Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Analysis

  • max time kernel
    294s
  • max time network
    294s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    09/05/2024, 22:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe

  • Size

    390KB

  • MD5

    18b50c6016cd5d7ff2f01b71a5e3373b

  • SHA1

    d62dc0a84e39a1fff24163153761c62a55ff30fe

  • SHA256

    18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97

  • SHA512

    27e0017fa30a9322e71191b2c4954d1f55d8fe827f029092fa3bdd6a52e799bbb671a776c3596a1df02d8ebe660b2192f293cb67252ec289bbc99a8725ceaa19

  • SSDEEP

    6144:LlEGEyWKpTlDB878Ed8nFO+tFXFBCorNVDq5GZJrtLK7BYY0g2wqS5e8x:KGEyWERrpdTjZDqeh2Beg28Tx

Score
10/10
dcratgluptebaprivateloadersmokeloaderstealczgratbackdoordiscoverydropperevasionexecutioninfostealerloaderpersistenceransomwareratrootkitspywarestealerthemidatrojanupx

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://cellc.org/tmp/index.php

http://h-c-v.ru/tmp/index.php

http://icebrasilpr.com/tmp/index.php

http://piratia-life.ru/tmp/index.php

http://piratia.su/tmp/index.php
rc4.i32
rc4.i32

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes
  • url_path

    /c698e1bc8a2f5e6d.php

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Detect ZGRat V1 3 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 11 IoCs
  • Modifies firewall policy service 2 TTPs 1 IoCs
    evasion
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 10 IoCs
    evasiontrojan
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Modifies boot configuration data using bcdedit 1 TTPs 14 IoCs
    ransomwareevasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 2 TTPs 4 IoCs
    evasion
  • Possible attempt to disable PatchGuard 2 TTPs

    Rootkits can use kernel patching to embed themselves in an operating system.

    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 8 IoCs
  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 41 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 10 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMon driver. 1 IoCs

    Roottkits write to WinMon to hide PIDs from being detected.

    rootkitevasion
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 4 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 11 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 15 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe
    "C:\Users\Admin\AppData\Local\Temp\18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe"
    1⤵
    • UAC bypass
    • Checks whether UAC is enabled
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2092
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\18d62aa8d04103058203e75fe4039dadb80eb0927ddd23b14f89c984f28aea97.exe" -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2504
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2672
      • C:\Users\Admin\Pictures\2wwXI3oeLrMOsp9XPfocA8Ia.exe
        "C:\Users\Admin\Pictures\2wwXI3oeLrMOsp9XPfocA8Ia.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2500
        • C:\Users\Admin\AppData\Local\Temp\u1xg.0.exe
          "C:\Users\Admin\AppData\Local\Temp\u1xg.0.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:2928
        • C:\Users\Admin\AppData\Local\Temp\u1xg.1.exe
          "C:\Users\Admin\AppData\Local\Temp\u1xg.1.exe"
          4⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:2692
          • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
            "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
            5⤵
            • Loads dropped DLL
            • Suspicious use of AdjustPrivilegeToken
            PID:2816
      • C:\Users\Admin\Pictures\jxAg053Lo3sv6UGxcQTLpnkr.exe
        "C:\Users\Admin\Pictures\jxAg053Lo3sv6UGxcQTLpnkr.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:864
        • C:\Users\Admin\Pictures\jxAg053Lo3sv6UGxcQTLpnkr.exe
          "C:\Users\Admin\Pictures\jxAg053Lo3sv6UGxcQTLpnkr.exe"
          4⤵
          • Windows security bypass
          • Executes dropped EXE
          • Windows security modification
          • Adds Run key to start application
          • Checks for VirtualBox DLLs, possible anti-VM trick
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          PID:292
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            5⤵
              PID:2124
              • C:\Windows\system32\netsh.exe
                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                6⤵
                • Modifies Windows Firewall
                PID:2364
        • C:\Users\Admin\Pictures\NktKANoAJaPSl9alKSXkjYcY.exe
          "C:\Users\Admin\Pictures\NktKANoAJaPSl9alKSXkjYcY.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2856
          • C:\Users\Admin\Pictures\NktKANoAJaPSl9alKSXkjYcY.exe
            "C:\Users\Admin\Pictures\NktKANoAJaPSl9alKSXkjYcY.exe"
            4⤵
            • Windows security bypass
            • Executes dropped EXE
            • Loads dropped DLL
            • Windows security modification
            • Adds Run key to start application
            • Checks for VirtualBox DLLs, possible anti-VM trick
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3048
            • C:\Windows\system32\cmd.exe
              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2612
              • C:\Windows\system32\netsh.exe
                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                6⤵
                • Modifies Windows Firewall
                PID:2912
            • C:\Windows\rss\csrss.exe
              C:\Windows\rss\csrss.exe
              5⤵
              • Drops file in Drivers directory
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Manipulates WinMon driver.
              • Manipulates WinMonFS driver.
              • Drops file in Windows directory
              • Modifies system certificate store
              • Suspicious use of AdjustPrivilegeToken
              PID:448
              • C:\Windows\system32\schtasks.exe
                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                6⤵
                • Creates scheduled task(s)
                PID:1396
              • C:\Windows\system32\schtasks.exe
                schtasks /delete /tn ScheduledUpdate /f
                6⤵
                  PID:2916
                • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                  "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Modifies system certificate store
                  PID:2164
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:2688
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1832
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1680
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1012
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1836
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:2264
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:560
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1612
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1668
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:2968
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:588
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -timeout 0
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1424
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:2008
                • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                  C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                  6⤵
                  • Executes dropped EXE
                  PID:2204
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\Sysnative\bcdedit.exe /v
                  6⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2716
                • C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                  C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                  6⤵
                  • Executes dropped EXE
                  PID:1216
                • C:\Windows\system32\schtasks.exe
                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                  6⤵
                  • Creates scheduled task(s)
                  PID:1068
                • C:\Windows\windefender.exe
                  "C:\Windows\windefender.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:2408
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                    7⤵
                      PID:1620
                      • C:\Windows\SysWOW64\sc.exe
                        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                        8⤵
                        • Launches sc.exe
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2492
            • C:\Users\Admin\Pictures\WX542njaR8VbFU6hKMBkMkcf.exe
              "C:\Users\Admin\Pictures\WX542njaR8VbFU6hKMBkMkcf.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1940
              • C:\Users\Admin\Pictures\WX542njaR8VbFU6hKMBkMkcf.exe
                "C:\Users\Admin\Pictures\WX542njaR8VbFU6hKMBkMkcf.exe"
                4⤵
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Adds Run key to start application
                • Checks for VirtualBox DLLs, possible anti-VM trick
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                PID:1712
                • C:\Windows\system32\cmd.exe
                  C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                  5⤵
                    PID:2952
                    • C:\Windows\system32\netsh.exe
                      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                      6⤵
                      • Modifies Windows Firewall
                      • Modifies data under HKEY_USERS
                      PID:1336
              • C:\Users\Admin\Pictures\Rgyxg4pwPhZf98jJUo06z2X0.exe
                "C:\Users\Admin\Pictures\Rgyxg4pwPhZf98jJUo06z2X0.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2548
                • C:\Users\Admin\Pictures\Rgyxg4pwPhZf98jJUo06z2X0.exe
                  "C:\Users\Admin\Pictures\Rgyxg4pwPhZf98jJUo06z2X0.exe"
                  4⤵
                  • Windows security bypass
                  • Executes dropped EXE
                  • Windows security modification
                  • Adds Run key to start application
                  • Checks for VirtualBox DLLs, possible anti-VM trick
                  • Drops file in Windows directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:2100
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                    5⤵
                      PID:1620
                      • C:\Windows\system32\netsh.exe
                        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                        6⤵
                        • Modifies Windows Firewall
                        • Modifies data under HKEY_USERS
                        PID:1532
                • C:\Users\Admin\Pictures\Z0LqEyU4qBY7NzsekEkStGYY.exe
                  "C:\Users\Admin\Pictures\Z0LqEyU4qBY7NzsekEkStGYY.exe"
                  3⤵
                  • Executes dropped EXE
                  • Checks SCSI registry key(s)
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: MapViewOfSection
                  PID:2616
                • C:\Users\Admin\Pictures\tPoPnyaiAbhapW1lzgCPkjme.exe
                  "C:\Users\Admin\Pictures\tPoPnyaiAbhapW1lzgCPkjme.exe"
                  3⤵
                  • Modifies firewall policy service
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Drops file in System32 directory
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  PID:1508
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 2092 -s 956
                2⤵
                  PID:2560
              • C:\Windows\system32\makecab.exe
                "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240509224055.log C:\Windows\Logs\CBS\CbsPersist_20240509224055.cab
                1⤵
                • Drops file in Windows directory
                PID:2260
              • C:\Windows\system32\DllHost.exe
                C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
                1⤵
                  PID:2856
                • C:\Windows\system32\DllHost.exe
                  C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                  1⤵
                    PID:1336
                  • C:\Users\Admin\AppData\Local\Temp\AD7E.exe
                    C:\Users\Admin\AppData\Local\Temp\AD7E.exe
                    1⤵
                    • Executes dropped EXE
                    PID:2800
                  • C:\Windows\system32\conhost.exe
                    \??\C:\Windows\system32\conhost.exe "-97140168-1299007174-204935707-887829759-194746240-163699897821956674-574531035"
                    1⤵
                      PID:2500
                    • C:\Windows\system32\conhost.exe
                      \??\C:\Windows\system32\conhost.exe "-1648430119401314617545780161-1638417601-816986579-1034423708-21037039251120637256"
                      1⤵
                        PID:2612
                      • C:\Windows\windefender.exe
                        C:\Windows\windefender.exe
                        1⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        PID:2056
                      • C:\Windows\system32\wbem\wmiprvse.exe
                        C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                        1⤵
                          PID:2008

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        2
                        T1059

                        PowerShell

                        1
                        T1059.001

                        Scheduled Task/Job

                        1
                        T1053

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        2
                        T1543

                        Windows Service

                        2
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Privilege Escalation

                        Abuse Elevation Control Mechanism

                        1
                        T1548

                        Bypass User Account Control

                        1
                        T1548.002

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        2
                        T1543

                        Windows Service

                        2
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Defense Evasion

                        Abuse Elevation Control Mechanism

                        1
                        T1548

                        Bypass User Account Control

                        1
                        T1548.002

                        Impair Defenses

                        5
                        T1562

                        Disable or Modify System Firewall

                        1
                        T1562.004

                        Disable or Modify Tools

                        3
                        T1562.001

                        Modify Registry

                        7
                        T1112

                        Subvert Trust Controls

                        1
                        T1553

                        Install Root Certificate

                        1
                        T1553.004

                        Virtualization/Sandbox Evasion

                        1
                        T1497

                        Credential Access

                        Unsecured Credentials

                        3
                        T1552

                        Credentials In Files

                        3
                        T1552.001

                        Discovery

                        Peripheral Device Discovery

                        1
                        T1120

                        Query Registry

                        6
                        T1012

                        System Information Discovery

                        6
                        T1082

                        Virtualization/Sandbox Evasion

                        1
                        T1497

                        Lateral Movement

                        Collection

                        Data from Local System

                        3
                        T1005

                        Command and Control

                        Web Service

                        1
                        T1102

                        Exfiltration

                        Impact

                        Inhibit System Recovery

                        1
                        T1490

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                          Filesize

                          68KB

                          MD5

                          29f65ba8e88c063813cc50a4ea544e93

                          SHA1

                          05a7040d5c127e68c25d81cc51271ffb8bef3568

                          SHA256

                          1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

                          SHA512

                          e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
                          Filesize

                          893B

                          MD5

                          d4ae187b4574036c2d76b6df8a8c1a30

                          SHA1

                          b06f409fa14bab33cbaf4a37811b8740b624d9e5

                          SHA256

                          a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7

                          SHA512

                          1f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          304B

                          MD5

                          76b8787b0d6993201c5d4c3e26084d1c

                          SHA1

                          2678cfa142e16afd6d283ccdc334451ea930b215

                          SHA256

                          91a98fa9e71abccdfca357f99c832d06520763867307bc5f80140d907023676f

                          SHA512

                          2d186ba9a4726d08ae2f40869b542a59175cf27a59f51c9f44279f55e1e834af15fb045b5f714d859b990fbf2205eacedc611291b119a0b67c69c9175d6735f0

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          304B

                          MD5

                          a4d6277f10236efd6aa63401dc94f21e

                          SHA1

                          3f3838a7cae13b79b53eb2ea78919839910b9c85

                          SHA256

                          6279324e6bde13aa607c3853b7e4c507a9fb3cd3d00444bd04647a1a58231d1a

                          SHA512

                          93d32c03441ff8bfb3c2b4b7031d76ff04468a08d21fb4d6f8e357baccc147db94c636c76cd30d5aa3dd00c5466c9fd125e4410475401f734052fc36427f2676

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          304B

                          MD5

                          eda9b85d83e58c59c89e68b5ed89c637

                          SHA1

                          447fe630ecfe62f1dccd805a2d6511abee03cbda

                          SHA256

                          3af4e1d34cccd497cc912aab1b316cdcd4367efd5aebd8fc78808995b3054853

                          SHA512

                          55b9982fdbf5e251b62008f9a7ac07b34d47e3e1ecee15b069a4f8af3b48527d78292d99b93667f2e514dc44582a068c94841192879ae2a60b0fd7a4400036e4

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          304B

                          MD5

                          9d2600f6bd0e9d78e67e33d6be151404

                          SHA1

                          2744fadebb9fa12cbf31fe2ede939b9f74c3f18f

                          SHA256

                          648ffe1bdf8f21dcd67664509b285211be20024194a7129ceb589833b728c2da

                          SHA512

                          b6fd73ed7c1d784b92a44a2174c225604c01c68b7683de12cc85517ba8a806b9aa1cc34c1045c0babb59de00c57823dbde12ababf5e941eab477dadf98e3f114

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
                          Filesize

                          252B

                          MD5

                          9d38facf89ab8acfe10513d7099908b1

                          SHA1

                          45b1b0c3a79e185e6c6741b0b8e28825b0dc3c6a

                          SHA256

                          a90b6f8da76b161bc355b223113e50e6ded31c909f962a7550963dd757e12cf5

                          SHA512

                          3354f87508b2c777eb5616307ff7605836622e4deb70d6386c909a39f11af0a68068e2e2928f2f2a7bb15a4d9e38bb94d38a8e0d195baaa584fe69c9c357003d

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\ApplicationInsights\bd92d7984d802ff9a1e24336bd1ccb4209c69a1bd116225cd9479ac9d0f516c4\32a3b6a01fea4f598021f598aed32a1c.tmp
                          Filesize

                          1KB

                          MD5

                          155db19bee3450abe02aaeea41aabb07

                          SHA1

                          042d4e15bcb72407d7d90baa79899986bce3acea

                          SHA256

                          7bb5df82a183a656c9440d272503145586bbce7f35b198a23d152a09012fa9f6

                          SHA512

                          f31273700357fb35272203a48a20232acffc8284ad6c8c783667f571dd5b3fa7a8538e56a13c01c0e24d00b3c60670b5ad81f0ea370943a06130543449c94cc9

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\AD7E.exe
                          Filesize

                          331KB

                          MD5

                          cc193035cd8f2bbd157ff4987775fbce

                          SHA1

                          62c5c7fb9ea684901b096993ffa94ccd061f7a7b

                          SHA256

                          95cee0c04c33b542a2d8d1f675b2c6610d91e9a406d744e9fef9197b8be57b6a

                          SHA512

                          157d687bb89b960b32da06b27edbd85d474531bfe7395bffa30fb207f6fcd1f57ce834f2d87b839d75b5200dafc69b72649c801c0876f4bee2c3e98695fb855c

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Cab2DB9.tmp
                          Filesize

                          65KB

                          MD5

                          ac05d27423a85adc1622c714f2cb6184

                          SHA1

                          b0fe2b1abddb97837ea0195be70ab2ff14d43198

                          SHA256

                          c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                          SHA512

                          6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error
                          Filesize

                          2.1MB

                          MD5

                          455389872c3928dad7b846c9cbf0d04f

                          SHA1

                          c3ae5b05fb0412fc54c76a9690c038b6acad298d

                          SHA256

                          ef13b3a2cb64ebd668a0d7e3c1bb9e9dd1c9c22d333eb0f90a8b07516403341e

                          SHA512

                          a4ae6ee7a6d074fc4937ac01afe219b81237e5d7295604cd8b7c152f5b45de7233fefd6aa6700252537a037cfd70892bbda4351186f7d46b9189896762e163ba

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
                          Filesize

                          492KB

                          MD5

                          fafbf2197151d5ce947872a4b0bcbe16

                          SHA1

                          a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020

                          SHA256

                          feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71

                          SHA512

                          acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Tar2DBC.tmp
                          Filesize

                          171KB

                          MD5

                          9c0c641c06238516f27941aa1166d427

                          SHA1

                          64cd549fb8cf014fcd9312aa7a5b023847b6c977

                          SHA256

                          4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

                          SHA512

                          936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Tar2E8D.tmp
                          Filesize

                          177KB

                          MD5

                          435a9ac180383f9fa094131b173a2f7b

                          SHA1

                          76944ea657a9db94f9a4bef38f88c46ed4166983

                          SHA256

                          67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

                          SHA512

                          1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                          Filesize

                          281KB

                          MD5

                          d98e33b66343e7c96158444127a117f6

                          SHA1

                          bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                          SHA256

                          5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                          SHA512

                          705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                          Filesize

                          1.7MB

                          MD5

                          13aaafe14eb60d6a718230e82c671d57

                          SHA1

                          e039dd924d12f264521b8e689426fb7ca95a0a7b

                          SHA256

                          f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3

                          SHA512

                          ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                          Filesize

                          2KB

                          MD5

                          7f0ea371fcb130f52b887a91f79cdab0

                          SHA1

                          7b4a94e364b988474c067904a63021dfec290738

                          SHA256

                          973eea1e4bd75074eaf41a8c94266e037d52d62e9d170d51b7b7643707d5c09a

                          SHA512

                          4f03da7991b5a8367146dec161b512f28f32462bb4b2ae2dedab6dbd382fc78d3e4fd3495691898c1cfb626aa90c2b4ca2e9e757d3fdade2e574a73b52856c62

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                          Filesize

                          5.3MB

                          MD5

                          1afff8d5352aecef2ecd47ffa02d7f7d

                          SHA1

                          8b115b84efdb3a1b87f750d35822b2609e665bef

                          SHA256

                          c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1

                          SHA512

                          e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\osloader.exe
                          Filesize

                          591KB

                          MD5

                          e2f68dc7fbd6e0bf031ca3809a739346

                          SHA1

                          9c35494898e65c8a62887f28e04c0359ab6f63f5

                          SHA256

                          b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4

                          SHA512

                          26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579

                          Download Submit

                        • C:\Users\Admin\Pictures\2wwXI3oeLrMOsp9XPfocA8Ia.exe
                          Filesize

                          384KB

                          MD5

                          f969256486cae8c6c357924481ec86ee

                          SHA1

                          95f91c8a6539700b4dd6077ba3a778c13bc72d4d

                          SHA256

                          d719fb243a6d2ad33a76aa78ee66f4763a36c78a2373a01de223fb5c27b722da

                          SHA512

                          106959ab072744ae5ce79cbc627040dbd32bb416407ca7d1f848ae49dbb609f900c0f34696fc5e30c5418d889b5c07b35d5a0f9b4f1be1e662621ba2c4491e16

                          Download Submit

                        • C:\Users\Admin\Pictures\Z0LqEyU4qBY7NzsekEkStGYY.exe
                          Filesize

                          213KB

                          MD5

                          718455b384af2a8caa79eca4c64b7d78

                          SHA1

                          84993e856abe4c3c90a61f95f02252dfbe94b356

                          SHA256

                          1e418b3dae341f3196b5c3c23cb11eb071dbb82c77ebef9badfd74e3ddea1aac

                          SHA512

                          46f51aa5f2fa32f597bbc6e6d375d8d0b9baa2fae2ec68a76fdba63e0d831a514658aa26c137657b8ad1ec653b1f4f5c728b3a61a40f0ba3e0b67a381d02537f

                          Download Submit

                        • C:\Users\Admin\Pictures\jxAg053Lo3sv6UGxcQTLpnkr.exe
                          Filesize

                          4.1MB

                          MD5

                          f6156b63d313f7247432a693de39daef

                          SHA1

                          bff890bf23551db49d04af57779630bea35356a9

                          SHA256

                          f148a51481ad34b81dbdc1c27873ca0e4d56c83729dcf8ed891f4443f5492620

                          SHA512

                          54c61e755d5661da14ebfef93b9fa61d02f59fb43edc1310cf21c0780479bc54be973836286f0d5104a946e9d511e94162d38e2a5471f0f386b7b7e396e7f759

                          Download Submit

                        • \ProgramData\mozglue.dll
                          Filesize

                          593KB

                          MD5

                          c8fd9be83bc728cc04beffafc2907fe9

                          SHA1

                          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                          SHA256

                          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                          SHA512

                          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                          Download Submit

                        • \ProgramData\nss3.dll
                          Filesize

                          2.0MB

                          MD5

                          1cc453cdf74f31e4d913ff9c10acdde2

                          SHA1

                          6e85eae544d6e965f15fa5c39700fa7202f3aafe

                          SHA256

                          ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                          SHA512

                          dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\dbghelp.dll
                          Filesize

                          1.5MB

                          MD5

                          f0616fa8bc54ece07e3107057f74e4db

                          SHA1

                          b33995c4f9a004b7d806c4bb36040ee844781fca

                          SHA256

                          6e58fcf4d763022b1f79a3c448eb2ebd8ad1c15df3acf58416893f1cbc699026

                          SHA512

                          15242e3f5652d7f1d0e31cebadfe2f238ca3222f0e927eb7feb644ab2b3d33132cf2316ee5089324f20f72f1650ad5bb8dd82b96518386ce5b319fb5ceb8313c

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\symsrv.dll
                          Filesize

                          163KB

                          MD5

                          5c399d34d8dc01741269ff1f1aca7554

                          SHA1

                          e0ceed500d3cef5558f3f55d33ba9c3a709e8f55

                          SHA256

                          e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f

                          SHA512

                          8ff9d38b22d73c595cc417427b59f5ca8e1fb7b47a2fa6aef25322bf6e614d6b71339a752d779bd736b4c1057239100ac8cc62629fd5d6556785a69bcdc3d73d

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\u1xg.0.exe
                          Filesize

                          206KB

                          MD5

                          0917be53327ea132956255dcab650a82

                          SHA1

                          b60818917f645a8a9af3b530e3ae37c1f002be2f

                          SHA256

                          211c34660898480e0777c6ef6f61bf2111f6550e00b40cab859543d567dc455a

                          SHA512

                          a72acc24ba813d983bbf2ecab7929d0aab4e25637ae43e85b973a5105429bd15c061415fd855737620caaf81b456b2d6ba57f85566245efbe5f8b5db5560932a

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\u1xg.1.exe
                          Filesize

                          4.6MB

                          MD5

                          397926927bca55be4a77839b1c44de6e

                          SHA1

                          e10f3434ef3021c399dbba047832f02b3c898dbd

                          SHA256

                          4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                          SHA512

                          cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                          Download Submit

                        • \Users\Admin\Pictures\WX542njaR8VbFU6hKMBkMkcf.exe
                          Filesize

                          4.1MB

                          MD5

                          0ed8d071deae90ff638cb070d0b9559d

                          SHA1

                          9b39b4703ccd78d9ca56bbf2f4c168d71a7bcfda

                          SHA256

                          691bddda01382e95f74905b1fc77da9acbb73383734ca3116075be2c7d62cf99

                          SHA512

                          960a5a4e2b4f82bb7273cbab8bf622933c6e603cdc44b59b409c285b62c3a2c741bca7692ed77864520aa95c85a2f3fc31ddc9383caada588828d953346c2729

                          Download Submit

                        • \Users\Admin\Pictures\tPoPnyaiAbhapW1lzgCPkjme.exe
                          Filesize

                          2.8MB

                          MD5

                          d41fd1ea6e0ca0032be2174317f60fd8

                          SHA1

                          60f001b9d201259aa333e9b202e4ab5648d16bf3

                          SHA256

                          3c56d175e67df7e1664bbedd95abee57cf93a7aceaf80374ede4ce1fc4a30990

                          SHA512

                          a4ce799f1ce9157d053dcb1694dcb127d98e994eb55cecb484ace1c192cf80a1fbfb7b8de94851a49e915cafebc568f70ce07b912e5901387ed90639c692c16e

                          Download Submit

                        • memory/292-468-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                          Download

                        • memory/292-355-0x0000000003030000-0x0000000003428000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/448-555-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                          Download

                        • memory/448-624-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                          Download

                        • memory/448-648-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                          Download

                        • memory/448-650-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                          Download

                        • memory/448-680-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                          Download

                        • memory/448-641-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                          Download

                        • memory/448-433-0x0000000003140000-0x0000000003538000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/864-248-0x00000000030D0000-0x00000000034C8000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/864-354-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                          Download

                        • memory/1156-417-0x0000000002E30000-0x0000000002E46000-memory.dmp

                          Filesize

                          88KB

                          Download

                        • memory/1508-324-0x0000000140000000-0x000000014097B000-memory.dmp

                          Filesize

                          9.5MB

                          Download

                        • memory/1508-527-0x0000000140000000-0x000000014097B000-memory.dmp

                          Filesize

                          9.5MB

                          Download

                        • memory/1712-402-0x0000000003140000-0x0000000003538000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/1712-448-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                          Download

                        • memory/1940-273-0x00000000030F0000-0x00000000034E8000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/1940-408-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                          Download

                        • memory/2056-684-0x0000000000400000-0x00000000008DF000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2056-688-0x0000000000400000-0x00000000008DF000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2092-2-0x00000000003D0000-0x00000000003DA000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/2092-4-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

                          Filesize

                          9.9MB

                          Download

                        • memory/2092-493-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

                          Filesize

                          9.9MB

                          Download

                        • memory/2092-0-0x000007FEF57F3000-0x000007FEF57F4000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2092-1-0x0000000000F80000-0x0000000000F8A000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/2092-475-0x000007FEF57F3000-0x000007FEF57F4000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2092-3-0x0000000000D70000-0x0000000000DCE000-memory.dmp

                          Filesize

                          376KB

                          Download

                        • memory/2100-454-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                          Download

                        • memory/2100-397-0x00000000030A0000-0x0000000003498000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/2164-494-0x0000000140000000-0x00000001405E8000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2164-508-0x0000000140000000-0x00000001405E8000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2408-685-0x0000000000400000-0x00000000008DF000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2408-683-0x0000000000400000-0x00000000008DF000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2500-385-0x0000000000400000-0x0000000002B1E000-memory.dmp

                          Filesize

                          39.1MB

                          Download

                        • memory/2504-9-0x0000000002A10000-0x0000000002A90000-memory.dmp

                          Filesize

                          512KB

                          Download

                        • memory/2504-23-0x0000000001F70000-0x0000000001F78000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/2504-22-0x000000001B530000-0x000000001B812000-memory.dmp

                          Filesize

                          2.9MB

                          Download

                        • memory/2548-286-0x0000000003090000-0x0000000003488000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/2548-404-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                          Download

                        • memory/2616-418-0x0000000000400000-0x0000000002AF2000-memory.dmp

                          Filesize

                          38.9MB

                          Download

                        • memory/2672-10-0x0000000000400000-0x0000000000408000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/2672-530-0x000000000BC50000-0x000000000C5CB000-memory.dmp

                          Filesize

                          9.5MB

                          Download

                        • memory/2672-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2672-16-0x0000000000400000-0x0000000000408000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/2672-21-0x0000000000400000-0x0000000000408000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/2672-12-0x0000000000400000-0x0000000000408000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/2672-20-0x0000000000400000-0x0000000000408000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/2672-19-0x0000000000400000-0x0000000000408000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/2672-14-0x0000000000400000-0x0000000000408000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/2672-323-0x000000000BC50000-0x000000000C5CB000-memory.dmp

                          Filesize

                          9.5MB

                          Download

                        • memory/2692-550-0x0000000000400000-0x00000000008AD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2692-528-0x0000000000400000-0x00000000008AD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2800-637-0x0000000000400000-0x0000000002B10000-memory.dmp

                          Filesize

                          39.1MB

                          Download

                        • memory/2816-554-0x0000000005A00000-0x0000000005A0C000-memory.dmp

                          Filesize

                          48KB

                          Download

                        • memory/2816-553-0x0000000000500000-0x0000000000510000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/2816-570-0x00000000059B0000-0x00000000059BA000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/2816-552-0x000000001ED40000-0x000000001EE4A000-memory.dmp

                          Filesize

                          1.0MB

                          Download

                        • memory/2816-576-0x00000000059D0000-0x00000000059DA000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/2816-577-0x0000000005BF0000-0x0000000005BFA000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/2816-579-0x000000001E080000-0x000000001E0A2000-memory.dmp

                          Filesize

                          136KB

                          Download

                        • memory/2816-578-0x000000001E4A0000-0x000000001E502000-memory.dmp

                          Filesize

                          392KB

                          Download

                        • memory/2816-582-0x000000001E0A0000-0x000000001E0AC000-memory.dmp

                          Filesize

                          48KB

                          Download

                        • memory/2816-620-0x0000000140000000-0x000000014097B000-memory.dmp

                          Filesize

                          9.5MB

                          Download

                        • memory/2816-621-0x0000000140000000-0x000000014097B000-memory.dmp

                          Filesize

                          9.5MB

                          Download

                        • memory/2816-623-0x00000000059D0000-0x00000000059DA000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/2816-622-0x00000000059D0000-0x00000000059DA000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/2816-574-0x000000001FC00000-0x000000001FF00000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2816-557-0x0000000005BC0000-0x0000000005BE4000-memory.dmp

                          Filesize

                          144KB

                          Download

                        • memory/2816-565-0x0000000140000000-0x000000014097B000-memory.dmp

                          Filesize

                          9.5MB

                          Download

                        • memory/2816-567-0x00000000059A0000-0x00000000059AA000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/2816-568-0x0000000005B30000-0x0000000005B5A000-memory.dmp

                          Filesize

                          168KB

                          Download

                        • memory/2816-569-0x000000001F420000-0x000000001F4D2000-memory.dmp

                          Filesize

                          712KB

                          Download

                        • memory/2816-564-0x0000000140000000-0x000000014097B000-memory.dmp

                          Filesize

                          9.5MB

                          Download

                        • memory/2816-556-0x0000000000D50000-0x0000000000D64000-memory.dmp

                          Filesize

                          80KB

                          Download

                        • memory/2816-551-0x0000000000D60000-0x0000000004594000-memory.dmp

                          Filesize

                          56.2MB

                          Download

                        • memory/2856-260-0x00000000032F0000-0x00000000036E8000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/2856-403-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                          Download

                        • memory/2928-474-0x0000000000400000-0x0000000002AF1000-memory.dmp

                          Filesize

                          38.9MB

                          Download

                        • memory/2928-369-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                          Filesize

                          972KB

                          Download

                        • memory/3048-432-0x0000000000400000-0x0000000002ED5000-memory.dmp

                          Filesize

                          42.8MB

                          Download

                        • memory/3048-396-0x00000000030C0000-0x00000000034B8000-memory.dmp

                          Filesize

                          4.0MB

                          Download