4MB

Download
memory/2920-145-0x0000000002C2B000-0x0000000002C92000-memory.dmp

Filesize
412KB

Download
memory/2920-144-0x0000000002C20000-0x0000000002CA0000-memory.dmp

Filesize
512KB

Download
memory/2920-146-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/2920-143-0x000007FEF5630000-0x000007FEF5FCD000-memory.dmp

Filesize
9.6MB

Download
memory/2920-147-0x0000000002C24000-0x0000000002C27000-memory.dmp

Filesize
12KB

Download