3ce2deed846543f4b039f43c99406ad949053816d492761c271bb796e32d5e7a

Analysis

max time kernel
150s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
09-06-2024 23:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ce2deed846543f4b039f43c99406ad949053816d492761c271bb796e32d5e7a.exe
Size

40.8MB
MD5

4e518b01f1a03136dd9add70b1896771
SHA1

5067bf77aa4237d8af1f32bcf1290f2ac93df50c
SHA256

3ce2deed846543f4b039f43c99406ad949053816d492761c271bb796e32d5e7a
SHA512

31f7b845fd787a7b05f481f8fec4cb9a9915e062e79d6896e96704c85b48e4dad4f3fcf2b4f92924e5f1c360af5dd71f37602b1cdfadf590814c2c1cff581298
SSDEEP

786432:U4XcPJcRbQxx6Ed3MBFAFUqq63budRfPY73B:rXWJ2ux6YMoq63bsRfPY73B

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1952	powershell.exe
1080	powershell.exe
1756	powershell.exe
1428	powershell.exe
1928	powershell.exe
1428	powershell.exe
2536	powershell.exe
2912	powershell.exe
1040	powershell.exe
3552	powershell.exe
1864	powershell.exe
1264	powershell.exe
1064	powershell.exe
3552	powershell.exe
2912	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 5 IoCs

pid	Process
1396	3ce2deed846543f4b039f43c99406ad949053816d492761c271bb796e32d5e7a.exe
3692	winsvc.exe
2476	winsvc.exe
3024	WINCFG.EXE
4756	WINNET.EXE

Drops file in System32 directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\data\ntcp2.keys	WINNET.EXE
File created	C:\Windows\system32\data\router.info	WINNET.EXE
File opened for modification	C:\Windows\system32\winsvc.exe	3ce2deed846543f4b039f43c99406ad949053816d492761c271bb796e32d5e7a.exe
File opened for modification	C:\Windows\system32\winnet.exe	winsvc.exe
File opened for modification	C:\Windows\system32\data\router.info	WINNET.EXE
File created	C:\Windows\system32\data\destinations\utlp7phbv7snagoaahfkoenhyfcr3hkdtg5hjkgfckuenw4e4qsa.dat	WINNET.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\wincfg.exe	winsvc.exe
File opened for modification	C:\Windows\system32\.coB556.tmp	3ce2deed846543f4b039f43c99406ad949053816d492761c271bb796e32d5e7a.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\data\router.keys	WINNET.EXE
File created	C:\Windows\system32\data\ssu2.keys	WINNET.EXE
File opened for modification	C:\Windows\System32\.coB556.tmp	3ce2deed846543f4b039f43c99406ad949053816d492761c271bb796e32d5e7a.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1504	sc.exe
2340	sc.exe
4552	sc.exe
3864	sc.exe

Kills process with taskkill 8 IoCs

evasion

pid	Process
3916	taskkill.exe
5020	taskkill.exe
4256	taskkill.exe
1616	taskkill.exe
3228	taskkill.exe
2000	taskkill.exe
1368	taskkill.exe
2376	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1064	powershell.exe
1064	powershell.exe
1428	powershell.exe
1428	powershell.exe
1952	powershell.exe
1952	powershell.exe
1040	powershell.exe
1040	powershell.exe
3552	powershell.exe
3552	powershell.exe
2912	powershell.exe
2912	powershell.exe
1864	powershell.exe
1864	powershell.exe
2536	powershell.exe
2536	powershell.exe
1264	powershell.exe
1264	powershell.exe
1080	powershell.exe
1080	powershell.exe
1928	powershell.exe
1928	powershell.exe
1428	powershell.exe
1428	powershell.exe
1756	powershell.exe
1756	powershell.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe
2476	winsvc.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeDebugPrivilege	1064	powershell.exe
Token: SeDebugPrivilege	1428	powershell.exe
Token: SeDebugPrivilege	1952	powershell.exe
Token: SeDebugPrivilege	1040	powershell.exe
Token: SeDebugPrivilege	3552	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	1864	powershell.exe
Token: SeShutdownPrivilege	2584	powercfg.exe
Token: SeCreatePagefilePrivilege	2584	powercfg.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeShutdownPrivilege	3040	powercfg.exe
Token: SeCreatePagefilePrivilege	3040	powercfg.exe
Token: SeDebugPrivilege	1264	powershell.exe
Token: SeShutdownPrivilege	4804	powercfg.exe
Token: SeCreatePagefilePrivilege	4804	powercfg.exe
Token: SeDebugPrivilege	1080	powershell.exe
Token: SeShutdownPrivilege	4340	powercfg.exe
Token: SeCreatePagefilePrivilege	4340	powercfg.exe
Token: SeDebugPrivilege	1928	powershell.exe
Token: SeShutdownPrivilege	2924	powercfg.exe
Token: SeCreatePagefilePrivilege	2924	powercfg.exe
Token: SeDebugPrivilege	3916	taskkill.exe
Token: SeDebugPrivilege	5020	taskkill.exe
Token: SeDebugPrivilege	4256	taskkill.exe
Token: SeDebugPrivilege	1616	taskkill.exe
Token: SeDebugPrivilege	1428	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	1428	powershell.exe
Token: SeIncreaseQuotaPrivilege	1428	powershell.exe
Token: SeSecurityPrivilege	1428	powershell.exe
Token: SeTakeOwnershipPrivilege	1428	powershell.exe
Token: SeLoadDriverPrivilege	1428	powershell.exe
Token: SeSystemtimePrivilege	1428	powershell.exe
Token: SeBackupPrivilege	1428	powershell.exe
Token: SeRestorePrivilege	1428	powershell.exe
Token: SeShutdownPrivilege	1428	powershell.exe
Token: SeSystemEnvironmentPrivilege	1428	powershell.exe
Token: SeUndockPrivilege	1428	powershell.exe
Token: SeManageVolumePrivilege	1428	powershell.exe
Token: SeDebugPrivilege	1756	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	1756	powershell.exe
Token: SeIncreaseQuotaPrivilege	1756	powershell.exe
Token: SeSecurityPrivilege	1756	powershell.exe
Token: SeTakeOwnershipPrivilege	1756	powershell.exe
Token: SeLoadDriverPrivilege	1756	powershell.exe
Token: SeSystemtimePrivilege	1756	powershell.exe
Token: SeBackupPrivilege	1756	powershell.exe
Token: SeRestorePrivilege	1756	powershell.exe
Token: SeShutdownPrivilege	1756	powershell.exe
Token: SeSystemEnvironmentPrivilege	1756	powershell.exe
Token: SeUndockPrivilege	1756	powershell.exe
Token: SeManageVolumePrivilege	1756	powershell.exe
Token: SeDebugPrivilege	3228	taskkill.exe
Token: SeDebugPrivilege	2000	taskkill.exe
Token: SeDebugPrivilege	1368	taskkill.exe
Token: SeDebugPrivilege	2376	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 1396	3304	3ce2deed846543f4b039f43c99406ad949053816d492761c271bb796e32d5e7a.exe	77
PID 3304 wrote to memory of 1396	3304	3ce2deed846543f4b039f43c99406ad949053816d492761c271bb796e32d5e7a.exe	77
PID 1396 wrote to memory of 3692	1396	3ce2deed846543f4b039f43c99406ad949053816d492761c271bb796e32d5e7a.exe	78
PID 1396 wrote to memory of 3692	1396	3ce2deed846543f4b039f43c99406ad949053816d492761c271bb796e32d5e7a.exe	78
PID 3692 wrote to memory of 1064	3692	winsvc.exe	79
PID 3692 wrote to memory of 1064	3692	winsvc.exe	79
PID 1064 wrote to memory of 2340	1064	powershell.exe	81
PID 1064 wrote to memory of 2340	1064	powershell.exe	81
PID 3692 wrote to memory of 1428	3692	winsvc.exe	82
PID 3692 wrote to memory of 1428	3692	winsvc.exe	82
PID 1428 wrote to memory of 4552	1428	powershell.exe	84
PID 1428 wrote to memory of 4552	1428	powershell.exe	84
PID 3692 wrote to memory of 1952	3692	winsvc.exe	85
PID 3692 wrote to memory of 1952	3692	winsvc.exe	85
PID 1952 wrote to memory of 3864	1952	powershell.exe	87
PID 1952 wrote to memory of 3864	1952	powershell.exe	87
PID 3692 wrote to memory of 1040	3692	winsvc.exe	88
PID 3692 wrote to memory of 1040	3692	winsvc.exe	88
PID 1040 wrote to memory of 1504	1040	powershell.exe	90
PID 1040 wrote to memory of 1504	1040	powershell.exe	90
PID 2476 wrote to memory of 3552	2476	winsvc.exe	92
PID 2476 wrote to memory of 3552	2476	winsvc.exe	92
PID 2476 wrote to memory of 2912	2476	winsvc.exe	94
PID 2476 wrote to memory of 2912	2476	winsvc.exe	94
PID 2476 wrote to memory of 1864	2476	winsvc.exe	96
PID 2476 wrote to memory of 1864	2476	winsvc.exe	96
PID 1864 wrote to memory of 2584	1864	powershell.exe	98
PID 1864 wrote to memory of 2584	1864	powershell.exe	98
PID 2476 wrote to memory of 2536	2476	winsvc.exe	99
PID 2476 wrote to memory of 2536	2476	winsvc.exe	99
PID 2536 wrote to memory of 3040	2536	powershell.exe	101
PID 2536 wrote to memory of 3040	2536	powershell.exe	101
PID 2476 wrote to memory of 1264	2476	winsvc.exe	102
PID 2476 wrote to memory of 1264	2476	winsvc.exe	102
PID 1264 wrote to memory of 4804	1264	powershell.exe	104
PID 1264 wrote to memory of 4804	1264	powershell.exe	104
PID 2476 wrote to memory of 1080	2476	winsvc.exe	105
PID 2476 wrote to memory of 1080	2476	winsvc.exe	105
PID 1080 wrote to memory of 4340	1080	powershell.exe	107
PID 1080 wrote to memory of 4340	1080	powershell.exe	107
PID 2476 wrote to memory of 1928	2476	winsvc.exe	108
PID 2476 wrote to memory of 1928	2476	winsvc.exe	108
PID 1928 wrote to memory of 2924	1928	powershell.exe	110
PID 1928 wrote to memory of 2924	1928	powershell.exe	110
PID 2476 wrote to memory of 3916	2476	winsvc.exe	111
PID 2476 wrote to memory of 3916	2476	winsvc.exe	111
PID 2476 wrote to memory of 5020	2476	winsvc.exe	114
PID 2476 wrote to memory of 5020	2476	winsvc.exe	114
PID 2476 wrote to memory of 4256	2476	winsvc.exe	116
PID 2476 wrote to memory of 4256	2476	winsvc.exe	116
PID 2476 wrote to memory of 1616	2476	winsvc.exe	118
PID 2476 wrote to memory of 1616	2476	winsvc.exe	118
PID 2476 wrote to memory of 1428	2476	winsvc.exe	120
PID 2476 wrote to memory of 1428	2476	winsvc.exe	120
PID 2476 wrote to memory of 1756	2476	winsvc.exe	122
PID 2476 wrote to memory of 1756	2476	winsvc.exe	122
PID 2476 wrote to memory of 3228	2476	winsvc.exe	124
PID 2476 wrote to memory of 3228	2476	winsvc.exe	124
PID 2476 wrote to memory of 2000	2476	winsvc.exe	125
PID 2476 wrote to memory of 2000	2476	winsvc.exe	125
PID 2476 wrote to memory of 1368	2476	winsvc.exe	128
PID 2476 wrote to memory of 1368	2476	winsvc.exe	128
PID 2476 wrote to memory of 2376	2476	winsvc.exe	129
PID 2476 wrote to memory of 2376	2476	winsvc.exe	129

C:\Users\Admin\AppData\Local\Temp\3ce2deed846543f4b039f43c99406ad949053816d492761c271bb796e32d5e7a.exe
"C:\Users\Admin\AppData\Local\Temp\3ce2deed846543f4b039f43c99406ad949053816d492761c271bb796e32d5e7a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Users\Admin\AppData\Local\Temp\3ce2deed846543f4b039f43c99406ad949053816d492761c271bb796e32d5e7a-664100a7b05f66cb\3ce2deed846543f4b039f43c99406ad949053816d492761c271bb796e32d5e7a.exe
  "C:\Users\Admin\AppData\Local\Temp\3ce2deed846543f4b039f43c99406ad949053816d492761c271bb796e32d5e7a-664100a7b05f66cb\3ce2deed846543f4b039f43c99406ad949053816d492761c271bb796e32d5e7a.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\system32\winsvc.exe
    "C:\Windows\system32\winsvc.exe" "C:\Users\Admin\AppData\Local\Temp\3ce2deed846543f4b039f43c99406ad949053816d492761c271bb796e32d5e7a-664100a7b05f66cb\3ce2deed846543f4b039f43c99406ad949053816d492761c271bb796e32d5e7a.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "create" "winsvc" "type=own" "start=auto" "error=ignore" "binPath=\"C:\Windows\system32\winsvc.exe\"" "DisplayName=\"Windows System Service\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1064
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" create winsvc type=own start=auto error=ignore binPath=C:\Windows\system32\winsvc.exe "DisplayName=Windows System Service"
        5⤵
        Launches sc.exe
        
        PID:2340
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "failure" "winsvc" "reset=0" "actions=restart/0/restart/0/restart/0"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1428
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" failure winsvc reset=0 actions=restart/0/restart/0/restart/0
        5⤵
        Launches sc.exe
        
        PID:4552
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "description" "winsvc" "\"Windows System Service is the main system supervision service.\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1952
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" description winsvc "Windows System Service is the main system supervision service."
        5⤵
        Launches sc.exe
        
        PID:3864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "start" "winsvc"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1040
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" start winsvc
        5⤵
        Launches sc.exe
        
        PID:1504

C:\Windows\system32\winsvc.exe
C:\Windows\system32\winsvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "Add-MpPreference" "-ExclusionPath" "\"C:\Windows\system32\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "Add-MpPreference" "-ExclusionPath" "\"C:\Windows\Temp\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-SETACTIVE" "8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -SETACTIVE 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "standby-timeout-ac" "0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -change standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "standby-timeout-dc" "0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -change standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "hibernate-timeout-ac" "0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -change hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "hibernate-timeout-dc" "0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" -change hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2924
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" "/F" "/IM" "winnet.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3916
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" "/F" "/IM" "winnet.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5020
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" "/F" "/IM" "wincfg.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4256
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" "/F" "/IM" "wincfg.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "Remove-NetFirewallRule" "-DisplayName" "\"Windows Network Manager\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" "-WindowStyle" "Hidden" "-Command" "New-NetFirewallRule" "-DisplayName" "\"Windows Network Manager\"" "-Program" "\"C:\Windows\system32\winnet.exe\"" "-Action" "Allow" "-Direction" "Inbound" "-EdgeTraversalPolicy" "Allow" "-Enabled" "True"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1756
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" "/F" "/IM" "WINCFG.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3228
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" "/F" "/IM" "WINNET.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2000
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" "/F" "/IM" "WINCFG.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1368
- C:\Windows\system32\taskkill.exe
  "taskkill.exe" "/F" "/IM" "WINNET.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2376
- C:\WINDOWS\SYSTEM32\WINCFG.EXE
  "C:\WINDOWS\SYSTEM32\WINCFG.EXE"
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\WINDOWS\SYSTEM32\WINNET.EXE
  "C:\WINDOWS\SYSTEM32\WINNET.EXE" "--datadir=C:\Windows\system32\data" "--precomputation.elgamal=false" "--persist.profiles=false" "--persist.addressbook=false" "--cpuext.aesni" "--cpuext.avx" "--ipv4" "--ipv6" "--bandwidth=X" "--share=100" "--floodfill" "--nat" "--upnp.enabled=true" "--upnp.name=Microsoft" "--insomnia" "--nettime.enabled=true" "--nettime.ntpsyncinterval=1" "--sam.enabled=true" "--sam.singlethread=false" "--http.enabled=false" "--bob.enabled=false" "--httpproxy.enabled=false" "--socksproxy.enabled=false" "--i2cp.enabled=false" "--i2pcontrol.enabled=false" "--loglevel=none" "--log=stdout"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:4756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
5caad758326454b5788ec35315c4c304

SHA1
3aef8dba8042662a7fcf97e51047dc636b4d4724

SHA256
83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391

SHA512
4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\3ce2deed846543f4b039f43c99406ad949053816d492761c271bb796e32d5e7a-664100a7b05f66cb\3ce2deed846543f4b039f43c99406ad949053816d492761c271bb796e32d5e7a.exe

Filesize
42.1MB

MD5
4a15c9ac14e06e947b55109965362682

SHA1
cbf8291f6d001ce82fbbbdf181501b1b607fc5f2

SHA256
5d344800fc9aca2c8ab4447bc73d695e4abbe9a5a02a00b17c4fffd112406469

SHA512
16472fa5f924cab82044559cc1309308090031745df537807e01f714fa11cb33ae722e148764efd0fa01f58c3364f0dff4ac056cf010d0a378802ad148d51060

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q4lhdp42.atg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System32\data\router.info

Filesize
931B

MD5
6cea58da591e2e501e7ce28995f1b688

SHA1
d479b0f05da26734eec95392b493c90eb6ed2282

SHA256
0e164699dacc3d8187b59783ab9a2afc3f176d32a7c146d5072a9502418a2f94

SHA512
c24f1ceb15c850f0b91d5831c6585808632d51dda0d02fda0268a5676f5bf0dace6b68e9259356efd5f3c242eb81d3d231e04443a8d978e2297d3fb9a1b1cdc3

Download Submit
C:\Windows\System32\wincfg.exe

Filesize
34.1MB

MD5
7b9ec19cabffb397ec7c4cd8abf9540c

SHA1
530430c7f7b99a447a2a5d35935ff332d1b6d065

SHA256
0f7daa7cbbe5b22bc7a7926470ccd51ed1e80fcfaccff86dec337bdb6e0167bb

SHA512
ac18b032013524600f5a6208c21b1dd171016c616ad552a522861b8aaeeab134f1e37ac15efbc6a3f836979233685ca36a728f685da982f50d12f739be2c471d

Download Submit
C:\Windows\System32\winnet.exe

Filesize
9.1MB

MD5
2fdbf4ba6ab24cf44aa0cc08cd77ca66

SHA1
df5e034ba45a932b9f5d3ed7adc4a71e0b376984

SHA256
fcd362e0632b35dad13a87f09ea6da4d07fa89516f42d64236d2cc3e3b2b725b

SHA512
81d73f7540ede7337922dc18fc6b110c87f621bc0349c3fa17f50d1cb924b0d9b30a4a772b2d548238b65a1be43d458f1991320e7308e608c6cf40ccc3e59a51

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
4KB

MD5
275d53603045198a76b858c4ab291b31

SHA1
2bf40fc8d9cd9f98d8ba24db0febe318de2c0fd5

SHA256
beede0a0786f0e0f63331076809470f60d2469bb6df1817e42d134828474ac5a

SHA512
03a81858635f71ea569cdbe0a1feb5abd989f62672b127e45bfbccd97ab373ed848a82eb8c1c352c11d8ac1092f2fcedae448c6424e0cd2ba2c73124df047bae

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5257f4275005cfec6b2053f771845b8f

SHA1
a0bc2521a0710a8a33cac14d96c0277625ac995f

SHA256
26bf34d7fb63215592200058477af031e9a14b8d363be78854c4b755d0dfe589

SHA512
ac4c523dce3c619f521cf08fea4a2b195293c86e9d815b2eb624d0ce9e9acfba0ec8fac2de1d77b6ea8e96e1afd04acae07e5e81a1ca95878cb7e4bb40847fb5

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6e0a7bc62e0cd744e56b968eacd380a5

SHA1
ec4168cb07e8b5953a6b33851b72442de918a33e

SHA256
77c864c40af0592b2451d0f8a171a1b1f7613ac13d23164290bc7d816a357479

SHA512
e4909fc41c6db72184d486c9f5891c2d8e670aeec9847c25f032a589e35d5aae692642a165b78bfbfcd91d4132181e1278d1102ab4821bfa84f98da6c2a91b7e

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
f5441dc8b5e8c9f154ce57c9f1cd228a

SHA1
5a315e7d833883bd1ed5a01a40434e3631cdfb39

SHA256
05a46acb69ff66b3646a709d41e4fc48d339eefbbb69fa12e7433758c3b52b0c

SHA512
b9b1cd7b27095adc9a2f4dffeac6d34a665fd9411440941da91fa505e4efdde6ea6acb6e2fcdf558237714064aa9f09e763401bbd313ed96a4e029c402965f25

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
53fbb36e3de882ade26ea8b023b9a6ce

SHA1
ff48acf3b1475f0933c950856f58aebb26ca4af9

SHA256
c1ed4103218a9267eb4c0266f7a5d599950aa178523cc33357e49b727bb65130

SHA512
a2536a0500b3075e9f87ea66fee73061d6660af246637d04cfb7d80d51ddaa35692682a08663c21db9533cecc0e140a6b610d8656cc1aa02d3969b5d2a83f2c9

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4f4eccc00a1daa0fb533ee35e6704163

SHA1
74c9efc6c017408a90b3461f560d33f322cef512

SHA256
f77e50cb536bb9dc6cdbe562bc98d86848a56d0de27e3a72906ac59bff62032b

SHA512
6d6f199dff1a58a752f0935315eefcf703983743fd318bd81cdd8816d119884b0e4f7ac39845ec941bfad6c38fa91e2e594b52b1f025f78602dea522ce9fe0db

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9e9cde84e97360fb39f64e3697c25587

SHA1
02f67f54c54a08320a5331e464dc77b2816fbc97

SHA256
1bdc4f0e8c0845ba527337f1e791da5873c34dff15eb33c71a5aba89e4db4c80

SHA512
c719f5adf610599f0e57df5241da9b3fb595839fcbf955acbf4007ebc75d400916cec75cf9f24f72be6118237641c7800ae9b4c28b585b71a63d02a5789ca044

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
65b912603309f69a95f5252e535980f2

SHA1
673f15f4e8163ab6abc1e91823b489dd30b96321

SHA256
4c0e395804de2c389ac4ab261c69b920f2474bb6fe16cc10c14d5213910f9ed3

SHA512
4642eac25cc751a65debaae18b65a76a3a7d9e5d9c659ca0fa5d1975d0ec0b43bf9b656d6d23c2c93b231e41e8153c55c1cc18bcd91be0dc5e95831b71160c04

Download Submit
memory/1064-13-0x0000026DAE0A0000-0x0000026DAE0C2000-memory.dmp

Filesize
136KB

Download
memory/1428-199-0x0000023CC7A40000-0x0000023CC7AF3000-memory.dmp

Filesize
716KB

Download
memory/1428-201-0x0000023CC7CC0000-0x0000023CC7CDA000-memory.dmp

Filesize
104KB

Download
memory/1428-200-0x0000023CC7C60000-0x0000023CC7C6E000-memory.dmp

Filesize
56KB

Download
memory/1756-222-0x000002122B2B0000-0x000002122B363000-memory.dmp

Filesize
716KB

Download
memory/2476-65-0x00007FF71EB50000-0x00007FF71EB60000-memory.dmp

Filesize
64KB

Download
memory/2476-64-0x00007FF71EB40000-0x00007FF71EB50000-memory.dmp

Filesize
64KB

Download
memory/3552-86-0x0000011BEBFE0000-0x0000011BEBFFC000-memory.dmp

Filesize
112KB

Download
memory/3552-94-0x0000011BEC370000-0x0000011BEC37A000-memory.dmp

Filesize
40KB

Download
memory/3552-93-0x0000011BEC360000-0x0000011BEC366000-memory.dmp

Filesize
24KB

Download
memory/3552-92-0x0000011BEC330000-0x0000011BEC338000-memory.dmp

Filesize
32KB

Download
memory/3552-91-0x0000011BEC380000-0x0000011BEC39A000-memory.dmp

Filesize
104KB

Download
memory/3552-90-0x0000011BEC320000-0x0000011BEC32A000-memory.dmp

Filesize
40KB

Download
memory/3552-89-0x0000011BEC340000-0x0000011BEC35C000-memory.dmp

Filesize
112KB

Download
memory/3552-88-0x0000011BEC1C0000-0x0000011BEC1CA000-memory.dmp

Filesize
40KB

Download
memory/3552-87-0x0000011BEC000000-0x0000011BEC0B3000-memory.dmp

Filesize
716KB

Download
memory/4756-255-0x00007FF68D630000-0x00007FF68DF5C000-memory.dmp

Filesize
9.2MB

Download