e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c

Resubmissions

17/04/2024, 12:24

240417-pljenaef838

17/04/2024, 12:24

17/04/2024, 12:24

17/04/2024, 12:24

17/04/2024, 12:24

16/04/2024, 14:05

Analysis

max time kernel
1199s
max time network
1201s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
Size 5.3MB
Sample240417-plfc1aef75
SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
MD5 2e9e23fa8bcd5a77540acf53fd9eb0cb
SHA1 d59c9734a57d44b70c576214333b1cc3dd19ccdc
SHA512 a40c6908bc3a8279e1fbffbe52a49374e780ec7eea29e89c8746ec58514de252b0cbf8f61332240be51a209205548443f68890ffa44590e6ab1cd543a1800112
SSDEEP 98304:lQXWMzCvX6rbPny4EsfdRokAV+tM+yf4K1lMJulKu4y3MDOJrzhmmyijh44FNbJv:lQXWPX6rvfdRogF9lI0yjm4koBX
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 10 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1824	netsh.exe
584	netsh.exe
1300	netsh.exe
648	netsh.exe
968	netsh.exe
2460	netsh.exe
988	netsh.exe
2456	netsh.exe
2640	netsh.exe
2848	netsh.exe

Executes dropped EXE 7 IoCs

pid	Process
2944	svchost.exe
1680	svchost.exe
2388	~tl8F45.tmp
1608	svchost.exe
880	~tl6529.tmp
2144	svchost.exe
3000	~tl311F.tmp

Loads dropped DLL 12 IoCs

pid	Process
2360	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
2360	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
2244	taskeng.exe
2944	svchost.exe
2944	svchost.exe
2388	~tl8F45.tmp
2388	~tl8F45.tmp
1608	svchost.exe
1608	svchost.exe
1888	taskeng.exe
2144	svchost.exe
2144	svchost.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\getlog[1].htm	svchost.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\output1[1].jpg	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\getlog[2].htm	~tl311F.tmp
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	~tl311F.tmp
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\getlog[1].htm	~tl311F.tmp
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	~tl8F45.tmp
File opened for modification	C:\Windows\System\svchost.exe	~tl8F45.tmp
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File created	C:\Windows\System\svchost.exe	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File opened for modification	C:\Windows\System\svchost.exe	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2500	schtasks.exe
1264	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 90a672fad090da01	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0140000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	~tl311F.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	~tl311F.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{67CF2435-589E-4286-B957-87CFD716836C}\WpadDecision = "0"	~tl311F.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{67CF2435-589E-4286-B957-87CFD716836C}\WpadNetworkName = "Network 3"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	~tl311F.tmp
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-bc-3c-1a-53-30\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{6C467336-8281-4E60-8204-430CED96822D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000505351fad090da01	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0140000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	~tl311F.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-bc-3c-1a-53-30\WpadDetectedUrl	~tl311F.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{67CF2435-589E-4286-B957-87CFD716836C}\WpadDecisionTime = d0004803d190da01	~tl311F.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{67CF2435-589E-4286-B957-87CFD716836C}\WpadDecisionReason = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	~tl311F.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-bc-3c-1a-53-30\WpadDecisionReason = "1"	~tl311F.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0140000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	~tl311F.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	~tl311F.tmp
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{67CF2435-589E-4286-B957-87CFD716836C}\8e-bc-3c-1a-53-30	~tl311F.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-bc-3c-1a-53-30\WpadDecisionTime = d0004803d190da01	~tl311F.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{67CF2435-589E-4286-B957-87CFD716836C}\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-bc-3c-1a-53-30	~tl311F.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-bc-3c-1a-53-30\WpadDecisionTime = 901bdaf0d090da01	~tl311F.tmp
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{67CF2435-589E-4286-B957-87CFD716836C}	~tl311F.tmp
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-bc-3c-1a-53-30\WpadDecisionTime = 901bdaf0d090da01	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-bc-3c-1a-53-30\WpadDecision = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	~tl311F.tmp
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	~tl311F.tmp
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{67CF2435-589E-4286-B957-87CFD716836C}\WpadDecisionReason = "1"	~tl311F.tmp
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0"	netsh.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2660	powershell.exe
2856	powershell.exe
2360	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
1684	powershell.exe
1548	powershell.exe
2388	~tl8F45.tmp
2488	powershell.exe
2924	powershell.exe
2388	~tl8F45.tmp
1608	svchost.exe
2236	powershell.exe
952	powershell.exe
880	~tl6529.tmp
2612	powershell.exe
2676	powershell.exe
2144	svchost.exe
1840	powershell.exe
1484	powershell.exe
3000	~tl311F.tmp
2528	powershell.exe
2620	powershell.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	1684	powershell.exe
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeDebugPrivilege	2236	powershell.exe
Token: SeDebugPrivilege	952	powershell.exe
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeDebugPrivilege	2676	powershell.exe
Token: SeDebugPrivilege	1840	powershell.exe
Token: SeDebugPrivilege	1484	powershell.exe
Token: SeDebugPrivilege	2528	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2660	2360	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	28
PID 2360 wrote to memory of 2660	2360	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	28
PID 2360 wrote to memory of 2660	2360	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	28
PID 2360 wrote to memory of 2856	2360	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	30
PID 2360 wrote to memory of 2856	2360	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	30
PID 2360 wrote to memory of 2856	2360	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	30
PID 2360 wrote to memory of 2500	2360	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	32
PID 2360 wrote to memory of 2500	2360	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	32
PID 2360 wrote to memory of 2500	2360	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	32
PID 2360 wrote to memory of 2944	2360	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	34
PID 2360 wrote to memory of 2944	2360	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	34
PID 2360 wrote to memory of 2944	2360	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	34
PID 2944 wrote to memory of 1548	2944	svchost.exe	37
PID 2944 wrote to memory of 1548	2944	svchost.exe	37
PID 2944 wrote to memory of 1548	2944	svchost.exe	37
PID 2944 wrote to memory of 1684	2944	svchost.exe	39
PID 2944 wrote to memory of 1684	2944	svchost.exe	39
PID 2944 wrote to memory of 1684	2944	svchost.exe	39
PID 2244 wrote to memory of 1680	2244	taskeng.exe	42
PID 2244 wrote to memory of 1680	2244	taskeng.exe	42
PID 2244 wrote to memory of 1680	2244	taskeng.exe	42
PID 2944 wrote to memory of 2388	2944	svchost.exe	43
PID 2944 wrote to memory of 2388	2944	svchost.exe	43
PID 2944 wrote to memory of 2388	2944	svchost.exe	43
PID 2388 wrote to memory of 2572	2388	~tl8F45.tmp	46
PID 2388 wrote to memory of 2572	2388	~tl8F45.tmp	46
PID 2388 wrote to memory of 2572	2388	~tl8F45.tmp	46
PID 2388 wrote to memory of 2848	2388	~tl8F45.tmp	48
PID 2388 wrote to memory of 2848	2388	~tl8F45.tmp	48
PID 2388 wrote to memory of 2848	2388	~tl8F45.tmp	48
PID 2388 wrote to memory of 2460	2388	~tl8F45.tmp	50
PID 2388 wrote to memory of 2460	2388	~tl8F45.tmp	50
PID 2388 wrote to memory of 2460	2388	~tl8F45.tmp	50
PID 2388 wrote to memory of 2488	2388	~tl8F45.tmp	52
PID 2388 wrote to memory of 2488	2388	~tl8F45.tmp	52
PID 2388 wrote to memory of 2488	2388	~tl8F45.tmp	52
PID 2388 wrote to memory of 2924	2388	~tl8F45.tmp	54
PID 2388 wrote to memory of 2924	2388	~tl8F45.tmp	54
PID 2388 wrote to memory of 2924	2388	~tl8F45.tmp	54
PID 2388 wrote to memory of 812	2388	~tl8F45.tmp	56
PID 2388 wrote to memory of 812	2388	~tl8F45.tmp	56
PID 2388 wrote to memory of 812	2388	~tl8F45.tmp	56
PID 2388 wrote to memory of 1264	2388	~tl8F45.tmp	58
PID 2388 wrote to memory of 1264	2388	~tl8F45.tmp	58
PID 2388 wrote to memory of 1264	2388	~tl8F45.tmp	58
PID 2388 wrote to memory of 1608	2388	~tl8F45.tmp	60
PID 2388 wrote to memory of 1608	2388	~tl8F45.tmp	60
PID 2388 wrote to memory of 1608	2388	~tl8F45.tmp	60
PID 1608 wrote to memory of 940	1608	svchost.exe	62
PID 1608 wrote to memory of 940	1608	svchost.exe	62
PID 1608 wrote to memory of 940	1608	svchost.exe	62
PID 1608 wrote to memory of 1824	1608	svchost.exe	64
PID 1608 wrote to memory of 1824	1608	svchost.exe	64
PID 1608 wrote to memory of 1824	1608	svchost.exe	64
PID 1608 wrote to memory of 584	1608	svchost.exe	65
PID 1608 wrote to memory of 584	1608	svchost.exe	65
PID 1608 wrote to memory of 584	1608	svchost.exe	65
PID 1608 wrote to memory of 2236	1608	svchost.exe	68
PID 1608 wrote to memory of 2236	1608	svchost.exe	68
PID 1608 wrote to memory of 2236	1608	svchost.exe	68
PID 1608 wrote to memory of 952	1608	svchost.exe	70
PID 1608 wrote to memory of 952	1608	svchost.exe	70
PID 1608 wrote to memory of 952	1608	svchost.exe	70
PID 1608 wrote to memory of 880	1608	svchost.exe	72

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
"C:\Users\Admin\AppData\Local\Temp\e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Windows\system32\schtasks.exe
  schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
  2⤵
  - Creates scheduled task(s)
  PID:2500
- C:\Windows\System\svchost.exe
  "C:\Windows\System\svchost.exe" formal
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1684
- - C:\Users\Admin\AppData\Local\Temp\~tl8F45.tmp
    C:\Users\Admin\AppData\Local\Temp\~tl8F45.tmp
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Windows\system32\netsh.exe
      netsh int ipv4 set dynamicport tcp start=1025 num=64511
      4⤵
      PID:2572
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:2848
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:2460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2488
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2924
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /TN "Timer"
      4⤵
      PID:812
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
      4⤵
      Creates scheduled task(s)
      PID:1264
  - - C:\Windows\System\svchost.exe
      "C:\Windows\System\svchost.exe" formal
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1608
    - - C:\Windows\system32\netsh.exe
        
        netsh int ipv4 set dynamicport tcp start=1025 num=64511
        5⤵
        
        PID:940
    - - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:1824
    - - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:584
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2236
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:952
    - - C:\Users\Admin\AppData\Local\Temp\~tl6529.tmp
        
        C:\Users\Admin\AppData\Local\Temp\~tl6529.tmp
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:880
      - C:\Windows\system32\netsh.exe
        
        netsh int ipv4 set dynamicport tcp start=1025 num=64511
        6⤵
        
        PID:1732
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:988
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:1300
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2612
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2676

C:\Windows\system32\taskeng.exe
taskeng.exe {92BE4BEB-BA68-4668-9772-B9BBDE8881B3} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2244
- \??\c:\windows\system\svchost.exe
  c:\windows\system\svchost.exe
  2⤵
  - Executes dropped EXE
  PID:1680

C:\Windows\system32\taskeng.exe
taskeng.exe {A44545A5-29C6-45EB-BE61-2D0A7758A5DD} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Loads dropped DLL
PID:1888
- \??\c:\windows\system\svchost.exe
  c:\windows\system\svchost.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2144
- - C:\Windows\system32\netsh.exe
    netsh int ipv4 set dynamicport tcp start=1025 num=64511
    3⤵
    - Modifies data under HKEY_USERS
    PID:2236
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Modifies data under HKEY_USERS
    PID:648
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Modifies data under HKEY_USERS
    PID:968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1484
- - C:\Windows\TEMP\~tl311F.tmp
    C:\Windows\TEMP\~tl311F.tmp
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:3000
  - - C:\Windows\system32\netsh.exe
      netsh int ipv4 set dynamicport tcp start=1025 num=64511
      4⤵
      Modifies data under HKEY_USERS
      PID:1960
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Modifies data under HKEY_USERS
      PID:2456
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Modifies data under HKEY_USERS
      PID:2640
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      4⤵
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2528
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      4⤵
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 7d4fbc74f4b3f54c72fce66fe5a1488412e990c9a6c79076faf22e070a223b14
MD5 80207945b9c4cf3948764605c3fa2fc5
SHA1 cf19e0e550bbdb4eb6c15093f908ffc2c695640d
SHA512 de0aeaf70f27bf6b36ac8461604261119605dc9c6c67819f22545c2a49846dc4dec46b1867d062f79af6e04d2b885d058700f403c51a2a50c33d8eb2d4ff11bd
SSDEEP 96:led0PCBM8onqvsqvJCwoied0PCBM8onqvsEHyqvJCwordPK4wQHmHH7RPNXlUVe:800cUol00cAHnordPWLn7RPNx
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 ddbed34cae519c6d15c5f9cc21b22075538b7a3156f0f27a758f05708a5c8d04
MD5 f6d24bf5d9e3554200f161239257658a
SHA1 4081e422157d15ae88748365bfbb91f632acd1e9
SHA512 093ef71e3eef83f54c3636c587840e776c8ed6b2786d0249d6f9b37aed5c93685cdcfac8b38811d2003e7f6be0891c0436b2d851975221ebf627c3dbd4f50a31
SSDEEP 96:led0PCBM8onqvsqvJCwoied0PCBM8onqvsEHyqvJCwordP+4wQHmHH7RPNXlUVe:800cUol00cAHnordPaLn7RPNx
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
Size 2.6MB
SHA256 ed9ec12bba9fded5d2021a7c9f0474e2f09cc7f1b85617d3e789653dd3e581a4
MD5 ce429ca18521f43e55a599bb78c1cc24
SHA1 264524f1bf8939e983069aa7752fd2f66798f7b0
SHA512 f8bc49d99fc4958e96e39331b80ea795c2124048ec9c199bce6b33ecf435a27c53c8b3517142d9a8695b125ee750afb8503fd6de384fd67c7ca2364d6f8999ab
SSDEEP 12288:chg2XX65ugwunc+posCEzibHj4bnKtFDl2I9yRb8rxg2YUSYhG:chgXU9o82nk0REK8rG
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
Size 13.5MB
SHA256 a674d0a9c2b37b616ba70e2fc1a943f2cedb12fea12dd9789076c658b87abea5
MD5 9854d50d2cc45b3d428e2f154e4cea22
SHA1 b4221042f0cfb328949ca4ab58b5b88efe884577
SHA512 9136056e35cc178f00e5b429b196c07a16c60ed08403f1a1dde24ddeb355aaaf3ca70b115522a57e079d1f31bd48c01c5072e00e3ca321b4d3cfa313c98b2a6b
SSDEEP 24576:2HaHorS8zXqDYgk/aH7OiybUYfo+eakQQobi0rW0D4gXkomdjdL/yhF1Uf8kPC4f:aoBAKj9uq3fA9TQ3g+
MD5 SHA1 SHA512 SSDEEP

Submit Download

~tl6529.tmp

Path \Users\Admin\AppData\Local\Temp\~tl6529.tmp
Size 393KB
SHA256 33c53cd5265502e7b62432dba0e1b5ed702b5007cc79973ccd1e71b2acc01e86
MD5 9dbdd43a2e0b032604943c252eaf634a
SHA1 9584dc66f3c1cce4210fdf827a1b4e2bb22263af
SHA512 b7b20b06dac952a96eda254bad29966fe7a4f827912beb0bc66d5af5b302d7c0282d70c1b01ff782507dd03a1d58706f05cb157521c7f2887a43085ffe5f94d1
SSDEEP 6144:GqqLlyLkmSr1MuM3oCQmIKFShtejiIMdeq7Hm72qgdfuF0WSytM86Kp:UcLkRr1p69IKmzjn3dfdyw
MD5 SHA1 SHA512 SSDEEP

Submit Download

~tl8F45.tmp

Path \Users\Admin\AppData\Local\Temp\~tl8F45.tmp
Size 385KB
SHA256 cb82ea45a37f8f79d10726a7c165aa5b392b68d5ac954141129c1762a539722c
MD5 e802c96760e48c5139995ffb2d891f90
SHA1 bba3d278c0eb1094a26e5d2f4c099ad685371578
SHA512 97300ac501be6b6ea3ac1915361dd472824fe612801cab8561a02c7df071b1534190d2d5ef872d89d24c8c915b88101e7315f948f53215c2538d661181e3a5f0
SSDEEP 12288:+Fi5siE46KR5MEvyRy8QCH9oHainZgGTw:+Fqs34vliy8QCaHnnZgGTw
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path \Windows\system\svchost.exe
Size 5.3MB
SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
MD5 2e9e23fa8bcd5a77540acf53fd9eb0cb
SHA1 d59c9734a57d44b70c576214333b1cc3dd19ccdc
SHA512 a40c6908bc3a8279e1fbffbe52a49374e780ec7eea29e89c8746ec58514de252b0cbf8f61332240be51a209205548443f68890ffa44590e6ab1cd543a1800112
SSDEEP 98304:lQXWMzCvX6rbPny4EsfdRokAV+tM+yf4K1lMJulKu4y3MDOJrzhmmyijh44FNbJv:lQXWPX6rvfdRogF9lI0yjm4koBX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/880-204-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/880-207-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/880-232-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/952-190-0x00000000029E0000-0x0000000002A60000-memory.dmp

Download

memory/952-189-0x000007FEF4FC0000-0x000007FEF595D000-memory.dmp

Download

memory/952-188-0x00000000029E0000-0x0000000002A60000-memory.dmp

Download

memory/952-187-0x000007FEF4FC0000-0x000007FEF595D000-memory.dmp

Download

memory/1548-52-0x000000001B640000-0x000000001B922000-memory.dmp

Download

memory/1548-53-0x000007FEF4E10000-0x000007FEF57AD000-memory.dmp

Download

memory/1548-65-0x000007FEF4E10000-0x000007FEF57AD000-memory.dmp

Download

memory/1548-63-0x00000000027A0000-0x0000000002820000-memory.dmp

Download

memory/1548-60-0x00000000027A0000-0x0000000002820000-memory.dmp

Download

memory/1548-58-0x000007FEF4E10000-0x000007FEF57AD000-memory.dmp

Download

memory/1548-56-0x00000000027A0000-0x0000000002820000-memory.dmp

Download

memory/1608-203-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/1608-168-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/1608-166-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/1680-116-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/1680-115-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/1680-113-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/1684-54-0x0000000001F70000-0x0000000001F78000-memory.dmp

Download

memory/1684-57-0x000007FEF4E10000-0x000007FEF57AD000-memory.dmp

Download

memory/1684-59-0x0000000002C30000-0x0000000002CB0000-memory.dmp

Download

memory/1684-61-0x0000000002C30000-0x0000000002CB0000-memory.dmp

Download

memory/1684-62-0x0000000002C30000-0x0000000002CB0000-memory.dmp

Download

memory/1684-64-0x000007FEF4E10000-0x000007FEF57AD000-memory.dmp

Download

memory/1684-55-0x000007FEF4E10000-0x000007FEF57AD000-memory.dmp

Download

memory/2144-280-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/2144-251-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/2236-174-0x000000001B640000-0x000000001B922000-memory.dmp

Download

memory/2236-178-0x0000000002880000-0x0000000002900000-memory.dmp

Download

memory/2236-175-0x000007FEF4FC0000-0x000007FEF595D000-memory.dmp

Download

memory/2236-176-0x0000000002880000-0x0000000002900000-memory.dmp

Download

memory/2236-177-0x000007FEF4FC0000-0x000007FEF595D000-memory.dmp

Download

memory/2236-179-0x0000000002880000-0x0000000002900000-memory.dmp

Download

memory/2236-186-0x000007FEF4FC0000-0x000007FEF595D000-memory.dmp

Download

memory/2236-180-0x0000000002880000-0x0000000002900000-memory.dmp

Download

memory/2360-0-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2360-1-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2360-3-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2360-36-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2360-4-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2388-167-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/2388-127-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/2388-128-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/2388-129-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/2388-126-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/2488-136-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

Download

memory/2488-141-0x0000000002860000-0x00000000028E0000-memory.dmp

Download

memory/2488-140-0x0000000002860000-0x00000000028E0000-memory.dmp

Download

memory/2488-150-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

Download

memory/2488-139-0x0000000002860000-0x00000000028E0000-memory.dmp

Download

memory/2488-138-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

Download

memory/2488-137-0x0000000002860000-0x00000000028E0000-memory.dmp

Download

memory/2488-135-0x000000001B6A0000-0x000000001B982000-memory.dmp

Download

memory/2660-23-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

Download

memory/2660-25-0x0000000002A0B000-0x0000000002A72000-memory.dmp

Download

memory/2660-24-0x0000000002A00000-0x0000000002A80000-memory.dmp

Download

memory/2660-37-0x0000000002A00000-0x0000000002A80000-memory.dmp

Download

memory/2660-20-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

Download

memory/2660-14-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Download

memory/2660-16-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

Download

memory/2660-18-0x0000000002A00000-0x0000000002A80000-memory.dmp

Download

memory/2660-22-0x0000000002A00000-0x0000000002A80000-memory.dmp

Download

memory/2856-17-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

Download

memory/2856-19-0x0000000002CF4000-0x0000000002CF7000-memory.dmp

Download

memory/2856-21-0x0000000002CFB000-0x0000000002D62000-memory.dmp

Download

memory/2856-15-0x0000000001CF0000-0x0000000001CF8000-memory.dmp

Download

memory/2924-151-0x0000000002300000-0x0000000002380000-memory.dmp

Download

memory/2924-147-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

Download

memory/2924-148-0x0000000002300000-0x0000000002380000-memory.dmp

Download

memory/2924-152-0x0000000002300000-0x0000000002380000-memory.dmp

Download

memory/2924-149-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

Download

memory/2924-153-0x000007FEF5470000-0x000007FEF5E0D000-memory.dmp

Download

memory/2944-66-0x0000000010000000-0x00000000104FC000-memory.dmp

Download

memory/2944-125-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/2944-40-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/3000-284-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/3000-302-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/3000-304-0x0000000140000000-0x0000000140170400-memory.dmp

Download