Overview

overview

10

Static

static

10

dba803bf09...JC.exe

windows7-x64

10

dba803bf09...JC.exe

windows10-1703-x64

10

dba803bf09...JC.exe

windows10-2004-x64

10

dba803bf09...JC.exe

windows11-21h2-x64

10

Resubmissions

10/04/2024, 02:55

240410-dektcsff5x10

10/04/2024, 02:54

240410-dd6z7scc8910

10/04/2024, 02:54

240410-dd6pfacc8810

10/04/2024, 02:54

240410-dd53xacc8710

09/09/2023, 16:01

230909-tgqqdscd3z7

Analysis

  • max time kernel
    1796s
  • max time network
    1804s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2024, 02:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
  • Size 203KB
  • Sample240410-dektcsff5x
  • SHA256 dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
gurcuzgratcollectiondiscoveryratspywarestealer

Malware Config

Signatures

  • Detect Gurcu Stealer V3 payload 2 IoCs
  • Detect ZGRat V1 2 IoCs
  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Checks computer location settings 2 TTPs 32 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 62 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3380
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe" &&START "" "C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2496
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:4696
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:4432
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:2032
        • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
          "C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3688
          • C:\Windows\System32\tar.exe
            "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmp885A.tmp" -C "C:\Users\Admin\AppData\Local\9krryil1hy"
            4⤵
              PID:4488
            • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
              "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
              4⤵
              • Executes dropped EXE
              PID:912
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:1468
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4784
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2984
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3332
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4168
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4180
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2640
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3324
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4636
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2656
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2840
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4128
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3864
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2876
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3320
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1012
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1136
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1156
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4836
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3236
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2840
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4972
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3640
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2116
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3636
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4480
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1352
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4152
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5108
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3224
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5008
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:724
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1216
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3656
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3868
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:972
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2972
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1348
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4256
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1624
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4464
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1012
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3084
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2704
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1980
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4624
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5052
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3044
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3888
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2496
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:704
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:424
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1420
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4300
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1128
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1760
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1388
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4424
      • C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1940
        • C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
          "C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:5028

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            cached-microdesc-consensus.tmp
            • Path C:\Users\Admin\AppData\Local\9krryil1hy\data\cached-microdesc-consensus.tmp
            • Size 2.7MB
            • SHA256 60b43cdce0f807f7891521f396f53def34a7d98986dbde0faa2a197189c587f3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cached-microdescs.new
            • Path C:\Users\Admin\AppData\Local\9krryil1hy\data\cached-microdescs.new
            • Size 7.5MB
            • SHA256 c3cee463b3b23b4296035358c36a0959e224ffb46cb1fcf02aa2d23cb67e26bd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            hostname
            • Path C:\Users\Admin\AppData\Local\9krryil1hy\host\hostname
            • Size 64B
            • SHA256 e08b543ea96b4523c39089345bcac135f3608805d4d7efe4e263124b829763c1
            • MD5 SHA1 SHA512
            Submit Download

            port.dat
            • Path C:\Users\Admin\AppData\Local\9krryil1hy\port.dat
            • Size 4B
            • SHA256 2021dc8bd93e4492bf258d9d18eabf53579b19c8c97bbcebaf0619d9eba587cb
            • MD5 SHA1 SHA512
            Submit Download

            tor.exe
            • Path C:\Users\Admin\AppData\Local\9krryil1hy\tor\tor.exe
            • Size 7.4MB
            • SHA256 46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            torrc.txt
            • Path C:\Users\Admin\AppData\Local\9krryil1hy\torrc.txt
            • Size 218B
            • SHA256 0e48f4a46a60cb2faeb1317ae000d341e59ae171366a8143d13337b89b60282a
            • MD5 SHA1 SHA512
            Submit Download

            dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
            • Path C:\Users\Admin\AppData\Local\EsetSecurity\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe
            • Size 203KB
            • SHA256 dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dba803bf0917907fad2aa9163b78a20ba8ba2b9a79cf105dede3a5acd821236aexe_JC.exe.log
            • Size 847B
            • SHA256 169bc31a8d1666535977ca170d246a463e6531bb21faab6c48cb4269d9d60b2e
            • MD5 SHA1 SHA512
            Submit Download

            installUtilLog.txt
            • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
            • Size 271B
            • SHA256 42caba1fd78a3bc722a278d964b5e2675a7f01cc8911cb2525f6909b2698b4b1
            • MD5 SHA1 SHA512
            Submit Download

            installUtilLog.txt
            • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
            • Size 324B
            • SHA256 821060995fb73c5d908dc3325cbf0f78580839ea4f0c0ca37844571803fcd6c2
            • MD5 SHA1 SHA512
            Submit Download

            installUtilLog.txt
            • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
            • Size 377B
            • SHA256 36c9dd8ffc55c99f27a06f02332a861792a20bb7f396fc710e2b3835ab429895
            • MD5 SHA1 SHA512
            Submit Download

            installUtilLog.txt
            • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
            • Size 430B
            • SHA256 6272b650d0b317f6feb44a590ad89e760e1992eec519548f1c81f15f583b7507
            • MD5 SHA1 SHA512
            Submit Download

            installUtilLog.txt
            • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
            • Size 483B
            • SHA256 bd088ea1730df511199021905c86bd17177384c4d1d9056c1fa6abede3a9fe5e
            • MD5 SHA1 SHA512
            Submit Download

            installUtilLog.txt
            • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
            • Size 536B
            • SHA256 1d67d94e7c997dd5271200ad14e3ec8c81fd023877b132d7d236460d7d0a1262
            • MD5 SHA1 SHA512
            Submit Download

            installUtilLog.txt
            • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
            • Size 589B
            • SHA256 e97d4ac9b62fbdf03b0a307e6d93e143e8094eec69a42a3b73536d4122b75876
            • MD5 SHA1 SHA512
            Submit Download

            installUtilLog.txt
            • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
            • Size 642B
            • SHA256 959c00542ee8c7b6e3a8724c75b71875576b19c47a137ab73d3ced9d0269f037
            • MD5 SHA1 SHA512
            Submit Download

            installUtilLog.txt
            • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
            • Size 695B
            • SHA256 ed2c0e0d26a644a03f3de4402ac2a43a3affa22d6c3b61416e69d7cd7dab773b
            • MD5 SHA1 SHA512
            Submit Download

            installUtilLog.txt
            • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
            • Size 748B
            • SHA256 7b7c7d8add64fb71c8898f59d0dd67029181e991e0292452ad18cba7f5edce5d
            • MD5 SHA1 SHA512
            Submit Download

            installUtilLog.txt
            • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
            • Size 801B
            • SHA256 585ee8e5f0004357e973e153af3fb1f838025167061bad43f3e87ab6ff114750
            • MD5 SHA1 SHA512
            Submit Download

            installUtilLog.txt
            • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
            • Size 854B
            • SHA256 61dcf33a82722d55f7f265ceed8d8a9855508be8484ed77afebf560c5b138eef
            • MD5 SHA1 SHA512
            Submit Download

            installUtilLog.txt
            • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
            • Size 907B
            • SHA256 9845c099a0f004c453b8cac2cb55083816f6d2baac866f6c40660c074ad019c4
            • MD5 SHA1 SHA512
            Submit Download

            installUtilLog.txt
            • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
            • Size 960B
            • SHA256 481a8a44db9c7ec9cb59bc67f8b978525cd68d2b1e98656723162caf7ddde800
            • MD5 SHA1 SHA512
            Submit Download

            installUtilLog.txt
            • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
            • Size 1013B
            • SHA256 b8b63ba447de79c5c4fa0f9b73f60d0507723fbe25c1e17a115463814ef90bb1
            • MD5 SHA1 SHA512
            Submit Download

            installUtilLog.txt
            • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
            • Size 1KB
            • SHA256 4864358e7d0ff4641c5fe280700588097c830904256265030ca6527ac3085543
            • MD5 SHA1 SHA512
            Submit Download

            installUtilLog.txt
            • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
            • Size 165B
            • SHA256 d5ce3a6b67926e408d06ef7c29e28c5d7399ea9600837fd9ac6dd23ee1ea8fcd
            • MD5 SHA1 SHA512
            Submit Download

            installUtilLog.txt
            • Path C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
            • Size 218B
            • SHA256 41510f625487775e0abd72c6fba915e7f2c2f124c720722d04c3c831aadf402b
            • MD5 SHA1 SHA512
            Submit Download

            tmp885A.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\tmp885A.tmp
            • Size 13.3MB
            • SHA256 b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/704-372-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download

            memory/1136-181-0x00007FFDCE6A0000-0x00007FFDCF161000-memory.dmp
            Download

            memory/1136-173-0x00007FFDCE6A0000-0x00007FFDCF161000-memory.dmp
            Download

            memory/1216-279-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download

            memory/1216-283-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download

            memory/1352-242-0x000001281E730000-0x000001281E740000-memory.dmp
            Download

            memory/1352-239-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download

            memory/1352-244-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download

            memory/1468-79-0x00007FFDCE020000-0x00007FFDCEAE1000-memory.dmp
            Download

            memory/1468-75-0x00007FFDCE020000-0x00007FFDCEAE1000-memory.dmp
            Download

            memory/1980-347-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download

            memory/1980-349-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download

            memory/2640-118-0x00007FFDCE6A0000-0x00007FFDCF161000-memory.dmp
            Download

            memory/2640-114-0x00007FFDCE6A0000-0x00007FFDCF161000-memory.dmp
            Download

            memory/2840-201-0x00007FFDCE6A0000-0x00007FFDCF161000-memory.dmp
            Download

            memory/2840-146-0x00007FFDCE6A0000-0x00007FFDCF161000-memory.dmp
            Download

            memory/2840-197-0x00007FFDCE6A0000-0x00007FFDCF161000-memory.dmp
            Download

            memory/2840-142-0x00007FFDCE6A0000-0x00007FFDCF161000-memory.dmp
            Download

            memory/2972-303-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download

            memory/2972-305-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download

            memory/2984-97-0x00007FFDCE020000-0x00007FFDCEAE1000-memory.dmp
            Download

            memory/2984-101-0x00007FFDCE020000-0x00007FFDCEAE1000-memory.dmp
            Download

            memory/3084-336-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download

            memory/3084-338-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download

            memory/3320-167-0x00007FFDCE6A0000-0x00007FFDCF161000-memory.dmp
            Download

            memory/3320-163-0x00007FFDCE6A0000-0x00007FFDCF161000-memory.dmp
            Download

            memory/3380-0-0x0000025D9C850000-0x0000025D9C888000-memory.dmp
            Download

            memory/3380-2-0x0000025DB6DC0000-0x0000025DB6DD0000-memory.dmp
            Download

            memory/3380-1-0x00007FFDCED00000-0x00007FFDCF7C1000-memory.dmp
            Download

            memory/3380-6-0x00007FFDCED00000-0x00007FFDCF7C1000-memory.dmp
            Download

            memory/3636-225-0x00007FFDCE6A0000-0x00007FFDCF161000-memory.dmp
            Download

            memory/3636-229-0x00007FFDCE6A0000-0x00007FFDCF161000-memory.dmp
            Download

            memory/3640-215-0x00007FFDCE6A0000-0x00007FFDCF161000-memory.dmp
            Download

            memory/3640-219-0x00007FFDCE6A0000-0x00007FFDCF161000-memory.dmp
            Download

            memory/3688-11-0x00007FFDCE020000-0x00007FFDCEAE1000-memory.dmp
            Download

            memory/3688-12-0x000001C700100000-0x000001C700110000-memory.dmp
            Download

            memory/3688-68-0x00007FFDCE020000-0x00007FFDCEAE1000-memory.dmp
            Download

            memory/3688-73-0x000001C700100000-0x000001C700110000-memory.dmp
            Download

            memory/3688-91-0x00007FFDCE020000-0x00007FFDCEAE1000-memory.dmp
            Download

            memory/3864-151-0x000001E970420000-0x000001E970430000-memory.dmp
            Download

            memory/3864-148-0x00007FFDCE6A0000-0x00007FFDCF161000-memory.dmp
            Download

            memory/3864-153-0x00007FFDCE6A0000-0x00007FFDCF161000-memory.dmp
            Download

            memory/3868-293-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download

            memory/3868-297-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download

            memory/3888-363-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download

            memory/3888-361-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download

            memory/4168-110-0x00000144E2A70000-0x00000144E2A80000-memory.dmp
            Download

            memory/4168-112-0x00007FFDCE6A0000-0x00007FFDCF161000-memory.dmp
            Download

            memory/4168-107-0x00007FFDCE6A0000-0x00007FFDCF161000-memory.dmp
            Download

            memory/4256-314-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download

            memory/4256-316-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download

            memory/4464-329-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download

            memory/4464-331-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download

            memory/4636-128-0x00007FFDCE6A0000-0x00007FFDCF161000-memory.dmp
            Download

            memory/4636-132-0x00007FFDCE6A0000-0x00007FFDCF161000-memory.dmp
            Download

            memory/4836-187-0x00007FFDCE6A0000-0x00007FFDCF161000-memory.dmp
            Download

            memory/4836-191-0x00007FFDCE6A0000-0x00007FFDCF161000-memory.dmp
            Download

            memory/5008-264-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download

            memory/5008-269-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download

            memory/5008-267-0x0000015B42420000-0x0000015B42430000-memory.dmp
            Download

            memory/5052-350-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download

            memory/5052-356-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download

            memory/5108-256-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download

            memory/5108-258-0x00007FFDCEBD0000-0x00007FFDCF691000-memory.dmp
            Download