653d46b5d17c5fd51248e6dde5adc57a5d7621299b7561cecf2479464da44efd

Resubmissions

12/06/2024, 04:57

240612-flpr1a1flp 6

12/06/2024, 04:52

240612-fhvtva1eqd 6

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$_4_.msi
Size

68.0MB
MD5

d338244a4c63c6829ba63a436cd96bca
SHA1

cf5b67a36f27990ae89933913b8e09c48360837c
SHA256

c04393d32a045faa0940dc56f91d456935060cfa995cf3caee948ef09ab5cd33
SHA512

ac5ed089a9ca48a7a997cf6053d7a8dec41b729f1ee456051ffc23373425bf62a2f82df9027176fa614b39c335ca86b4e23633fe50359fc0392a54ff47744b46
SSDEEP

393216:wst/V4e0wTkW4rjtNkWbNUz6sdhq1Dzw7RvPm0DMFGwyZyjVhlwdLnoIXXsagvHs:wUqWYXkW5Ujqhzw7RvtYrHs9os

Score

6^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	348	msiexec.exe
7	2620	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PingPlotter 5\System.Globalization.Calendars.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Net.Security.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Collections.Specialized.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\SQLitePCLRaw.core.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Buffers.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Extensions\RemoteAgentScript\package.json	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.Extensions.Caching.Memory.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.IO.Pipes.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\IpHlpApidotnet.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Diagnostics.TextWriterTraceListener.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.SignalR.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\LiteHtmlSharp.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Http.Features.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\x86\e_sqlite3.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.EntityFrameworkCore.Proxies.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Authorization.Policy.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.ServiceModel.Primitives.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\qvsntoj3kv.dat	PingPlotter.exe
File created	C:\Program Files (x86)\PingPlotter 5\Extensions\AlertAction_LaunchAnExecutable\launchanexecutable.js	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Resources\pngcrush.exe	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Diagnostics.Tracing.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Server.Kestrel.Https.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\PingPlotter ICMP Generator.exe.config	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Persistence.Sqlite.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\GalaSoft.MvvmLight.Platform.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Http.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Xml.XmlDocument.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\MathNet.Numerics.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\ExposedObject.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Windows.Interactivity.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.IO.Pipelines.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Authentication.Cookies.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Linq.Expressions.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Threading.Tasks.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Collections.NonGeneric.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Nito.AsyncEx.Tasks.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Extensions\AlertAction_LaunchAnExecutable\launchanexecutable.meta.json	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Mvc.DataAnnotations.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\MessagePack.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\protobuf-net.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\netstandard.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Threading.Overlapped.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.Extensions.Configuration.Binder.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Resources.Reader.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.Diagnostics.Runtime.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\ParallelExtensionsExtras.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.EntityFrameworkCore.Design.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Globalization.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.IO.Compression.ZipFile.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\PingPlotter ICMP Generator.exe	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.Shared.Wpf.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.DataGrid.Contrib.Wpf.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Mvc.Formatters.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.ComponentModel.TypeConverter.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Runtime.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Runtime.Serialization.Xml.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Alert Audio\buzzer.mp3	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Threading.ThreadPool.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.PropertyGrid.Wpf.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Extensions\MOSColumn\default_settings.json	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Castle.Core.dll	msiexec.exe

Drops file in Windows directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI1864.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{CBAA9826-6D34-44FF-AEBF-E880F91CADCE}\ext.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA6B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4DA.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI34F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI46C.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\MSI17E5.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI3BE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{CBAA9826-6D34-44FF-AEBF-E880F91CADCE}\SystemFoldermsiexec.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\f76fd82.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI5B7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI39E.tmp	msiexec.exe
File created	C:\Windows\Installer\f76fd84.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB28.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Installer\f76fd81.msi	msiexec.exe
File created	C:\Windows\Installer\f76fd82.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI529.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIED.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB08.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\MSI207.tmp	msiexec.exe
File created	C:\Windows\Installer\{CBAA9826-6D34-44FF-AEBF-E880F91CADCE}\ext.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6D1.tmp	msiexec.exe
File created	C:\Windows\Installer\{CBAA9826-6D34-44FF-AEBF-E880F91CADCE}\SystemFoldermsiexec.exe	msiexec.exe
File created	C:\Windows\Installer\f76fd81.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3FE.tmp	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
1952	PingPlotter.exe
1060	PingPlotter.exe

Loads dropped DLL 22 IoCs

pid	Process
2596	MsiExec.exe
2596	MsiExec.exe
2596	MsiExec.exe
2596	MsiExec.exe
2596	MsiExec.exe
2596	MsiExec.exe
2596	MsiExec.exe
2428	MsiExec.exe
2428	MsiExec.exe
2428	MsiExec.exe
2428	MsiExec.exe
2428	MsiExec.exe
2428	MsiExec.exe
2428	MsiExec.exe
2428	MsiExec.exe
2428	MsiExec.exe
1804	MsiExec.exe
1804	MsiExec.exe
1804	MsiExec.exe
1804	MsiExec.exe
1804	MsiExec.exe
2428	MsiExec.exe

Modifies data under HKEY_USERS 51 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Pingman Tools\PingPlotter 5\License = 411880bf66de892c79882f0f97e6657ac089c5e1a2397a1bb845404a4d3d5c5fe316ae9f04f117193f7ca22880d48a77	PingPlotter.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	PingPlotter.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Pingman Tools\PingPlotter 5	PingPlotter.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Pingman Tools\PingPlotter 5	PingPlotter.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Pingman Tools	PingPlotter.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\pingplotter\DefaultIcon\ = "C:\\Program Files (x86)\\PingPlotter 5\\PingPlotter.exe,1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\shell\open\command\ = "\"C:\\Program Files (x86)\\PingPlotter 5\\PingPlotter.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\pingplotter\ = "URL:PingPlotter Protocol Handler"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pingplotter\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6289AABC43D6FF44EAFB8E089FC1DAEC\WebInterface = "PingPlotter5Main"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ppws	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\DefaultIcon\ = "C:\\Windows\\Installer\\{CBAA9826-6D34-44FF-AEBF-E880F91CADCE}\\ext.exe,0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\shell\ = "open"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pp2	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pingplotter\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6289AABC43D6FF44EAFB8E089FC1DAEC\PingPlotter5Main	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\PackageCode = "D9266175463576C49929C4305A953AF8"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\ProductIcon = "C:\\Windows\\Installer\\{CBAA9826-6D34-44FF-AEBF-E880F91CADCE}\\ext.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BDE4C0E5F8F1D9E448B630CA83009281	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\shell\open\ = "&Open PingPlotter Sample Set"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\pingplotter	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pingplotter\shell\open	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\Version = "85458947"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\SourceList\PackageName = "$_4_.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pp2\ = "Pingman Tools.PingPlotter 5.pp2"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\pingplotter\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pp2\Pingman Tools.PingPlotter 5.pp2\ShellNew	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\pingplotter\DefaultIcon	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|PingPlotter 5\|PingPlotter.exe\PingPlotter,Version="5.24.3.8913",Culture="neutral",ProcessorArchitecture="MSIL" = 5e00780078004e006a0064002c00790032003d0055006a0060004c00510066002b0032004c006b00500069006e00670050006c006f00740074006500720035004d00610069006e003e003700250067003300240058007e0037006000410051007a005e004e00750077002600330070002d0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6289AABC43D6FF44EAFB8E089FC1DAEC\FirewallICMPforUDP = "PingPlotter5Main"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\shell\open\command\ = "\"C:\\Program Files (x86)\\PingPlotter 5\\PingPlotter.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\pingplotter\URL Protocol	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pp2\Pingman Tools.PingPlotter 5.pp2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BDE4C0E5F8F1D9E448B630CA83009281\6289AABC43D6FF44EAFB8E089FC1DAEC	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6289AABC43D6FF44EAFB8E089FC1DAEC	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\shell\open\command\command = 5e00780078004e006a0064002c00790032003d0055006a0060004c00510066002b0032004c006b00500069006e00670050006c006f00740074006500720035004d00610069006e003e003700250067003300240058007e0037006000410051007a005e004e00750077002600330070002d002000220025003100220000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pingplotter	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\ = "PingPlotter Workspace"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6289AABC43D6FF44EAFB8E089FC1DAEC\Scripts = "PingPlotter5Main"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6289AABC43D6FF44EAFB8E089FC1DAEC\WindowsService = "\x06"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\shell\open	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\shell\open\command\command = 5e00780078004e006a0064002c00790032003d0055006a0060004c00510066002b0032004c006b00500069006e00670050006c006f00740074006500720035004d00610069006e003e003700250067003300240058007e0037006000410051007a005e004e00750077002600330070002d002000220025003100220000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\ = "PingPlotter Sample Set"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\ProductName = "PingPlotter 5"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\shell\open\ = "&Open PingPlotter workspace"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ppws\ = "Pingman Tools.PingPlotter 5.ppws"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\pingplotter\shell\open\command\ = "\"C:\\Program Files (x86)\\PingPlotter 5\\PingPlotter.exe\" /url \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\DefaultIcon	msiexec.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2620	msiexec.exe
2620	msiexec.exe
2428	MsiExec.exe
1804	MsiExec.exe
1804	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	348	msiexec.exe
Token: SeIncreaseQuotaPrivilege	348	msiexec.exe
Token: SeRestorePrivilege	2620	msiexec.exe
Token: SeTakeOwnershipPrivilege	2620	msiexec.exe
Token: SeSecurityPrivilege	2620	msiexec.exe
Token: SeCreateTokenPrivilege	348	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	348	msiexec.exe
Token: SeLockMemoryPrivilege	348	msiexec.exe
Token: SeIncreaseQuotaPrivilege	348	msiexec.exe
Token: SeMachineAccountPrivilege	348	msiexec.exe
Token: SeTcbPrivilege	348	msiexec.exe
Token: SeSecurityPrivilege	348	msiexec.exe
Token: SeTakeOwnershipPrivilege	348	msiexec.exe
Token: SeLoadDriverPrivilege	348	msiexec.exe
Token: SeSystemProfilePrivilege	348	msiexec.exe
Token: SeSystemtimePrivilege	348	msiexec.exe
Token: SeProfSingleProcessPrivilege	348	msiexec.exe
Token: SeIncBasePriorityPrivilege	348	msiexec.exe
Token: SeCreatePagefilePrivilege	348	msiexec.exe
Token: SeCreatePermanentPrivilege	348	msiexec.exe
Token: SeBackupPrivilege	348	msiexec.exe
Token: SeRestorePrivilege	348	msiexec.exe
Token: SeShutdownPrivilege	348	msiexec.exe
Token: SeDebugPrivilege	348	msiexec.exe
Token: SeAuditPrivilege	348	msiexec.exe
Token: SeSystemEnvironmentPrivilege	348	msiexec.exe
Token: SeChangeNotifyPrivilege	348	msiexec.exe
Token: SeRemoteShutdownPrivilege	348	msiexec.exe
Token: SeUndockPrivilege	348	msiexec.exe
Token: SeSyncAgentPrivilege	348	msiexec.exe
Token: SeEnableDelegationPrivilege	348	msiexec.exe
Token: SeManageVolumePrivilege	348	msiexec.exe
Token: SeImpersonatePrivilege	348	msiexec.exe
Token: SeCreateGlobalPrivilege	348	msiexec.exe
Token: SeCreateTokenPrivilege	348	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	348	msiexec.exe
Token: SeLockMemoryPrivilege	348	msiexec.exe
Token: SeIncreaseQuotaPrivilege	348	msiexec.exe
Token: SeMachineAccountPrivilege	348	msiexec.exe
Token: SeTcbPrivilege	348	msiexec.exe
Token: SeSecurityPrivilege	348	msiexec.exe
Token: SeTakeOwnershipPrivilege	348	msiexec.exe
Token: SeLoadDriverPrivilege	348	msiexec.exe
Token: SeSystemProfilePrivilege	348	msiexec.exe
Token: SeSystemtimePrivilege	348	msiexec.exe
Token: SeProfSingleProcessPrivilege	348	msiexec.exe
Token: SeIncBasePriorityPrivilege	348	msiexec.exe
Token: SeCreatePagefilePrivilege	348	msiexec.exe
Token: SeCreatePermanentPrivilege	348	msiexec.exe
Token: SeBackupPrivilege	348	msiexec.exe
Token: SeRestorePrivilege	348	msiexec.exe
Token: SeShutdownPrivilege	348	msiexec.exe
Token: SeDebugPrivilege	348	msiexec.exe
Token: SeAuditPrivilege	348	msiexec.exe
Token: SeSystemEnvironmentPrivilege	348	msiexec.exe
Token: SeChangeNotifyPrivilege	348	msiexec.exe
Token: SeRemoteShutdownPrivilege	348	msiexec.exe
Token: SeUndockPrivilege	348	msiexec.exe
Token: SeSyncAgentPrivilege	348	msiexec.exe
Token: SeEnableDelegationPrivilege	348	msiexec.exe
Token: SeManageVolumePrivilege	348	msiexec.exe
Token: SeImpersonatePrivilege	348	msiexec.exe
Token: SeCreateGlobalPrivilege	348	msiexec.exe
Token: SeCreateTokenPrivilege	348	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
348	msiexec.exe
348	msiexec.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2596	2620	msiexec.exe	29
PID 2620 wrote to memory of 2596	2620	msiexec.exe	29
PID 2620 wrote to memory of 2596	2620	msiexec.exe	29
PID 2620 wrote to memory of 2596	2620	msiexec.exe	29
PID 2620 wrote to memory of 2596	2620	msiexec.exe	29
PID 2620 wrote to memory of 2596	2620	msiexec.exe	29
PID 2620 wrote to memory of 2596	2620	msiexec.exe	29
PID 2620 wrote to memory of 2428	2620	msiexec.exe	35
PID 2620 wrote to memory of 2428	2620	msiexec.exe	35
PID 2620 wrote to memory of 2428	2620	msiexec.exe	35
PID 2620 wrote to memory of 2428	2620	msiexec.exe	35
PID 2620 wrote to memory of 2428	2620	msiexec.exe	35
PID 2620 wrote to memory of 2428	2620	msiexec.exe	35
PID 2620 wrote to memory of 2428	2620	msiexec.exe	35
PID 2620 wrote to memory of 1804	2620	msiexec.exe	36
PID 2620 wrote to memory of 1804	2620	msiexec.exe	36
PID 2620 wrote to memory of 1804	2620	msiexec.exe	36
PID 2620 wrote to memory of 1804	2620	msiexec.exe	36
PID 2620 wrote to memory of 1804	2620	msiexec.exe	36
PID 2620 wrote to memory of 1804	2620	msiexec.exe	36
PID 2620 wrote to memory of 1804	2620	msiexec.exe	36
PID 1804 wrote to memory of 808	1804	MsiExec.exe	37
PID 1804 wrote to memory of 808	1804	MsiExec.exe	37
PID 1804 wrote to memory of 808	1804	MsiExec.exe	37
PID 1804 wrote to memory of 808	1804	MsiExec.exe	37
PID 808 wrote to memory of 2276	808	cmd.exe	39
PID 808 wrote to memory of 2276	808	cmd.exe	39
PID 808 wrote to memory of 2276	808	cmd.exe	39
PID 808 wrote to memory of 2276	808	cmd.exe	39
PID 1804 wrote to memory of 2200	1804	MsiExec.exe	40
PID 1804 wrote to memory of 2200	1804	MsiExec.exe	40
PID 1804 wrote to memory of 2200	1804	MsiExec.exe	40
PID 1804 wrote to memory of 2200	1804	MsiExec.exe	40
PID 1804 wrote to memory of 1716	1804	MsiExec.exe	42
PID 1804 wrote to memory of 1716	1804	MsiExec.exe	42
PID 1804 wrote to memory of 1716	1804	MsiExec.exe	42
PID 1804 wrote to memory of 1716	1804	MsiExec.exe	42
PID 1804 wrote to memory of 1284	1804	MsiExec.exe	45
PID 1804 wrote to memory of 1284	1804	MsiExec.exe	45
PID 1804 wrote to memory of 1284	1804	MsiExec.exe	45
PID 1804 wrote to memory of 1284	1804	MsiExec.exe	45
PID 2620 wrote to memory of 1952	2620	msiexec.exe	47
PID 2620 wrote to memory of 1952	2620	msiexec.exe	47
PID 2620 wrote to memory of 1952	2620	msiexec.exe	47
PID 2620 wrote to memory of 1060	2620	msiexec.exe	49
PID 2620 wrote to memory of 1060	2620	msiexec.exe	49
PID 2620 wrote to memory of 1060	2620	msiexec.exe	49

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\$_4_.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:348

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F352532781A0A424C94D2E81BBDCD986 C
  2⤵
  - Loads dropped DLL
  PID:2596
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 96A76E5D8E7228058C24B7C0DC51A7BA
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2428
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F8B61BE9C04289D776C70F54A5158557 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\SysWOW64\cmd.exe
    /C "C:\Users\Admin\AppData\Local\Temp\{1DC67473-A1D4-41E5-A7F6-05AEF94AFCC5}.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:808
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:2276
- - C:\Windows\SysWOW64\cmd.exe
    /C "C:\Users\Admin\AppData\Local\Temp\{1DC67473-A1D4-41E5-A7F6-05AEF94AFCC5}.bat"
    3⤵
    PID:2200
- - C:\Windows\SysWOW64\cmd.exe
    /C "C:\Users\Admin\AppData\Local\Temp\{1DC67473-A1D4-41E5-A7F6-05AEF94AFCC5}.bat"
    3⤵
    PID:1716
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe" /queue:1
    3⤵
    - Drops file in Windows directory
    PID:1284
- C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe
  "C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe" regserver initializeprofile quiet
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  PID:1952
- C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe
  "C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe" regserver quiet
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:1060

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2784

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000002C8" "00000000000005B0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2092

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f76fd83.rbs

Filesize
2.1MB

MD5
a220124d08c3efe8e058449a2e5450fa

SHA1
56cb72f65c8389750a02f58ac686e4159c52436f

SHA256
67d69f0faa0349e85d77164d1c66eb2ae5c335080801b7dbddf39e1a22b3d58b

SHA512
d0a7b3e20caa8cf122f9d8fa9f5dad44e9754c5c6ccda79944069738c2987ab39bf2779ba3264a4180bd412bcfed2a291dac700470932b44c22b448f8d1cd319

Download Submit
C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.DataGrid.Contrib.Wpf.dll

Filesize
87KB

MD5
9c43eb18df357b00aaf31b6684e57a53

SHA1
6de6fc5c23b5ef38eb2faab1eb643c3161c2e9f6

SHA256
abf2ec51aff791bee7580e77502a90b28aa034d2e729580e0d2b10d7ee296fd6

SHA512
fea50d9884aef63e24546d0947608fee8fb3aad6b0f8b5a02fdf5fead5564c2d8f16828fae1c182f1350b209a8a9b2e99201822957c36787b6ff36d266412309

Download Submit
C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.Docking.Wpf.dll

Filesize
677KB

MD5
b9d27fbdd161b1879aa1b5bf390b8114

SHA1
1e9ffc3fcefc25581fd726087c74d257c713ffe4

SHA256
3866414e85e128dd761a894b63befed29fded32788ab79087d0abc79335f17a4

SHA512
4af0057663f74f65af501ec45bed8cc75e225395b1acbd318220cd97eb28123b3b7290c34b865129edc20255c6876c58c25308ae1a458a97f5df285f5a2444c6

Download Submit
C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.Editors.Wpf.dll

Filesize
929KB

MD5
6f0e2870c72222d5989e9842d7d9e275

SHA1
9a847f1d5efe181c945c60bcfeeb43132db3f599

SHA256
b637f6e4c87ac32276f92c609ee71bb3d482b36d5516e383e5c52d8f615359e8

SHA512
ff99918d8a8510d70d250695a583deb91953f6db2abf2a71069a2d67932532977529d3a50ec012cd4547a03601cf8f5367592187768fe4d8aa5a80d8dacfda0d

Download Submit
C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.PropertyGrid.Wpf.dll

Filesize
315KB

MD5
3e50933e28b0ac08f7158e3a783f6bf4

SHA1
2178728de734670785b749499e4cfda7e1e30f60

SHA256
7d0ee0f0aad53788758a43ccf295cad4b8e6afae6815f2a2800033b29b81c14a

SHA512
3324d40fdc9a82915b8323f5386d00361bea8ae42aa79fc85b4d9d95a087fbadfc557d9f77e34938ef4fdc8b04d0e6a9f24bbfca6569d981cf404626fb2eb7f6

Download Submit
C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.Shared.Wpf.dll

Filesize
1.9MB

MD5
674447f18caace5e1163fb227e4cf08d

SHA1
62082108201e8be712cd52806a66503cf51fe714

SHA256
56dfde9007145d5f6ed21730ecbb5ac04e7c6bc1370fb317acb0e29bffaf5c84

SHA512
89fcdc36bd040a554a3bf8be205541914a00e0eed741eed066831d7564fa0f2ede717fb21d1e85e9503d9d262145d2fef837e37ed40087bb7386159fa5411bb8

Download Submit
C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.SyntaxEditor.Wpf.dll

Filesize
1.1MB

MD5
855914201fde2285b71d87c05c4bbcc2

SHA1
8bc1bdbb97c2775c0399e9d0e90a036f41357a4c

SHA256
580a06e4ff57218280a92877d2b5def390b563c86a16366882cfee5d30951bd6

SHA512
7040fcb1fa29171f10e9a6400deae3283a078899eb21c969d9fde51136ab5002d2cc95ef9b37ea1647fd28c18df1f1776bd80d12b16703a9b15f2776d97b7fbb

Download Submit
C:\Program Files (x86)\PingPlotter 5\CoreLib.dll

Filesize
2.2MB

MD5
4f79b56c4bebf4683f731c2fa68126ce

SHA1
be502d11260c83f3bdb67279f796b137094248b6

SHA256
28130a2c33fd8ac4a915bd2a695b1160e61ad179136860675b42bbebc878bb63

SHA512
3384c07d2378e87d9e7e85f5db6af6bbfe804b559057339b04fda64e744344255da4d309a75efed9ec3246afbb852d4b4dde9baa7d2a783230f25a56d5f6294f

Download Submit
C:\Program Files (x86)\PingPlotter 5\NGraphics.Net.dll

Filesize
24KB

MD5
50f77484e5ebbab4178d226457277f61

SHA1
f9ce26a5dac69bc620481e76ff4bcaa44610b4f1

SHA256
76a4ee07ad63c27d6d95b9e0cc9a903563514e9b8fb51744646a19e00c3175a5

SHA512
f094291b6097608443d168d7cc5cd6a288f98f6bdb418e22d6f606ea2f54a6c6c166f13fedd827a79e8812d598e4fca1d59f50af17264f80e8dd3621856c77da

Download Submit
C:\Program Files (x86)\PingPlotter 5\NGraphics.WPF.dll

Filesize
25KB

MD5
c15a90b02588f3c2e92086d729268d9a

SHA1
f3917545b0d2f1784d6c677940e184a8bdf199d7

SHA256
64c10c0c8c7e80b8697d395f4c89622f5323d89a1b5ae5bb5c2436d2b614667e

SHA512
821986403f4c2d96413f3b2f81ff570198d4445f6cbb5fca38dc43ce4f2f6d7fd571cec70ef047e93e24f32b2069695435344523ff3390d40a6a400e71144407

Download Submit
C:\Program Files (x86)\PingPlotter 5\NGraphics.dll

Filesize
100KB

MD5
36896e5b8ff559857c870c8d60470d79

SHA1
8abe9941ec44d19b2f079fa66c118d60ecd75141

SHA256
57f963ae4825b02214ccae01276708613cdda30d74c50289972f4a16bea3d823

SHA512
ddbd19c34fe0b38958778cb8e01ec0daf22882a5db774f24d5fbaf3f18938f71f48b55d6b8ed1d31ac31086d416c65f3e410168c891295412a3d67cbbf781793

Download Submit
C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe

Filesize
2.9MB

MD5
aea6964efb6bfc8723f85e191c6db9b0

SHA1
f213e8ae0088838ae76d9d5841f9e9a2376c78a9

SHA256
89a3e51a67ef4684952ab912be4e9fd379b4cf46991d6c17c6e59d34f6ec5eac

SHA512
84a8587ccc35cdb2392f2de20a7323bf626bfdef0cc1ba6957273921aa8336086edd58689fac446e342d3ecb9f0a00e7dd2dbb2e5de223a5b6a42e75d845ab8a

Download Submit
C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe.config

Filesize
27KB

MD5
928b8e104bc50973bad9150c577aaa64

SHA1
33eb7ed6547d26bbb8dbb087a45baf41292d01d2

SHA256
b42eb2bb81f89946449c5b27315afec9c87070ac01a6d0d1df91bd9d46702629

SHA512
3b8ac3ce5365b27c8156dfb1ccfeff4f8a0e3b10360c2e5639d3516f2b5aa3c2dc524ddbbd6e3d1941ae0d15f8867eb2e19a0df1c31d1872d25f7758c481cff2

Download Submit
C:\Program Files (x86)\PingPlotter 5\System.IO.dll

Filesize
15KB

MD5
ba3845f4986d242d62641e1f6e14caba

SHA1
9278fe4d60ed3462835a90c56bf187cadc35ddda

SHA256
ab5d0fa375fd11f411293552ffa7b127a62ecc7bef74c5c3a49cad629413e38b

SHA512
4ccc206b30208cf1ceef1e7341cf7f28e36f3ba90daff5051ee706841a1f30d49d654399c33b2d336d330789b76e5d3fac39d22d6d45d6d76a3ef643750a70cf

Download Submit
C:\Program Files (x86)\PingPlotter 5\System.Runtime.dll

Filesize
23KB

MD5
351865b759999ab60da018c38878662d

SHA1
2c6d09dfe7a95f78af5b27d0ffab491ca47dc2e5

SHA256
cfc8576cd3f50e93ead20e4a08cb1623e95cd928e5afcbaab9ad8ec1eba2528d

SHA512
7e329b5072fe7eb47871368a357643a4ec59576c0c7dfd2a48b671a33c9fb2fdf24198540ca283797ec2b274946c33f99d10d6b5aa5174872369aa5b58677f3b

Download Submit
C:\Program Files (x86)\PingPlotter 5\System.Threading.Tasks.dll

Filesize
16KB

MD5
e7120b5779730efb615235cf0107e386

SHA1
455ea9f216bbfcd1876f142d7a1b634fd85ef819

SHA256
ace34e85a2e954ed07ec11390cbdea7097ae4e56efd8b1bcef35788ce08c6777

SHA512
91f893b93d771eb1ac9b9f666561375da5c9a282bf778bca76489306f8aa398fd31bfa59eaeca2f1b1b16a598dc0f5cfa9d3f3d98b0a4cd2ec9fd5539bc3efb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
2eee3865f16574bb2c8058a2b4977995

SHA1
9e65c7b29d8a121cbd4dbdd24161113b7ec774f2

SHA256
6de01a7f89ac9c20580975e0f3163a4d355006395a615c71d86c7d0c7c5c007e

SHA512
3ec5e1000906b083f0366703a8e660360c80c2c2706beddb2f0976fda723596f955ab9e75f0d5328d02755279cf28e4dd4fc29ae334901eb986e84b9b58cb2c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_B5408224970389A1C2D228B1F06E63F2

Filesize
727B

MD5
36f5d03cd7b13e5fe0e915b00f4034e9

SHA1
c989899d4758051248cbb3edf7300aa356b176ca

SHA256
91e9646cae08070083e277fed6d82a39ad9f8ac15e3dfc5f13c893dbc95099d7

SHA512
b8ec8a218e62b3de3f63a6de399c438f19f378f3c6fbcf386d2e7719255f8d26c3133bbba6b008ad2a7f22054db2011f4ebd48a50b64bf9500bc2cc68f532238

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
f3caf7a7e82ca0c660532a49d65858d4

SHA1
34a5babef00151e28ac420f3b84cd90a5e5ac99f

SHA256
cdb6c2f46d77119c126ad9b9be53fc57c3fa834e25fe0ae73a8398f10a18701e

SHA512
3b3e3f4de4fc948bb15b8ca5f7e4c630deea291092132878a91968501c407057e8be2405b2c6ada56e63682acd1bb27f897480c2ece2680212da66b3287607c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
04560e031fd7f9563d5f513b02dd6dcc

SHA1
41ec5b00546dd2381d7ef81a54f7665919e55492

SHA256
1f1806e8c3d982c16b35d2ef5f7b2ba08abd6290df0ca189e7050410bc2bc8de

SHA512
6f29bafa2776a982ff4b21d56eb1c670a7470d3dac1335de22810ef4f04744ff230647662db3a96ad4e92db84e9edd7e68dbb48cb0616d71cd628a8f455ce79b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_B5408224970389A1C2D228B1F06E63F2

Filesize
408B

MD5
9853099f01ac4f1daf69213c4457ead3

SHA1
489a280ea8f959c2a0497d5b78c0a4d5a837b98b

SHA256
a9fb8b63992d83f5f216be6a9393270aabbaeb03fca59fc82ad13e99e3556ed8

SHA512
43ac89702d7f53f501a6364151053bd4ad17caa370fc853b0b749f8b2c7647af5bb00d767efa33240b4f6fc85a76b7409b75929fb991534c39639a7a843991db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
428ea7f238682528145e65f3eee89b4e

SHA1
2cecdb829b1bca26bc65eba00dc81f6797080131

SHA256
f431509f0731518a4bd8a3e2f9042720c076afc099f908310400718cd6294194

SHA512
0a4fc7d40b72c7494740b4edc938df60eef9d9a5f04f9fa2626cc751f3e4fa59b7b5c9fc38e063ee80ad528efc3c900469178e58530caa497d0ae3f12c1585f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
7b201f6b1d9a5bc0fb792fd0da8762bd

SHA1
5b75892b727a2424b19aa5c181665fd5c153a022

SHA256
1fe5ae1e5467543edd091f942583e1d19f1c489fe1e299034479f1775de027e2

SHA512
cb5ca799100e09de47fa86ae56349e11b8c2588f61053b0df632ac66024718fc33ba9e3a2dc7ccb5a4b301a7caed1f2fb482318b66911317b3d752d3616f7cce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1FF1.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI2208.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI23A1.tmp

Filesize
561KB

MD5
5576bf4d22dc695564e49a68cbc98bc2

SHA1
80e0e045162a65d84939e22a821ecbbbde3f31d6

SHA256
20f76ffd846155a41633d75cb2e784e54f6ec77ca9ca9d52d9510c3e2e918801

SHA512
4b952ce6ef08c86d8594fadd1069c3af39c3465314716dc7e7d9937befab8f4db5e4920a901920af4f937e5bb80ca02c33406d54cc766920b8ebba3855500972

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar218A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\k6uw8zvfvb.tmp

Filesize
48B

MD5
c30592a9bf4b648e81780bec7ddc9889

SHA1
43e319088483afd479d82d24b1fd1d6c9f3f17b8

SHA256
54a3899a84898c9e10eb78a9c50d37572e3f9769ff69d53ea2c43f7500954602

SHA512
1b7075843a97d7db22ade059cb85f2f05404980faa7008845f007ddc1adcbe4aacfb0952becc28f2daece8c85a97c65953a3a315eb612d8486d017ad428e17d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\k6uw8zvfvb.tmp

Filesize
48B

MD5
860e71a1d9021d02fe43ce9b12582d56

SHA1
d17b0d6207c8b1b21b64b98630cd8c09a3fd72eb

SHA256
c55fd0ee823e3b9aaa33454df9c884f20ddb8023870cb5fd3fc07a9addffd9cb

SHA512
779c361d2f328e2beb01a978824436af6e918c89ec38a63ba224cef680d003fbeeed78605b104fdae691081dbba6090d51250efd0b8e6b3f273842a3fee3e95f

Download Submit
C:\Users\Admin\AppData\Local\Temp\{1DC67473-A1D4-41E5-A7F6-05AEF94AFCC5}.bat

Filesize
104B

MD5
a33978158c4b6efd7eefae0fa8bd6505

SHA1
6a6eaad0812c0a9b8416d2af5ecdb9685dfdeba1

SHA256
029cac49e9ee7d9c9bbfebe663005c745c87e9f59e16b48d8cb5c1104316b781

SHA512
36773a2363b6dfab25937a1a040f9427d5613fd5d65fb53ba1cdf02dd110c2fd5a7c1353de40fbd11b91de20fa7a3e264abeba345fd57d2357070f6699288013

Download Submit
C:\Windows\Installer\MSI39E.tmp

Filesize
195KB

MD5
71c143221c4d2f06e495ee3f9e51a7f0

SHA1
44a3aa0ca190243d6f21becbd5b0c5e923426135

SHA256
8d245ef042215b0e9211692c7deaef442f4d46bd5323d74aa1bf25d676525bd9

SHA512
98a97a4f45cb70eb671ddc3c8d26a9a4c3d34745f0d1b6ee052a2080e1b4b3dac11303eb9a0c8d38e34df624edc28864e52f13e4d79bc16fe9223c5663372445

Download Submit
C:\Windows\Installer\MSI5B7.tmp

Filesize
409KB

MD5
e34827bf55cae867e83cc6122d25154a

SHA1
e513c23028532a6997692965765e235d42d96efa

SHA256
7f8ce80c53a7a4c3cecfbf497ee443538fd126a6e369b9930a3b021db548b55a

SHA512
506143a220f58c4236e4736f404c9421b9d5e0caaa21eff950953258ccf783de3534ea702e476acf565719964da6aeaeed787fca2d66c2b8ef5aa51c9b6e38d2

Download Submit
\Windows\Installer\MSI46C.tmp

Filesize
196KB

MD5
94fa9ff9c26724e0b8ac910c1e7c40aa

SHA1
0cf47957200dec349d6b6da432e24165afd590eb

SHA256
adae076f90908818d67777c050c5b1b6cc94be728017bab6c638dfc7763d4d09

SHA512
becb8229e8ef77a673829c547d2520d6fec94218abf2a21e2948ae5c156bf4a1eb64bfec38653b49902bb31708d9cf770c38f042c1f869d4d4695313b2acfefb

Download Submit
\Windows\Installer\MSI4DA.tmp

Filesize
849KB

MD5
99dc199a4a390a86f2728f5232a2f9a6

SHA1
21b03b2dacbc5e19f3334054703ce53c8ba4a15f

SHA256
12b9deeb6e80129593bae1439bcbc491c6f602bfff255f72eba627100a54e2f9

SHA512
8ba930b0fb37257bbb0d5ea97bbb581ec7d545b737bdce03a78e713b3ad95a2f4b2b6d101817102763100edfe8e46f4532946a7bd3ac24d2142358ac26ec45db

Download Submit
memory/1060-602-0x0000000000AE0000-0x0000000000AE8000-memory.dmp

Filesize
32KB

Download
memory/1060-603-0x0000000000AF0000-0x0000000000AFA000-memory.dmp

Filesize
40KB

Download
memory/1060-620-0x000000001D3F0000-0x000000001D71E000-memory.dmp

Filesize
3.2MB

Download
memory/1060-616-0x000000001C790000-0x000000001C7B4000-memory.dmp

Filesize
144KB

Download
memory/1060-617-0x000000001CF40000-0x000000001CF52000-memory.dmp

Filesize
72KB

Download
memory/1060-615-0x000000001C6D0000-0x000000001C78A000-memory.dmp

Filesize
744KB

Download
memory/1060-614-0x000000001C670000-0x000000001C6BC000-memory.dmp

Filesize
304KB

Download
memory/1060-613-0x000000001B530000-0x000000001B548000-memory.dmp

Filesize
96KB

Download
memory/1060-612-0x000000001B510000-0x000000001B526000-memory.dmp

Filesize
88KB

Download
memory/1060-611-0x0000000002490000-0x00000000024A2000-memory.dmp

Filesize
72KB

Download
memory/1060-609-0x000000001B4D0000-0x000000001B502000-memory.dmp

Filesize
200KB

Download
memory/1060-610-0x000000001C8F0000-0x000000001CEF6000-memory.dmp

Filesize
6.0MB

Download
memory/1060-608-0x000000001B230000-0x000000001B254000-memory.dmp

Filesize
144KB

Download
memory/1060-607-0x000000001AEA0000-0x000000001AECC000-memory.dmp

Filesize
176KB

Download
memory/1060-605-0x000000001C020000-0x000000001C0D2000-memory.dmp

Filesize
712KB

Download
memory/1060-606-0x000000001C0E0000-0x000000001C17C000-memory.dmp

Filesize
624KB

Download
memory/1060-604-0x00000000022B0000-0x00000000022BA000-memory.dmp

Filesize
40KB

Download
memory/1060-598-0x0000000000560000-0x000000000056A000-memory.dmp

Filesize
40KB

Download
memory/1060-599-0x00000000006F0000-0x000000000070C000-memory.dmp

Filesize
112KB

Download
memory/1060-600-0x0000000000710000-0x0000000000718000-memory.dmp

Filesize
32KB

Download
memory/1060-601-0x00000000007A0000-0x00000000007BA000-memory.dmp

Filesize
104KB

Download
memory/1060-592-0x000000001A930000-0x000000001A9DE000-memory.dmp

Filesize
696KB

Download
memory/1060-593-0x000000001BC30000-0x000000001BD1C000-memory.dmp

Filesize
944KB

Download
memory/1060-594-0x000000001BD20000-0x000000001BEFE000-memory.dmp

Filesize
1.9MB

Download
memory/1060-595-0x000000001B470000-0x000000001B4C2000-memory.dmp

Filesize
328KB

Download
memory/1060-596-0x000000001BF00000-0x000000001C016000-memory.dmp

Filesize
1.1MB

Download
memory/1060-597-0x0000000000540000-0x000000000055A000-memory.dmp

Filesize
104KB

Download
memory/1060-590-0x0000000000200000-0x00000000004F0000-memory.dmp

Filesize
2.9MB

Download
memory/1060-591-0x000000001AFE0000-0x000000001B222000-memory.dmp

Filesize
2.3MB

Download
memory/1952-546-0x0000000000170000-0x000000000017A000-memory.dmp

Filesize
40KB

Download
memory/1952-555-0x0000000000D20000-0x0000000000D2A000-memory.dmp

Filesize
40KB

Download
memory/1952-570-0x000000001CF40000-0x000000001CF52000-memory.dmp

Filesize
72KB

Download
memory/1952-569-0x000000001C7D0000-0x000000001C7F4000-memory.dmp

Filesize
144KB

Download
memory/1952-568-0x000000001C670000-0x000000001C72A000-memory.dmp

Filesize
744KB

Download
memory/1952-567-0x000000001C510000-0x000000001C55C000-memory.dmp

Filesize
304KB

Download
memory/1952-534-0x0000000000710000-0x00000000007BE000-memory.dmp

Filesize
696KB

Download
memory/1952-566-0x000000001B7D0000-0x000000001B7E8000-memory.dmp

Filesize
96KB

Download
memory/1952-565-0x000000001B630000-0x000000001B646000-memory.dmp

Filesize
88KB

Download
memory/1952-564-0x000000001B510000-0x000000001B522000-memory.dmp

Filesize
72KB

Download
memory/1952-563-0x000000001C910000-0x000000001CF16000-memory.dmp

Filesize
6.0MB

Download
memory/1952-562-0x000000001B690000-0x000000001B6C2000-memory.dmp

Filesize
200KB

Download
memory/1952-561-0x000000001B660000-0x000000001B684000-memory.dmp

Filesize
144KB

Download
memory/1952-560-0x0000000002650000-0x000000000267C000-memory.dmp

Filesize
176KB

Download
memory/1952-573-0x000000001D3C0000-0x000000001D6EE000-memory.dmp

Filesize
3.2MB

Download
memory/1952-558-0x000000001BDF0000-0x000000001BEA2000-memory.dmp

Filesize
712KB

Download
memory/1952-536-0x000000001AA80000-0x000000001AB6C000-memory.dmp

Filesize
944KB

Download
memory/1952-557-0x0000000000D30000-0x0000000000D3A000-memory.dmp

Filesize
40KB

Download
memory/1952-538-0x000000001BF60000-0x000000001C13E000-memory.dmp

Filesize
1.9MB

Download
memory/1952-559-0x000000001AC80000-0x000000001AD1C000-memory.dmp

Filesize
624KB

Download
memory/1952-540-0x00000000025E0000-0x0000000002632000-memory.dmp

Filesize
328KB

Download
memory/1952-553-0x0000000000D10000-0x0000000000D18000-memory.dmp

Filesize
32KB

Download
memory/1952-544-0x0000000000150000-0x000000000016A000-memory.dmp

Filesize
104KB

Download
memory/1952-551-0x0000000000BF0000-0x0000000000C0A000-memory.dmp

Filesize
104KB

Download
memory/1952-550-0x0000000000180000-0x0000000000188000-memory.dmp

Filesize
32KB

Download
memory/1952-542-0x000000001B100000-0x000000001B216000-memory.dmp

Filesize
1.1MB

Download
memory/1952-548-0x0000000000570000-0x000000000058C000-memory.dmp

Filesize
112KB

Download
memory/1952-532-0x000000001B2C0000-0x000000001B502000-memory.dmp

Filesize
2.3MB

Download
memory/1952-530-0x0000000000DE0000-0x00000000010D0000-memory.dmp

Filesize
2.9MB

Download