metasploit | 82fbb67bf03714661b75a49245c8fe42141e7b68dda3f97f765eb1f2e00a89a9

Resubmissions

09-04-2024 07:01

240409-htps3scd2w 10

09-04-2024 07:01

09-04-2024 07:00

09-04-2024 07:00

07-03-2024 22:29

Analysis

max time kernel
300s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 07:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New Text Document mod.exe
Size

8KB
MD5

69994ff2f00eeca9335ccd502198e05b
SHA1

b13a15a5bea65b711b835ce8eccd2a699a99cead
SHA256

2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
SHA512

ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3
SSDEEP

96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1

Score

10^/10

metasploit redline remcos risepro stealc xworm zgrat 6077866846 remotehost backdoor discovery infostealer persistence rat spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

6077866846

https://pastebin.com/raw/KE5Mft0T

Extracted

Family

metasploit

Version

metasploit_stager

91.92.247.21:8405

Extracted

Family

xworm

94.156.8.213:58002

Attributes

Install_directory
%Public%
install_file
svchost.exe

Extracted

Family

remcos

Botnet

RemoteHost

shgoini.com:30902

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-7XHN5V
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Detect Xworm Payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\a\svchost.exe	family_xworm
behavioral3/memory/3580-375-0x00000000000D0000-0x00000000000E6000-memory.dmp	family_xworm
behavioral3/memory/552-566-0x000000001AD40000-0x000000001AD58000-memory.dmp	family_xworm

Detect ZGRat V1 32 IoCs

Processes:

resource	yara_rule
behavioral3/memory/4372-75-0x000001E9F7330000-0x000001E9F75A6000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-97-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-94-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-110-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-115-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-117-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-119-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-122-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-124-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-126-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-128-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-132-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-136-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-143-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-148-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-152-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-154-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-158-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-163-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-169-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-171-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-174-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-179-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-182-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-184-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-186-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-188-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-191-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-193-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-195-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-197-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1
behavioral3/memory/4372-201-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp	family_zgrat_v1

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral3/memory/4956-11-0x0000000000770000-0x0000000000792000-memory.dmp	family_redline

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Blocklisted process makes network request 8 IoCs

Processes:

Props.exe

flow pid process

32 720 Props.exe
32 720 Props.exe
32 720 Props.exe
32 720 Props.exe
32 720 Props.exe
32 720 Props.exe
32 720 Props.exe
32 720 Props.exe
Downloads MZ/PE file

flow	pid	process
32	720	Props.exe
32	720	Props.exe
32	720	Props.exe
32	720	Props.exe
32	720	Props.exe
32	720	Props.exe
32	720	Props.exe
32	720	Props.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exeTester.exeNew Text Document mod.exeISetup8.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Tester.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	New Text Document mod.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	ISetup8.exe

Drops startup file 1 IoCs

Processes:

word.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\word.vbs word.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\word.vbs	word.exe

Executes dropped EXE 18 IoCs

Processes:

crypted6077866846MVYQY.exei1gcbW1E.exedisable-defender.exepclient.exeMStore.exeresponsibilitylead.exeProps.exewininit.exe1234.exeISetup8.exetest2.exeu1qw.0.exe1111.exeISetup2.exeword.exeTester.exesvchost.exesvchost.exe

pid	process
4956	crypted6077866846MVYQY.exe
4648	i1gcbW1E.exe
1612	disable-defender.exe
872	pclient.exe
3892	MStore.exe
4372	responsibilitylead.exe
720	Props.exe
4932	wininit.exe
2608	1234.exe
2264	ISetup8.exe
3264	test2.exe
3408	u1qw.0.exe
536	1111.exe
3924	ISetup2.exe
4056	word.exe
2532	Tester.exe
3580	svchost.exe
552	svchost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

pclient.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	pclient.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

10 raw.githubusercontent.com
12 raw.githubusercontent.com
44 pastebin.com
45 pastebin.com

flow	ioc
10	raw.githubusercontent.com
12	raw.githubusercontent.com
44	pastebin.com
45	pastebin.com

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\a\wininit.exe	autoit_exe
C:\Users\Admin\AppData\Local\directory\word.exe	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

word.exe

description pid process target process

PID 4056 set thread context of 3732 4056 word.exe svchost.exe
Drops file in Windows directory 2 IoCs

Processes:

Tester.exe

description ioc process

File created C:\Windows\svchost.exe Tester.exe
File opened for modification C:\Windows\svchost.exe Tester.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 4056 set thread context of 3732	4056	word.exe	svchost.exe

description	ioc	process
File created	C:\Windows\svchost.exe	Tester.exe
File opened for modification	C:\Windows\svchost.exe	Tester.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

u1qw.0.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	u1qw.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	u1qw.0.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1972 schtasks.exe

pid	process
1972	schtasks.exe

Suspicious behavior: EnumeratesProcesses 59 IoCs

Processes:

crypted6077866846MVYQY.exedisable-defender.exepowershell.exeu1qw.0.exeTester.exesvchost.exepowershell.exepowershell.exesvchost.exe

pid	process
4956	crypted6077866846MVYQY.exe
1612	disable-defender.exe
1612	disable-defender.exe
3944	powershell.exe
3944	powershell.exe
3944	powershell.exe
4956	crypted6077866846MVYQY.exe
4956	crypted6077866846MVYQY.exe
4956	crypted6077866846MVYQY.exe
4956	crypted6077866846MVYQY.exe
4956	crypted6077866846MVYQY.exe
4956	crypted6077866846MVYQY.exe
4956	crypted6077866846MVYQY.exe
4956	crypted6077866846MVYQY.exe
4956	crypted6077866846MVYQY.exe
4956	crypted6077866846MVYQY.exe
4956	crypted6077866846MVYQY.exe
4956	crypted6077866846MVYQY.exe
3408	u1qw.0.exe
3408	u1qw.0.exe
4956	crypted6077866846MVYQY.exe
2532	Tester.exe
2532	Tester.exe
2532	Tester.exe
2532	Tester.exe
2532	Tester.exe
2532	Tester.exe
2532	Tester.exe
2532	Tester.exe
2532	Tester.exe
2532	Tester.exe
3580	svchost.exe
3580	svchost.exe
2532	Tester.exe
2532	Tester.exe
2532	Tester.exe
2532	Tester.exe
2532	Tester.exe
2532	Tester.exe
2532	Tester.exe
2532	Tester.exe
2532	Tester.exe
2532	Tester.exe
2532	Tester.exe
2532	Tester.exe
2532	Tester.exe
2532	Tester.exe
2532	Tester.exe
2532	Tester.exe
2532	Tester.exe
2532	Tester.exe
720	powershell.exe
720	powershell.exe
720	powershell.exe
3628	powershell.exe
3628	powershell.exe
3628	powershell.exe
552	svchost.exe
552	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

word.exe

pid process

4056 word.exe

pid	process
4056	word.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

New Text Document mod.execrypted6077866846MVYQY.exedisable-defender.exeresponsibilitylead.exepowershell.exeTester.exesvchost.exevssvc.exepowershell.exepowershell.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	3872	New Text Document mod.exe
Token: SeDebugPrivilege	4956	crypted6077866846MVYQY.exe
Token: SeDebugPrivilege	1612	disable-defender.exe
Token: SeImpersonatePrivilege	1612	disable-defender.exe
Token: SeDebugPrivilege	4372	responsibilitylead.exe
Token: SeDebugPrivilege	3944	powershell.exe
Token: SeDebugPrivilege	2532	Tester.exe
Token: SeDebugPrivilege	3580	svchost.exe
Token: SeDebugPrivilege	3580	svchost.exe
Token: SeBackupPrivilege	2496	vssvc.exe
Token: SeRestorePrivilege	2496	vssvc.exe
Token: SeAuditPrivilege	2496	vssvc.exe
Token: SeDebugPrivilege	720	powershell.exe
Token: SeDebugPrivilege	3628	powershell.exe
Token: SeDebugPrivilege	552	svchost.exe
Token: SeDebugPrivilege	552	svchost.exe
Token: SeDebugPrivilege	552	svchost.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

wininit.exeword.exe

pid process

4932 wininit.exe
4932 wininit.exe
4056 word.exe
4056 word.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

wininit.exeword.exe

pid process

4932 wininit.exe
4932 wininit.exe
4056 word.exe
4056 word.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

svchost.exesvchost.exe

pid process

3580 svchost.exe
552 svchost.exe

pid	process
4932	wininit.exe
4932	wininit.exe
4056	word.exe
4056	word.exe

pid	process
4932	wininit.exe
4932	wininit.exe
4056	word.exe
4056	word.exe

pid	process
3580	svchost.exe
552	svchost.exe

Suspicious use of WriteProcessMemory 55 IoCs

Processes:

New Text Document mod.exepclient.exeMStore.execmd.exeISetup8.exewininit.exeword.exesvchost.exeTester.exe

description	pid	process	target process
PID 3872 wrote to memory of 4956	3872	New Text Document mod.exe	crypted6077866846MVYQY.exe
PID 3872 wrote to memory of 4956	3872	New Text Document mod.exe	crypted6077866846MVYQY.exe
PID 3872 wrote to memory of 4956	3872	New Text Document mod.exe	crypted6077866846MVYQY.exe
PID 3872 wrote to memory of 4648	3872	New Text Document mod.exe	i1gcbW1E.exe
PID 3872 wrote to memory of 4648	3872	New Text Document mod.exe	i1gcbW1E.exe
PID 3872 wrote to memory of 1612	3872	New Text Document mod.exe	disable-defender.exe
PID 3872 wrote to memory of 1612	3872	New Text Document mod.exe	disable-defender.exe
PID 3872 wrote to memory of 872	3872	New Text Document mod.exe	pclient.exe
PID 3872 wrote to memory of 872	3872	New Text Document mod.exe	pclient.exe
PID 3872 wrote to memory of 3892	3872	New Text Document mod.exe	MStore.exe
PID 3872 wrote to memory of 3892	3872	New Text Document mod.exe	MStore.exe
PID 872 wrote to memory of 4372	872	pclient.exe	responsibilitylead.exe
PID 872 wrote to memory of 4372	872	pclient.exe	responsibilitylead.exe
PID 3872 wrote to memory of 720	3872	New Text Document mod.exe	powershell.exe
PID 3872 wrote to memory of 720	3872	New Text Document mod.exe	powershell.exe
PID 3892 wrote to memory of 972	3892	MStore.exe	cmd.exe
PID 3892 wrote to memory of 972	3892	MStore.exe	cmd.exe
PID 972 wrote to memory of 3944	972	cmd.exe	powershell.exe
PID 972 wrote to memory of 3944	972	cmd.exe	powershell.exe
PID 3872 wrote to memory of 4932	3872	New Text Document mod.exe	wininit.exe
PID 3872 wrote to memory of 4932	3872	New Text Document mod.exe	wininit.exe
PID 3872 wrote to memory of 4932	3872	New Text Document mod.exe	wininit.exe
PID 3872 wrote to memory of 2608	3872	New Text Document mod.exe	1234.exe
PID 3872 wrote to memory of 2608	3872	New Text Document mod.exe	1234.exe
PID 3872 wrote to memory of 2608	3872	New Text Document mod.exe	1234.exe
PID 3872 wrote to memory of 2264	3872	New Text Document mod.exe	ISetup8.exe
PID 3872 wrote to memory of 2264	3872	New Text Document mod.exe	ISetup8.exe
PID 3872 wrote to memory of 2264	3872	New Text Document mod.exe	ISetup8.exe
PID 3872 wrote to memory of 3264	3872	New Text Document mod.exe	test2.exe
PID 3872 wrote to memory of 3264	3872	New Text Document mod.exe	test2.exe
PID 2264 wrote to memory of 3408	2264	ISetup8.exe	u1qw.0.exe
PID 2264 wrote to memory of 3408	2264	ISetup8.exe	u1qw.0.exe
PID 2264 wrote to memory of 3408	2264	ISetup8.exe	u1qw.0.exe
PID 3872 wrote to memory of 536	3872	New Text Document mod.exe	1111.exe
PID 3872 wrote to memory of 536	3872	New Text Document mod.exe	1111.exe
PID 3872 wrote to memory of 3924	3872	New Text Document mod.exe	ISetup2.exe
PID 3872 wrote to memory of 3924	3872	New Text Document mod.exe	ISetup2.exe
PID 3872 wrote to memory of 3924	3872	New Text Document mod.exe	ISetup2.exe
PID 4932 wrote to memory of 4056	4932	wininit.exe	word.exe
PID 4932 wrote to memory of 4056	4932	wininit.exe	word.exe
PID 4932 wrote to memory of 4056	4932	wininit.exe	word.exe
PID 3872 wrote to memory of 2532	3872	New Text Document mod.exe	Tester.exe
PID 3872 wrote to memory of 2532	3872	New Text Document mod.exe	Tester.exe
PID 4056 wrote to memory of 3732	4056	word.exe	svchost.exe
PID 4056 wrote to memory of 3732	4056	word.exe	svchost.exe
PID 4056 wrote to memory of 3732	4056	word.exe	svchost.exe
PID 3872 wrote to memory of 3580	3872	New Text Document mod.exe	svchost.exe
PID 3872 wrote to memory of 3580	3872	New Text Document mod.exe	svchost.exe
PID 4056 wrote to memory of 3732	4056	word.exe	svchost.exe
PID 3580 wrote to memory of 1972	3580	svchost.exe	schtasks.exe
PID 3580 wrote to memory of 1972	3580	svchost.exe	schtasks.exe
PID 2532 wrote to memory of 720	2532	Tester.exe	powershell.exe
PID 2532 wrote to memory of 720	2532	Tester.exe	powershell.exe
PID 2532 wrote to memory of 3628	2532	Tester.exe	powershell.exe
PID 2532 wrote to memory of 3628	2532	Tester.exe	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3872

C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
"C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4956

C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
"C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"
2⤵
- Executes dropped EXE
PID:4648

C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe
"C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Users\Admin\AppData\Local\Temp\a\pclient.exe
"C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:872

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4372

C:\Users\Admin\AppData\Local\Temp\a\MStore.exe
"C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe
3⤵
- Suspicious use of WriteProcessMemory
PID:972

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionExtension .exe
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3944

C:\Users\Admin\AppData\Local\Temp\a\Props.exe
"C:\Users\Admin\AppData\Local\Temp\a\Props.exe"
2⤵
- Blocklisted process makes network request
- Executes dropped EXE
PID:720

C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
"C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4932

C:\Users\Admin\AppData\Local\directory\word.exe
"C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4056

C:\Windows\SysWOW64\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
4⤵
PID:3732

C:\Users\Admin\AppData\Local\Temp\a\1234.exe
"C:\Users\Admin\AppData\Local\Temp\a\1234.exe"
2⤵
- Executes dropped EXE
PID:2608

C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
"C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264

C:\Users\Admin\AppData\Local\Temp\u1qw.0.exe
"C:\Users\Admin\AppData\Local\Temp\u1qw.0.exe"
3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3408

C:\Users\Admin\AppData\Local\Temp\a\test2.exe
"C:\Users\Admin\AppData\Local\Temp\a\test2.exe"
2⤵
- Executes dropped EXE
PID:3264

C:\Users\Admin\AppData\Local\Temp\a\1111.exe
"C:\Users\Admin\AppData\Local\Temp\a\1111.exe"
2⤵
- Executes dropped EXE
PID:536

C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
"C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"
2⤵
- Executes dropped EXE
PID:3924

C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
"C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svchost.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:720

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3628

C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3580

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"
3⤵
- Creates scheduled task(s)
PID:1972

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2496

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2979eabc783eaca50de7be23dd4eafcf

SHA1
d709ce5f3a06b7958a67e20870bfd95b83cad2ea

SHA256
006cca90e78fbb571532a83082ac6712721a34ea4b21f490058ffb3f521f4903

SHA512
92bc433990572d9427d0c93eef9bd1cc23fa00ed60dd0c9c983d87d3421e02ce3f156c6f88fe916ef6782dbf185cbce083bc0094f8c527f302be6a37d1c53aba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ba169f4dcbbf147fe78ef0061a95e83b

SHA1
92a571a6eef49fff666e0f62a3545bcd1cdcda67

SHA256
5ef1421e19fde4bc03cd825dd7d6c0e7863f85fd8f0aa4a4d4f8d555dc7606d1

SHA512
8d2e5e552210dcda684682538bc964fdd8a8ff5b24cc2cc8af813729f0202191f98eb42d38d2355df17ae620fe401aad6ceaedaed3b112fdacd32485a3a0c07c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe

Filesize
6KB

MD5
f7930c4859ccd34bd2b80a9995f49926

SHA1
8b5b95fb51619e20246f90d60f2137da7654fc5e

SHA256
163969ebee8180e125eb00c02307adda1eb31174ba6f7e011b7b4b3441d8950a

SHA512
8f5a440541b227083f3d2a3a251758bf699a290db3c066ae3209d4c2df5e1e933b9c24cd4c0da0a7f3cb6ca0ce025acf22f65cc06ee1e306ecb9b1318a223a43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Maianthemum

Filesize
29KB

MD5
1680954b249062aa27483ac80d9d2016

SHA1
acb196e38638fa7332a450b8ed9c127f1d56acff

SHA256
3614592179f15f4bc0cba05bac8e9dd7e545e6f623bd71b841aaa665f82b16cb

SHA512
9c94ec10f0577953a6bbc994b1339d9e414622efd07e4a61f31c5213f588d7327bd772c225a7a127736b721ec026ff836cf4167f9467dbf6df819bdec6e2ed93

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dkwfu1h3.alr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\1111.exe

Filesize
2.8MB

MD5
e670bdc7c82eee75a6d3ada6a7c9134e

SHA1
b0f0bab6f6e92bc86e86fd7bff93c257a4235859

SHA256
a5cf4844df86abc9222fe436dbc0726e09383a61f4708cdc1a3e8a89cc3540fb

SHA512
7384550bb19ccc11243b79d3bfc9c3f25dce84de64891e7f7eb078b246bfedcd26a958a019a3a7b4ecf5ee1c4e8c8d44790f5c958a58266e5676f3a8e58f4643

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\1234.exe

Filesize
1.3MB

MD5
5e13199a94cf8664e5bfbe2f68d4738e

SHA1
8cfaa21f68226ae775615f033507b5756f5ccacc

SHA256
71b320a5d9456acc43494213dcd1f4ae8b7f6e27a15ac80cb42df5f19f692ec5

SHA512
b7b682717cd49b9fff9885c85f1421050613559308aa7160dee7ce493d5bff126c8157727d8f88fdfd602092203c64ab0dbff718b7ce7af9f9f2ad8375d703b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe

Filesize
413KB

MD5
d388d6918f1e8a6a3b34ad993d8159eb

SHA1
cf3cd31a4dd6571cc78016c7b0f97f621b1f253d

SHA256
27d2a005efcb4da7da558eaafb6bc955a008c4beb5814d262cee38cf379f7645

SHA512
54cdbb862536ce1deffc37c5a185e85e52ea1b69bb4c8e0e9137e4d34787ad4b66b047a90b1dbe6694b1d41233e947ffa7119f08e01616f472daf3f72e35761e

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe

Filesize
413KB

MD5
94e9960a45131af61e599acee54d21d6

SHA1
39b03e050337d4eb127ae5ff5f0868e986bec7ad

SHA256
7add2d9d67534037b7ae6e8d1682595f5bc45cd71f6bcc933994f53f5ff00172

SHA512
179f713f0ce01a70b176373d042538f95a1653cf364510b7f35d3d46a7fee2d295c6e24755d2a1363e5ca82494caec8252dd94bcd31c7a015ef5640636f7e81a

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\MStore.exe

Filesize
12KB

MD5
282c1ebb16ad0edc41389d1e73a74607

SHA1
fbcdda121484ea6125827ed4e7b1b00f6a88835d

SHA256
7712424f2dec2d08630237c737e5f81789d2e92edc31111c72eaa0388b6df1dc

SHA512
94be4f173c5c63947a6e7902a86c8851ee84a06d1ddec104af91592178adafc3180f652791badc3e0c1139bbc7c9f64b9e47ccd0adadd16159a40ab6c188b292

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\Props.exe

Filesize
7KB

MD5
9c938f91a0530150a2b1c4546334570c

SHA1
f4ae9acba920744457739fef0205f86443dbdf65

SHA256
35a6319c334d545be1aff625c27d51d583762b44c77f172f532c27021459345a

SHA512
f5b8fa5f95011fe6677f2f751b5364745607a027e49de05d2a11a5bea5040c97b6cb4285007ee34ce05b00217dd9665065b276df21bf37f823691f57ad2a6a0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\Tester.exe

Filesize
267KB

MD5
0803c1aec008e75859877844cfa81492

SHA1
16924d5802ddf76a2096fcfade0ce06d4c0670bd

SHA256
d5ab98bd209db0ed18272fe616ea4b8be34fd13d36116d25793fa7aa6f8b33e3

SHA512
9001e77da2562652ae51bdb3b8b9bfe686d0ed0c4eb8d338b20b7c4eb6eb8e90a4fae01d8212b1908037d5ff456e982500e4907686c38e5c33e969d55ba914d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe

Filesize
524KB

MD5
c8edf453ed433cefb2696bb859e0f782

SHA1
e34cf939d6c5a34c7bedfd885249bb7fb15336e5

SHA256
0c5c2b10c3161ad9452c25d4a10e082ec94f0eb39b583c03ab3534a5e45649a0

SHA512
61d0ba50f9678d6614e4d8ab8b06d759891979e0debfda88246871ee110a07c16ceeed4e7baec475b4b63de851bc5d62c69c5ae41674ffc207b94515f6ab197c

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe

Filesize
294KB

MD5
10fc8b2915c43aa16b6a2e2b4529adc5

SHA1
0c15286457963eb86d61d83642870a3473ef38fe

SHA256
feb09cc39b1520d228e9e9274500b8c229016d6fc8018a2bf19aa9d3601492c5

SHA512
421631c06408c3be522953459228d2e1d45eeeafce29dba7746c8485a105b59c3a2c0d9e2ffc6d89126cd825ffd09ebe7eb82223a69d1f5caf441feb01e57897

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe

Filesize
2.3MB

MD5
262a7eb58a01d1aab21b24292c181cd3

SHA1
535312b7048fb90be981e04ea759c5ad8aaf6eda

SHA256
107090a44888272297ecb7a715a9abca4bc17dafe6aa57505436722a5a9926a6

SHA512
358b34a792eadc739446283e42a352147aac1bad6d9a535eedabeb2427735b03e7977d25086cfa6b6e8e17df628e37d9a8cd584dd1a64d703e99a8f7af1a0e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\pclient.exe

Filesize
157KB

MD5
5790d1417f8f00bd7ec6fb7011c79d9c

SHA1
36076ed9457c45d94e664ea291eb01e5c70d084b

SHA256
ad07503bc046f5b3d65eb61646fa826bc39560916c6e1ef2c3437b6465b30a82

SHA512
b19195510624ad16a4730282c97b68d05e4890a33d91f86f24eaf921e23e7786649e4e31aaaec2d9d6c7bb3695c615851d7aed3e53b13083e03acbc8d0543ef0

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\svchost.exe

Filesize
66KB

MD5
00135a86ab829fc2d4678179d7a6e70f

SHA1
ef75c259865d7685d566b6e25b7a20d134952555

SHA256
0b8b21af69d0b465b7b8cd584bdba1f86d062bb0c7c51656f36a66fce8e9bd89

SHA512
011389f2bc93f45b36233238a32991823c3334e3259af98e7dd6cedb455fc930d5b603f51bb69e415ab24f285309eda0b272250f1ec82a21508de0681281a0ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\test2.exe

Filesize
2.7MB

MD5
5347852b24409aed42423f0118637f03

SHA1
6c7947428231ab857ee8c9dab7a7e62fdeed024b

SHA256
a2e678bb376d2dcec5b7d0abac428c87cd8ae75936e28c03cb4232ae97015131

SHA512
0a52f226be962eb8187f444657317d3e0385d9d47d507e6f1c028143f57153a7b8e34ef7b0c8732bb3b3d361da483a13264f511ca5c80cedda3bc439fe936991

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\wininit.exe

Filesize
1.3MB

MD5
ddee86f4db0d3b8010110445b0545526

SHA1
b41380b50d17dd679f85a224771398b81966bb9e

SHA256
0d1277800ce70608ae6223a3361f709c7c68743178ca51fe3a2409a610c76de5

SHA512
4271e530a7090d58e41adc441eed6aacd6238d4e562cbab05bf273549e15a22dda668450746eda64e2435d480dc46531a29de3ba797a235a9c1a411a1f8f3710

Download Submit
C:\Users\Admin\AppData\Local\Temp\croc

Filesize
483KB

MD5
ceea497fc0601e397a9b0dba479b6ad3

SHA1
b791fd1115d9517d7e9cb9a987db2307aa900f67

SHA256
a17f87f849572c5977fa38198d6697a248424f2559aed98136834e188ac2d3f2

SHA512
702cff5d69b609e25d75545f58352aecf7ed28730c012f3a4ce6113842ebcda3308bc05e7658c27a260dec0bebaf25cad2bda1bff476aa79b2bb0ed4ad561858

Download Submit
C:\Users\Admin\AppData\Local\Temp\u1qw.0.exe

Filesize
271KB

MD5
b95747cad90e982d44da8fd74f50b9a6

SHA1
d7f267d2042f6b67f63542395ff6a5a1b3ba1250

SHA256
7b4d39265da2ddc442c1bc4335c92fe527bf6b8d644d4d465f1476a97a1fb153

SHA512
615d35780262f55313ccbe31e323bb6ba9787120ce06d5236a74844736543c7551e4e227e350bf1604208095165c42564234bb2dafe575785008683ae4e5393c

Download Submit
C:\Users\Admin\AppData\Local\directory\word.exe

Filesize
102.3MB

MD5
20aea6e7dc2efc5f5827fa70e0852432

SHA1
3cf392d41baf0f54ed6d08fee91dd6ed55fc9e90

SHA256
13825730eb46b779ffa6bb70f773e8a9bb6b04d73543c3e6cd89271a6612f427

SHA512
9c03573ea4cb9c7730603628a3430bd880d14ea0daf2f1da2de45a173f80e3331406a94060a2648cce5507cbe4ec00111eb4e8dd90cba48fb50b4dbf0aa99d8a

Download Submit
memory/552-565-0x00007FFA28E60000-0x00007FFA29921000-memory.dmp

Filesize
10.8MB

Download
memory/552-566-0x000000001AD40000-0x000000001AD58000-memory.dmp

Filesize
96KB

Download
memory/720-543-0x00007FFA28E60000-0x00007FFA29921000-memory.dmp

Filesize
10.8MB

Download
memory/720-541-0x0000025DEC220000-0x0000025DEC230000-memory.dmp

Filesize
64KB

Download
memory/720-539-0x00007FFA28E60000-0x00007FFA29921000-memory.dmp

Filesize
10.8MB

Download
memory/720-540-0x0000025DEC220000-0x0000025DEC230000-memory.dmp

Filesize
64KB

Download
memory/720-69-0x0000000140000000-0x0000000140004278-memory.dmp

Filesize
16KB

Download
memory/2264-176-0x0000000002E50000-0x0000000002F50000-memory.dmp

Filesize
1024KB

Download
memory/2264-178-0x00000000049C0000-0x0000000004A2C000-memory.dmp

Filesize
432KB

Download
memory/2264-400-0x0000000000400000-0x0000000002D44000-memory.dmp

Filesize
41.3MB

Download
memory/2264-190-0x0000000000400000-0x0000000002D44000-memory.dmp

Filesize
41.3MB

Download
memory/2532-393-0x00007FFA28E60000-0x00007FFA29921000-memory.dmp

Filesize
10.8MB

Download
memory/2532-355-0x0000000000970000-0x00000000009BA000-memory.dmp

Filesize
296KB

Download
memory/2532-564-0x00007FFA28E60000-0x00007FFA29921000-memory.dmp

Filesize
10.8MB

Download
memory/3408-260-0x0000000002DD0000-0x0000000002ED0000-memory.dmp

Filesize
1024KB

Download
memory/3408-523-0x0000000000400000-0x0000000002D21000-memory.dmp

Filesize
41.1MB

Download
memory/3408-274-0x0000000000400000-0x0000000002D21000-memory.dmp

Filesize
41.1MB

Download
memory/3408-262-0x0000000004940000-0x0000000004967000-memory.dmp

Filesize
156KB

Download
memory/3580-375-0x00000000000D0000-0x00000000000E6000-memory.dmp

Filesize
88KB

Download
memory/3580-404-0x00007FFA28E60000-0x00007FFA29921000-memory.dmp

Filesize
10.8MB

Download
memory/3628-558-0x00007FFA28E60000-0x00007FFA29921000-memory.dmp

Filesize
10.8MB

Download
memory/3628-556-0x0000026BE42E0000-0x0000026BE42F0000-memory.dmp

Filesize
64KB

Download
memory/3628-545-0x0000026BE42E0000-0x0000026BE42F0000-memory.dmp

Filesize
64KB

Download
memory/3628-544-0x00007FFA28E60000-0x00007FFA29921000-memory.dmp

Filesize
10.8MB

Download
memory/3732-399-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3872-173-0x00007FFA28E60000-0x00007FFA29921000-memory.dmp

Filesize
10.8MB

Download
memory/3872-0-0x0000000000A80000-0x0000000000A88000-memory.dmp

Filesize
32KB

Download
memory/3872-1-0x00007FFA28E60000-0x00007FFA29921000-memory.dmp

Filesize
10.8MB

Download
memory/3872-2-0x000000001B750000-0x000000001B760000-memory.dmp

Filesize
64KB

Download
memory/3872-495-0x00007FFA28E60000-0x00007FFA29921000-memory.dmp

Filesize
10.8MB

Download
memory/3872-258-0x000000001B750000-0x000000001B760000-memory.dmp

Filesize
64KB

Download
memory/3924-374-0x0000000002F10000-0x0000000003010000-memory.dmp

Filesize
1024KB

Download
memory/3924-388-0x0000000000400000-0x0000000002D44000-memory.dmp

Filesize
41.3MB

Download
memory/3944-410-0x00007FFA28E60000-0x00007FFA29921000-memory.dmp

Filesize
10.8MB

Download
memory/3944-96-0x00007FFA28E60000-0x00007FFA29921000-memory.dmp

Filesize
10.8MB

Download
memory/3944-98-0x000001AA5DEA0000-0x000001AA5DEB0000-memory.dmp

Filesize
64KB

Download
memory/3944-89-0x000001AA5DFB0000-0x000001AA5DFD2000-memory.dmp

Filesize
136KB

Download
memory/3944-144-0x000001AA5DEA0000-0x000001AA5DEB0000-memory.dmp

Filesize
64KB

Download
memory/3944-109-0x000001AA5DEA0000-0x000001AA5DEB0000-memory.dmp

Filesize
64KB

Download
memory/3944-120-0x000001AA5DEA0000-0x000001AA5DEB0000-memory.dmp

Filesize
64KB

Download
memory/4372-191-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-115-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-188-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-158-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-154-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-193-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-195-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-197-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-163-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-201-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-59-0x000001E9F4BE0000-0x000001E9F4BE6000-memory.dmp

Filesize
24KB

Download
memory/4372-143-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-66-0x00007FFA28E60000-0x00007FFA29921000-memory.dmp

Filesize
10.8MB

Download
memory/4372-67-0x000001E9F7220000-0x000001E9F7230000-memory.dmp

Filesize
64KB

Download
memory/4372-136-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-184-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-75-0x000001E9F7330000-0x000001E9F75A6000-memory.dmp

Filesize
2.5MB

Download
memory/4372-132-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-128-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-169-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-126-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-124-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-122-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-182-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-119-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-97-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-117-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-186-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-94-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-148-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-171-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-179-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-174-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-368-0x00007FFA28E60000-0x00007FFA29921000-memory.dmp

Filesize
10.8MB

Download
memory/4372-397-0x000001E9F7220000-0x000001E9F7230000-memory.dmp

Filesize
64KB

Download
memory/4372-110-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4372-152-0x000001E9F7330000-0x000001E9F75A1000-memory.dmp

Filesize
2.4MB

Download
memory/4932-114-0x0000000001C30000-0x0000000001C34000-memory.dmp

Filesize
16KB

Download
memory/4956-73-0x00000000056E0000-0x00000000056F2000-memory.dmp

Filesize
72KB

Download
memory/4956-357-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/4956-70-0x0000000005C60000-0x0000000006278000-memory.dmp

Filesize
6.1MB

Download
memory/4956-233-0x0000000006E70000-0x0000000006EE6000-memory.dmp

Filesize
472KB

Download
memory/4956-175-0x0000000006AD0000-0x0000000006C92000-memory.dmp

Filesize
1.8MB

Download
memory/4956-277-0x00000000070F0000-0x000000000710E000-memory.dmp

Filesize
120KB

Download
memory/4956-82-0x0000000005810000-0x000000000591A000-memory.dmp

Filesize
1.0MB

Download
memory/4956-112-0x0000000005330000-0x0000000005340000-memory.dmp

Filesize
64KB

Download
memory/4956-145-0x0000000006790000-0x00000000067DC000-memory.dmp

Filesize
304KB

Download
memory/4956-181-0x00000000071D0000-0x00000000076FC000-memory.dmp

Filesize
5.2MB

Download
memory/4956-527-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/4956-230-0x0000000006D40000-0x0000000006D90000-memory.dmp

Filesize
320KB

Download
memory/4956-202-0x0000000007CB0000-0x0000000008254000-memory.dmp

Filesize
5.6MB

Download
memory/4956-24-0x0000000002C70000-0x0000000002CD6000-memory.dmp

Filesize
408KB

Download
memory/4956-23-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/4956-11-0x0000000000770000-0x0000000000792000-memory.dmp

Filesize
136KB

Download
memory/4956-199-0x0000000006CA0000-0x0000000006D32000-memory.dmp

Filesize
584KB

Download
memory/4956-133-0x0000000006750000-0x000000000678C000-memory.dmp

Filesize
240KB

Download