Overview

overview

8

Static

static

3

e9e34828dd...d5.exe

windows10-1703-x64

8

e9e34828dd...d5.exe

windows7-x64

8

e9e34828dd...d5.exe

windows10-1703-x64

8

e9e34828dd...d5.exe

windows10-2004-x64

8

e9e34828dd...d5.exe

windows11-21h2-x64

7

Resubmissions

17/04/2024, 11:54

240417-n29fcafd81 8

17/04/2024, 11:54

240417-n285ksdh43 8

17/04/2024, 11:54

240417-n28h2sfd8z 8

17/04/2024, 11:54

240417-n246mafd8x 8

17/04/2024, 11:54

240417-n24j4afd8w 8

16/04/2024, 10:48

240416-mwlxesad2t 8

Analysis

  • max time kernel
    1800s
  • max time network
    1800s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/04/2024, 11:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e9e34828dd3f60d69e3b5ea854a7a06906828cc5cfc8d5906897d2ab3b6765d5.exe

  • Size

    5.3MB

  • MD5

    4a6096deaaaf3fe393b61d66540ce4ab

  • SHA1

    9f91f6feae419a73a3371e06206b5e459281cff0

  • SHA256

    e9e34828dd3f60d69e3b5ea854a7a06906828cc5cfc8d5906897d2ab3b6765d5

  • SHA512

    9322c12a042ef7914bedf73618b135775f99bcc352e23b606e6887f1e7843bda3fb9025a06eefb4bd1468a69565f6f8d34bacf0d0fcbd4ee7c34cd46c96e6d01

  • SSDEEP

    98304:GBze+DWzwgfjGmMdivlucHq81K0U4DzRtNCC6rYOALRiNKpRyE3Rb1:4ze9cidud8pUSzpXOALRi4pT91

Score
8/10
discoveryevasion

Malware Config

Signatures

  • Contacts a large (1044) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Modifies Windows Firewall 2 TTPs 22 IoCs
    evasion
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Drops file in System32 directory 31 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\e9e34828dd3f60d69e3b5ea854a7a06906828cc5cfc8d5906897d2ab3b6765d5.exe
    "C:\Users\Admin\AppData\Local\Temp\e9e34828dd3f60d69e3b5ea854a7a06906828cc5cfc8d5906897d2ab3b6765d5.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2232
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4660
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4816
    • C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
      2⤵
      • Creates scheduled task(s)
      PID:5076
    • C:\Windows\System\svchost.exe
      "C:\Windows\System\svchost.exe" formal
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:1224
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3600
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3548
      • C:\Users\Admin\AppData\Local\Temp\~tl9A2A.tmp
        C:\Users\Admin\AppData\Local\Temp\~tl9A2A.tmp
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4452
        • C:\Windows\SYSTEM32\netsh.exe
          netsh int ipv4 set dynamicport tcp start=1025 num=64511
          4⤵
            PID:4820
          • C:\Windows\System32\netsh.exe
            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
            4⤵
            • Modifies Windows Firewall
            PID:2044
          • C:\Windows\System32\netsh.exe
            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
            4⤵
            • Modifies Windows Firewall
            PID:1604
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3248
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5068
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /delete /TN "Timer"
            4⤵
              PID:4920
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
              4⤵
              • Creates scheduled task(s)
              PID:1476
            • C:\Windows\System\svchost.exe
              "C:\Windows\System\svchost.exe" formal
              4⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2196
              • C:\Windows\SYSTEM32\netsh.exe
                netsh int ipv4 set dynamicport tcp start=1025 num=64511
                5⤵
                  PID:2540
                • C:\Windows\System32\netsh.exe
                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                  5⤵
                  • Modifies Windows Firewall
                  PID:3524
                • C:\Windows\System32\netsh.exe
                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                  5⤵
                  • Modifies Windows Firewall
                  PID:212
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                  5⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3916
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                  5⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3428
                • C:\Users\Admin\AppData\Local\Temp\~tl7055.tmp
                  C:\Users\Admin\AppData\Local\Temp\~tl7055.tmp
                  5⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:1004
                  • C:\Windows\SYSTEM32\netsh.exe
                    netsh int ipv4 set dynamicport tcp start=1025 num=64511
                    6⤵
                      PID:448
                    • C:\Windows\System32\netsh.exe
                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                      6⤵
                      • Modifies Windows Firewall
                      PID:4188
                    • C:\Windows\System32\netsh.exe
                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                      6⤵
                      • Modifies Windows Firewall
                      PID:1992
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                      6⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1008
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                      6⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1988
          • \??\c:\windows\system\svchost.exe
            c:\windows\system\svchost.exe
            1⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4532
            • C:\Windows\system32\netsh.exe
              netsh int ipv4 set dynamicport tcp start=1025 num=64511
              2⤵
                PID:5096
              • C:\Windows\System32\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                2⤵
                • Modifies Windows Firewall
                PID:2332
              • C:\Windows\System32\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                2⤵
                • Modifies Windows Firewall
                PID:4796
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                2⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4256
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                2⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4832
              • C:\Windows\TEMP\~tlCD45.tmp
                C:\Windows\TEMP\~tlCD45.tmp
                2⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                PID:2864
                • C:\Windows\system32\netsh.exe
                  netsh int ipv4 set dynamicport tcp start=1025 num=64511
                  3⤵
                    PID:2180
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                    3⤵
                    • Modifies Windows Firewall
                    PID:5000
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                    3⤵
                    • Modifies Windows Firewall
                    PID:4124
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                    3⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3156
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                    3⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1132
              • \??\c:\windows\system\svchost.exe
                c:\windows\system\svchost.exe
                1⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                PID:1328
                • C:\Windows\system32\netsh.exe
                  netsh int ipv4 set dynamicport tcp start=1025 num=64511
                  2⤵
                    PID:2572
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                    2⤵
                    • Modifies Windows Firewall
                    PID:2688
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                    2⤵
                    • Modifies Windows Firewall
                    PID:624
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                    2⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4792
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                    2⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1884
                  • C:\Windows\TEMP\~tl350B.tmp
                    C:\Windows\TEMP\~tl350B.tmp
                    2⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3584
                    • C:\Windows\system32\netsh.exe
                      netsh int ipv4 set dynamicport tcp start=1025 num=64511
                      3⤵
                        PID:3524
                      • C:\Windows\System32\netsh.exe
                        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                        3⤵
                        • Modifies Windows Firewall
                        PID:1772
                      • C:\Windows\System32\netsh.exe
                        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                        3⤵
                        • Modifies Windows Firewall
                        PID:4936
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                        3⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:320
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                        3⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4104
                  • \??\c:\windows\system\svchost.exe
                    c:\windows\system\svchost.exe
                    1⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4216
                    • C:\Windows\system32\netsh.exe
                      netsh int ipv4 set dynamicport tcp start=1025 num=64511
                      2⤵
                        PID:4872
                      • C:\Windows\System32\netsh.exe
                        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                        2⤵
                        • Modifies Windows Firewall
                        PID:2196
                      • C:\Windows\System32\netsh.exe
                        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                        2⤵
                        • Modifies Windows Firewall
                        PID:4816
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                        2⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2308
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                        2⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4812
                      • C:\Windows\TEMP\~tl9BB7.tmp
                        C:\Windows\TEMP\~tl9BB7.tmp
                        2⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3264
                        • C:\Windows\system32\netsh.exe
                          netsh int ipv4 set dynamicport tcp start=1025 num=64511
                          3⤵
                            PID:516
                          • C:\Windows\System32\netsh.exe
                            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                            3⤵
                            • Modifies Windows Firewall
                            PID:4296
                          • C:\Windows\System32\netsh.exe
                            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                            3⤵
                            • Modifies Windows Firewall
                            PID:1892
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                            3⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4848
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                            3⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2628
                      • \??\c:\windows\system\svchost.exe
                        c:\windows\system\svchost.exe
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Drops file in Windows directory
                        PID:5052
                        • C:\Windows\system32\netsh.exe
                          netsh int ipv4 set dynamicport tcp start=1025 num=64511
                          2⤵
                            PID:2228
                          • C:\Windows\System32\netsh.exe
                            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                            2⤵
                            • Modifies Windows Firewall
                            PID:4376
                          • C:\Windows\System32\netsh.exe
                            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                            2⤵
                            • Modifies Windows Firewall
                            PID:1856
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                            2⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2572
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                            2⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4456
                          • C:\Windows\TEMP\~tl2C0.tmp
                            C:\Windows\TEMP\~tl2C0.tmp
                            2⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            PID:1316
                            • C:\Windows\system32\netsh.exe
                              netsh int ipv4 set dynamicport tcp start=1025 num=64511
                              3⤵
                                PID:3188
                              • C:\Windows\System32\netsh.exe
                                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                3⤵
                                • Modifies Windows Firewall
                                PID:1980
                              • C:\Windows\System32\netsh.exe
                                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                3⤵
                                • Modifies Windows Firewall
                                PID:996
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                3⤵
                                • Drops file in System32 directory
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2272
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                3⤵
                                • Drops file in System32 directory
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1600

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                            Filesize

                            2KB

                            MD5

                            d85ba6ff808d9e5444a4b369f5bc2730

                            SHA1

                            31aa9d96590fff6981b315e0b391b575e4c0804a

                            SHA256

                            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                            SHA512

                            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            944B

                            MD5

                            6f3b96b24f06e2d37a46e43e8b784f56

                            SHA1

                            7be6702c5867f359e913eeeecdd5b76698589295

                            SHA256

                            8e386afeed28e1d282d9a0294dd2e9402dcb807f7c77aca8426314c20057e720

                            SHA512

                            d760999531a77a9adf2b4dc019ce3b43ac3a8cad825398b3a09818afe8deaa177d37219a26dd8a432c00c9cff7858efc43cae2375edc996bb0136c92c39c9dfb

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            610B

                            MD5

                            d63c5c98464d021eb3e174c072153501

                            SHA1

                            c11f25917cc4c33e8ee1d527c831cf00ffa65348

                            SHA256

                            52a123036f722f403fe0f04b648dd685d53b12a1b1336ee43963dd8e66cd2144

                            SHA512

                            85ef0ee1f001ceb7498397605a503ced309d7e9e8ab79ce607051109b45b738e7cf20d7b7b93b9fc2e2f5c4a739c1dcdb0cde5abae4bddda66f772e844583c92

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            944B

                            MD5

                            54522d22658e4f8f87ecb947b71b8feb

                            SHA1

                            6a6144bdf9c445099f52211b6122a2ecf72b77e9

                            SHA256

                            af18fc4864bc2982879aed928c960b6266f372c928f8c9632c5a4eecd64e448a

                            SHA512

                            55f2c5a455be20dcb4cb93a29e5389e0422237bdd7ac40112fec6f16a36e5e19df50d25d39a6d5acb2d41a96514c7ecd8631ce8e67c4ff04997282f49d947aba

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            944B

                            MD5

                            993af531f0b57e8128ec273731c3a8e2

                            SHA1

                            a42ea55876f4f390837dd2c95fb7ff2344b6e9e1

                            SHA256

                            fff934d70d813381536d272c5b8ac6ad70acd054267b13592da767c9bd1dda62

                            SHA512

                            bdf5970ff2ee314dc297fce5c0f44765e77acbf269cd9ad9e7448a391d5f80d66a0c5426f99bc3480851e8763413aa180b3b3b6b22ef0e86a365450cb8c334e4

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            944B

                            MD5

                            77d622bb1a5b250869a3238b9bc1402b

                            SHA1

                            d47f4003c2554b9dfc4c16f22460b331886b191b

                            SHA256

                            f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                            SHA512

                            d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            944B

                            MD5

                            d8cb3e9459807e35f02130fad3f9860d

                            SHA1

                            5af7f32cb8a30e850892b15e9164030a041f4bd6

                            SHA256

                            2b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68

                            SHA512

                            045239ba31367fbdd59e883f74eafc05724e23bd6e8f0c1e7171ea2496a497eb9e0cfcb57285bb81c4d569daadba43d6ef64c626ca48f1e2a59e8d97f0cc9184

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fjjgnfbl.ljs.ps1
                            Filesize

                            60B

                            MD5

                            d17fe0a3f47be24a6453e9ef58c94641

                            SHA1

                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                            SHA256

                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                            SHA512

                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\~tl7055.tmp
                            Filesize

                            393KB

                            MD5

                            9dbdd43a2e0b032604943c252eaf634a

                            SHA1

                            9584dc66f3c1cce4210fdf827a1b4e2bb22263af

                            SHA256

                            33c53cd5265502e7b62432dba0e1b5ed702b5007cc79973ccd1e71b2acc01e86

                            SHA512

                            b7b20b06dac952a96eda254bad29966fe7a4f827912beb0bc66d5af5b302d7c0282d70c1b01ff782507dd03a1d58706f05cb157521c7f2887a43085ffe5f94d1

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\~tl9A2A.tmp
                            Filesize

                            385KB

                            MD5

                            e802c96760e48c5139995ffb2d891f90

                            SHA1

                            bba3d278c0eb1094a26e5d2f4c099ad685371578

                            SHA256

                            cb82ea45a37f8f79d10726a7c165aa5b392b68d5ac954141129c1762a539722c

                            SHA512

                            97300ac501be6b6ea3ac1915361dd472824fe612801cab8561a02c7df071b1534190d2d5ef872d89d24c8c915b88101e7315f948f53215c2538d661181e3a5f0

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
                            Filesize

                            2.6MB

                            MD5

                            8c8bc1908db7ac54e1dd393839811249

                            SHA1

                            00d3e7d05a0abd7dd8d764a13a90d027c06382a4

                            SHA256

                            b684399e3c8c9fe286edc15d8a6e14ea9ae7795ea7b5371865140e50fb678b3a

                            SHA512

                            438d374c3c0ba6db776767906f8ee5cadc4e6042c26f2da4715049f697a7d63e7d178c0e191b8edf91ed1e401401f813c34cd66c0f0b9911826d0b913f3de6d4

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
                            Filesize

                            10.0MB

                            MD5

                            e631702eebc9a1ac0ded631341c44d3c

                            SHA1

                            fd7cf0053fc873b417a56e91e0041e5fc1974c8c

                            SHA256

                            9162c78b3306871e0cd38b2cdf297fa2b112e1f3f1cd8994bcd0592149d5a389

                            SHA512

                            b894bd360959aa5edac38df676b5619acb60e50ac228248f32b27e86a9dd790ba171f8aad8163046e61726229f741804b44ff2aee0ec9b96a2c3c1e7c9cc6c69

                            Download Submit

                          • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output1[1].jpg
                            Filesize

                            393KB

                            MD5

                            72e28e2092a43e0d70289f62bec20e65

                            SHA1

                            944f2b81392ee946f4767376882c5c1bda6dddb5

                            SHA256

                            6ec8fe67dc01d8c3de9cfc94ca49ae25e46ed61f5a48f1a956ef269efa4ae08f

                            SHA512

                            31c0587cd1df4d63088973d72a015b144b64411031ac4c1904c54c4f43b5990b8016cc6d29e3b0238f86432005588c72b98806306918fdaf2786498de340e466

                            Download Submit

                          • C:\Windows\System\svchost.exe
                            Filesize

                            5.3MB

                            MD5

                            4a6096deaaaf3fe393b61d66540ce4ab

                            SHA1

                            9f91f6feae419a73a3371e06206b5e459281cff0

                            SHA256

                            e9e34828dd3f60d69e3b5ea854a7a06906828cc5cfc8d5906897d2ab3b6765d5

                            SHA512

                            9322c12a042ef7914bedf73618b135775f99bcc352e23b606e6887f1e7843bda3fb9025a06eefb4bd1468a69565f6f8d34bacf0d0fcbd4ee7c34cd46c96e6d01

                            Download Submit

                          • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                            Filesize

                            4KB

                            MD5

                            bdb25c22d14ec917e30faf353826c5de

                            SHA1

                            6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

                            SHA256

                            e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

                            SHA512

                            b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

                            Download Submit

                          • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            1KB

                            MD5

                            69dec12ec55ab48557c7057f40548039

                            SHA1

                            c92a0b6a9348486eb56fce6874dc3452a2b2656d

                            SHA256

                            3d8e595271f4ff79b5afba961d77eeddc75212a239262809fa19e4589d3842f7

                            SHA512

                            4d59a16eed2cfc369d42c9bf0d6cdcf562801f1c59493e910c78b90eacd6682f0ca0b22643dad450c802349927ace8c9822c8737e5d24a1b5a9ddd0fdbcac062

                            Download Submit

                          • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            1KB

                            MD5

                            3170376a78b538d863582b2f92fcf0ff

                            SHA1

                            dbe3de94e1ee2977dcae2b6248bf38de3c1277e4

                            SHA256

                            aeb3160de74fc1b2f357ab6c3a22005cc6c74f1604297d558e76910764cf1c79

                            SHA512

                            3076961eca457e4ac3742bfc17f368f9a7a729ffcab2ea650f7771fe14921ff61b01eb5221cc845bbed6acbfe854984db9d6b907b7f7cca7cda1efde6cd9f331

                            Download Submit

                          • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            1KB

                            MD5

                            2722730a0cf82161fb1452b600334796

                            SHA1

                            4479415f50cd9ab55c4f7bcdc1a0a5177492f053

                            SHA256

                            a44ba59eb52b4d6555065fa840ac7162080eb538e6b6a47198fe4961d0297833

                            SHA512

                            54ec97b79003db56fb1ca44b33a1c2a9748014a3c1dc84fdb2afca84d3c6618ad88ccb353d52078789e3e0ed0ee6c763a74bf34cea1334e427a264db9171dfb0

                            Download Submit

                          • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            120B

                            MD5

                            e507c20344f6707b72ea3a4899b771a3

                            SHA1

                            a1a73293571099e873d019eac1204d8aafdafeb6

                            SHA256

                            83642b5c4d8bad8adcca132bc44ab7c57b4df3f75464c4515acf9c4b6bdcf6d9

                            SHA512

                            d426af7c4baf513bddd87d334b222e7bae4c7ff01d994d9f55afad82159263cda945810e728ddd3fe4fc674473a04957d9c5d198f84aaae2c67725793f365cea

                            Download Submit

                          • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            1KB

                            MD5

                            45482e2e4287bbe4b255fadb24c502db

                            SHA1

                            0e79bd503529d4cfd5eb32ff9d0eccec1b5f630d

                            SHA256

                            781e701b97cac7ef3e9f48fabaa9d8587db8fa6978f0d7d3c3f052ac4817d053

                            SHA512

                            ff396d43090289cb577f559b045ea25bbdfd18606dbc8c3ffa8d3e0b8478cce68cc9628ffd202dd6a6271a1f9dfc6fe277b06350bb1976cc61f35ec71d8d6c9a

                            Download Submit

                          • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            496B

                            MD5

                            6ffa365eace8d26c8f67e090a709238c

                            SHA1

                            0c8651e65afd8c4b1112c352cdfc6139726f7c95

                            SHA256

                            24ed3ee95e67e4468769fae76b8068e52a57c0db28cd43e6059fc7d78a6b6f21

                            SHA512

                            88058b21c5a82c6231cd5831c09be4776da194f9603d54a780d99ddc4f8281f0e7af5bb6c967d85f1433db8e937f0ff3c58e6a37209b1bfca3bb1bab07fc309e

                            Download Submit

                          • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            1KB

                            MD5

                            6714d2ce29e2b80c6ec82827abecc844

                            SHA1

                            c5316f2b4b4a073e25a694e20d7ee47441d459fc

                            SHA256

                            085cf746903ae4fe3be49a9ef382f64cc09d7cec88789f9c207c9e2886c53e9b

                            SHA512

                            93d8275ca299d01c41c4a1e7077c2a1c22e6a017962d3aab60411dfa59d05144f170a01eae278dad64da55f3dba57d2a2986d8bcbb4c48e018652f1b0dae90f7

                            Download Submit

                          • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            1KB

                            MD5

                            82bbcf177565b5180851a77ade22aabe

                            SHA1

                            5ebe3372404467c45f4bdab221b6daf9243ce908

                            SHA256

                            6ed3b8e5aad03e1bbf6eea15fc980c3f7e329844a3559acab5c6b6717a792ddc

                            SHA512

                            ffdbde21a54edc6ae309f22a6d2acfd26958fb4e913d1a4f8a11dde41cf4a68376a148a0eb0f07a63a4080d108a10c5b26dfbd765c69e7fd4486d161f182665c

                            Download Submit

                          • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            1KB

                            MD5

                            24ff013da87d554289a5c22df5ef0ba6

                            SHA1

                            ad9b3dcc61e36d3c4ae48aa525ee909e96d772f0

                            SHA256

                            2dcac5dc219be612958e09ed071814f16577036ab8d042a47920d0633b2e7886

                            SHA512

                            2cd76c321f4f0d31b42ecc00cfd4f982bd7def26c71ec01b6bd04244e6051f002be7ed851dd4bea6589f04f278ac5cf685f31d12398f7e28482e23f16b7cd2d6

                            Download Submit

                          • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            1KB

                            MD5

                            6494311bccf8e3d2d71012d83579d25d

                            SHA1

                            6506537ba1cdae2d53537fee1e773b70a362952b

                            SHA256

                            7886bd67277429059000b622d932e1a177e9677690a8e2c27d7bcb168da96388

                            SHA512

                            159810bfbf60a017bd9fbf877f96bc0c1621461020a8b59173a69f45880e4689a3a324b38b19e04c6e00a2a8467e23d14aa3f9d9e00a9c290ed9950c64f94e2f

                            Download Submit

                          • memory/1004-217-0x0000000140000000-0x0000000140170400-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/1004-216-0x0000000140000000-0x0000000140170400-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/1004-215-0x0000000140000000-0x0000000140170400-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/1004-214-0x0000000140000000-0x0000000140170400-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/1004-212-0x0000000140000000-0x0000000140170400-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/1004-248-0x0000000140000000-0x0000000140170400-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/1008-219-0x00000289F82B0000-0x00000289F82C0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/1008-243-0x00007FFDD1D10000-0x00007FFDD27D1000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/1008-218-0x00007FFDD1D10000-0x00007FFDD27D1000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/1132-386-0x000001BBCD4E0000-0x000001BBCD6FC000-memory.dmp

                            Filesize

                            2.1MB

                            Download

                          • memory/1224-72-0x000000003B4B0000-0x000000003B9AC000-memory.dmp

                            Filesize

                            5.0MB

                            Download

                          • memory/1224-40-0x0000000140000000-0x0000000140647000-memory.dmp

                            Filesize

                            6.3MB

                            Download

                          • memory/1224-126-0x0000000140000000-0x0000000140647000-memory.dmp

                            Filesize

                            6.3MB

                            Download

                          • memory/1224-87-0x0000000140000000-0x0000000140647000-memory.dmp

                            Filesize

                            6.3MB

                            Download

                          • memory/1988-232-0x00000235AF150000-0x00000235AF160000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/1988-230-0x00007FFDD1D10000-0x00007FFDD27D1000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/1988-231-0x00000235AF150000-0x00000235AF160000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/1988-246-0x00007FFDD1D10000-0x00007FFDD27D1000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/2196-171-0x0000000140000000-0x000000014015E400-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/2196-172-0x0000000140000000-0x000000014015E400-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/2196-174-0x0000000140000000-0x000000014015E400-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/2196-213-0x0000000140000000-0x000000014015E400-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/2232-0-0x0000000140000000-0x0000000140647000-memory.dmp

                            Filesize

                            6.3MB

                            Download

                          • memory/2232-41-0x0000000140000000-0x0000000140647000-memory.dmp

                            Filesize

                            6.3MB

                            Download

                          • memory/2864-334-0x0000000140000000-0x0000000140170400-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/2864-395-0x0000000140000000-0x0000000140170400-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/3156-390-0x0000028FEAEC0000-0x0000028FEB0DC000-memory.dmp

                            Filesize

                            2.1MB

                            Download

                          • memory/3248-157-0x00007FFDD1D10000-0x00007FFDD27D1000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/3248-132-0x000002063DF20000-0x000002063DF30000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/3248-133-0x000002063DF20000-0x000002063DF30000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/3248-131-0x00007FFDD1D10000-0x00007FFDD27D1000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/3428-190-0x0000024BF38D0000-0x0000024BF38E0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/3428-188-0x00007FFDD1D10000-0x00007FFDD27D1000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/3428-204-0x00007FFDD1D10000-0x00007FFDD27D1000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/3428-189-0x0000024BF38D0000-0x0000024BF38E0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/3548-63-0x00007FFDD1410000-0x00007FFDD1ED1000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/3548-65-0x00000183BBCF0000-0x00000183BBD00000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/3548-66-0x00000183BBCF0000-0x00000183BBD00000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/3548-70-0x00007FFDD1410000-0x00007FFDD1ED1000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/3600-51-0x00007FFDD1410000-0x00007FFDD1ED1000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/3600-52-0x0000022AFA590000-0x0000022AFA5A0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/3600-64-0x0000022AFA590000-0x0000022AFA5A0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/3600-71-0x00007FFDD1410000-0x00007FFDD1ED1000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/3916-187-0x000001E087380000-0x000001E087390000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/3916-186-0x000001E087380000-0x000001E087390000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/3916-185-0x00007FFDD1D10000-0x00007FFDD27D1000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/3916-201-0x00007FFDD1D10000-0x00007FFDD27D1000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/4256-291-0x0000016AB09E0000-0x0000016AB09FC000-memory.dmp

                            Filesize

                            112KB

                            Download

                          • memory/4256-281-0x00007FF4AB820000-0x00007FF4AB830000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/4256-316-0x0000016AB0420000-0x0000016AB063C000-memory.dmp

                            Filesize

                            2.1MB

                            Download

                          • memory/4256-304-0x0000016AB0AC0000-0x0000016AB0ACA000-memory.dmp

                            Filesize

                            40KB

                            Download

                          • memory/4256-294-0x0000016AB0A00000-0x0000016AB0AB5000-memory.dmp

                            Filesize

                            724KB

                            Download

                          • memory/4256-259-0x00007FFDD1D10000-0x00007FFDD27D1000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/4256-260-0x0000016A97D70000-0x0000016A97D80000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/4256-292-0x0000016A97D70000-0x0000016A97D80000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/4452-128-0x0000000140000000-0x000000014015E400-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/4452-173-0x0000000140000000-0x000000014015E400-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/4452-127-0x0000000140000000-0x000000014015E400-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/4452-130-0x0000000140000000-0x000000014015E400-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/4452-129-0x0000000140000000-0x000000014015E400-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/4452-125-0x0000000140000000-0x000000014015E400-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/4532-255-0x0000000140000000-0x000000014015E400-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/4532-256-0x0000000140000000-0x000000014015E400-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/4532-329-0x0000000140000000-0x000000014015E400-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/4532-258-0x0000000140000000-0x000000014015E400-memory.dmp

                            Filesize

                            1.4MB

                            Download

                          • memory/4660-30-0x00007FFDD1410000-0x00007FFDD1ED1000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/4660-11-0x00007FFDD1410000-0x00007FFDD1ED1000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/4660-21-0x0000026048260000-0x0000026048270000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/4816-31-0x00007FFDD1410000-0x00007FFDD1ED1000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/4816-1-0x000001BBEFCE0000-0x000001BBEFD02000-memory.dmp

                            Filesize

                            136KB

                            Download

                          • memory/4816-22-0x00007FFDD1410000-0x00007FFDD1ED1000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/4816-24-0x000001BBEDB60000-0x000001BBEDB70000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/4816-23-0x000001BBEDB60000-0x000001BBEDB70000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/4832-270-0x00007FFDD1D10000-0x00007FFDD27D1000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/4832-317-0x000002A268750000-0x000002A26896C000-memory.dmp

                            Filesize

                            2.1MB

                            Download

                          • memory/4832-305-0x000002A268F30000-0x000002A268F4C000-memory.dmp

                            Filesize

                            112KB

                            Download

                          • memory/4832-271-0x000002A268740000-0x000002A268750000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/4832-293-0x00007FF4E2EF0000-0x00007FF4E2F00000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/4832-306-0x000002A268F10000-0x000002A268F1A000-memory.dmp

                            Filesize

                            40KB

                            Download

                          • memory/5068-160-0x00007FFDD1D10000-0x00007FFDD27D1000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/5068-146-0x000001F230100000-0x000001F230110000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/5068-145-0x000001F230100000-0x000001F230110000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/5068-144-0x00007FFDD1D10000-0x00007FFDD27D1000-memory.dmp

                            Filesize

                            10.8MB

                            Download