653d46b5d17c5fd51248e6dde5adc57a5d7621299b7561cecf2479464da44efd

Resubmissions

12-06-2024 04:57

240612-flpr1a1flp 6

12-06-2024 04:52

240612-fhvtva1eqd 6

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 04:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$_4_.msi
Size

68.0MB
MD5

d338244a4c63c6829ba63a436cd96bca
SHA1

cf5b67a36f27990ae89933913b8e09c48360837c
SHA256

c04393d32a045faa0940dc56f91d456935060cfa995cf3caee948ef09ab5cd33
SHA512

ac5ed089a9ca48a7a997cf6053d7a8dec41b729f1ee456051ffc23373425bf62a2f82df9027176fa614b39c335ca86b4e23633fe50359fc0392a54ff47744b46
SSDEEP

393216:wst/V4e0wTkW4rjtNkWbNUz6sdhq1Dzw7RvPm0DMFGwyZyjVhlwdLnoIXXsagvHs:wUqWYXkW5Ujqhzw7RvtYrHs9os

Score

6^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	1956	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PingPlotter 5\System.Security.Cryptography.Xml.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Resources.ResourceManager.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Remoting.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Resources\Fonts\Roboto\Roboto-Bold.ttf	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.Extensions.FileSystemGlobbing.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Reactive.PlatformServices.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Http.Connections.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Connections.Abstractions.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Nito.Collections.Deque.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Authorization.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\SQLitePCLRaw.provider.e_sqlite3.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Diagnostics.TextWriterTraceListener.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Resources\SplashBundles\cloud_agent.bundle	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\PingPlotter_v5_manual.pdf	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.EntityFrameworkCore.Relational.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Topshelf.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Mvc.Abstractions.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\MsgPack.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Resources\Fonts\Roboto\Roboto-Light.ttf	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Session.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Resources.Reader.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Threading.Timer.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\IdGen.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Resources\SplashBundles\action_target.bundle	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.SyntaxEditor.Addons.JavaScript.Wpf.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.Extensions.Logging.Abstractions.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Diagnostics.Abstractions.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Reactive.Interfaces.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Net.Requests.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\wpl95gklra.dat	PingPlotter.exe
File created	C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.PropertyGrid.Wpf.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\MailKit.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Net.NameResolution.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.Extensions.Logging.Configuration.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Antiforgery.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Runtime.Serialization.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Net.WebSockets.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\SQLitePCLRaw.batteries_v2.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.IO.Compression.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Globalization.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\NGraphics.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.ComponentModel.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.Win32.Registry.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Security.Claims.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Nito.AsyncEx.Interop.WaitHandles.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Chronic.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\MessagePack.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Extensions\AlertAction_LaunchAnExecutable\default_settings.json	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Extensions\RemoteAgentScript\package.json	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Mvc.DataAnnotations.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.Extensions.Configuration.FileExtensions.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\MagHubShared.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Http.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Reactive.Linq.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Authentication.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Mvc.dll	msiexec.exe
File created	C:\Program Files (x86)\wpl95gklra.dat	PingPlotter.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.DataProtection.Abstractions.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\LiteHtmlSharp.Wpf.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Microsoft.AspNetCore.Hosting.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\System.Buffers.dll	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Extensions\MOSColumn\moscolumn.js	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Alert Audio\sonar.mp3	msiexec.exe
File created	C:\Program Files (x86)\PingPlotter 5\Resources\Fonts\Roboto\Roboto-Regular.ttf	msiexec.exe

Drops file in Windows directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\f7678f8.ipi	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI7DFB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7E5C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7EDA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f7678f8.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\f7678f7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI80D1.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Installer\MSI7E1B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7FA6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{CBAA9826-6D34-44FF-AEBF-E880F91CADCE}\SystemFoldermsiexec.exe	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\MSI913B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7B3A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7D8D.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\MSI90EB.tmp	msiexec.exe
File created	C:\Windows\Installer\f7678f7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7C06.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7E4B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F19.tmp	msiexec.exe
File created	C:\Windows\Installer\{CBAA9826-6D34-44FF-AEBF-E880F91CADCE}\SystemFoldermsiexec.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI84CA.tmp	msiexec.exe
File created	C:\Windows\Installer\{CBAA9826-6D34-44FF-AEBF-E880F91CADCE}\ext.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{CBAA9826-6D34-44FF-AEBF-E880F91CADCE}\ext.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI841C.tmp	msiexec.exe
File created	C:\Windows\Installer\f7678fa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI84B9.tmp	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
2580	PingPlotter.exe
2008	PingPlotter.exe

Loads dropped DLL 22 IoCs

pid	Process
2464	MsiExec.exe
2464	MsiExec.exe
2464	MsiExec.exe
2464	MsiExec.exe
2464	MsiExec.exe
2464	MsiExec.exe
2464	MsiExec.exe
1540	MsiExec.exe
1540	MsiExec.exe
1540	MsiExec.exe
1540	MsiExec.exe
1540	MsiExec.exe
1540	MsiExec.exe
1540	MsiExec.exe
1540	MsiExec.exe
1540	MsiExec.exe
1196	MsiExec.exe
1196	MsiExec.exe
1196	MsiExec.exe
1196	MsiExec.exe
1196	MsiExec.exe
1540	MsiExec.exe

Modifies data under HKEY_USERS 51 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Pingman Tools\PingPlotter 5	PingPlotter.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Pingman Tools\PingPlotter 5\License = e7fb7500d3d133a30a5b52e59bce9d0f6b257560e64208388dd10bcc35f4bc5c48e23204f6b9af65a05d39fa95bbeed2	PingPlotter.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Pingman Tools\PingPlotter 5	PingPlotter.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Pingman Tools	PingPlotter.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	PingPlotter.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\shell\open\command\ = "\"C:\\Program Files (x86)\\PingPlotter 5\\PingPlotter.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\shell\ = "open"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\Version = "85458947"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\shell\open\ = "&Open PingPlotter Sample Set"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\shell\open\command\command = 5e00780078004e006a0064002c00790032003d0055006a0060004c00510066002b0032004c006b00500069006e00670050006c006f00740074006500720035004d00610069006e003e003700250067003300240058007e0037006000410051007a005e004e00750077002600330070002d002000220025003100220000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\pingplotter\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pingplotter\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\pingplotter\shell\open\command\ = "\"C:\\Program Files (x86)\\PingPlotter 5\\PingPlotter.exe\" /url \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6289AABC43D6FF44EAFB8E089FC1DAEC\PingPlotter5Main	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6289AABC43D6FF44EAFB8E089FC1DAEC\WebInterface = "PingPlotter5Main"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\ProductIcon = "C:\\Windows\\Installer\\{CBAA9826-6D34-44FF-AEBF-E880F91CADCE}\\ext.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pp2\ = "Pingman Tools.PingPlotter 5.pp2"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\Clients = 3a0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\shell\open\command\command = 5e00780078004e006a0064002c00790032003d0055006a0060004c00510066002b0032004c006b00500069006e00670050006c006f00740074006500720035004d00610069006e003e003700250067003300240058007e0037006000410051007a005e004e00750077002600330070002d002000220025003100220000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ppws	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pp2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\ = "PingPlotter Workspace"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\DefaultIcon\ = "C:\\Windows\\Installer\\{CBAA9826-6D34-44FF-AEBF-E880F91CADCE}\\ext.exe,0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pingplotter	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pingplotter\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\ProductName = "PingPlotter 5"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\pingplotter\DefaultIcon	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|PingPlotter 5\|PingPlotter.exe\PingPlotter,Version="5.24.3.8913",Culture="neutral",ProcessorArchitecture="MSIL" = 5e00780078004e006a0064002c00790032003d0055006a0060004c00510066002b0032004c006b00500069006e00670050006c006f00740074006500720035004d00610069006e003e003700250067003300240058007e0037006000410051007a005e004e00750077002600330070002d0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ppws\Pingman Tools.PingPlotter 5.ppws	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6289AABC43D6FF44EAFB8E089FC1DAEC	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\pingplotter\ = "URL:PingPlotter Protocol Handler"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\pingplotter\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6289AABC43D6FF44EAFB8E089FC1DAEC\Scripts = "PingPlotter5Main"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ppws\ = "Pingman Tools.PingPlotter 5.ppws"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ppws\Pingman Tools.PingPlotter 5.ppws\ShellNew	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|PingPlotter 5\|PingPlotter.exe	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\shell\ = "open"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BDE4C0E5F8F1D9E448B630CA83009281	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BDE4C0E5F8F1D9E448B630CA83009281\6289AABC43D6FF44EAFB8E089FC1DAEC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\SourceList\PackageName = "$_4_.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\shell\open\ = "&Open PingPlotter workspace"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\ = "PingPlotter Sample Set"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pingplotter\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6289AABC43D6FF44EAFB8E089FC1DAEC\PackageCode = "D9266175463576C49929C4305A953AF8"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pp2\Pingman Tools.PingPlotter 5.pp2	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\pingplotter	msiexec.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2688	msiexec.exe
2688	msiexec.exe
1540	MsiExec.exe
1196	MsiExec.exe
1196	MsiExec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1956	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1956	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1956	msiexec.exe
Token: SeRestorePrivilege	2688	msiexec.exe
Token: SeTakeOwnershipPrivilege	2688	msiexec.exe
Token: SeSecurityPrivilege	2688	msiexec.exe
Token: SeCreateTokenPrivilege	1956	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1956	msiexec.exe
Token: SeLockMemoryPrivilege	1956	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1956	msiexec.exe
Token: SeMachineAccountPrivilege	1956	msiexec.exe
Token: SeTcbPrivilege	1956	msiexec.exe
Token: SeSecurityPrivilege	1956	msiexec.exe
Token: SeTakeOwnershipPrivilege	1956	msiexec.exe
Token: SeLoadDriverPrivilege	1956	msiexec.exe
Token: SeSystemProfilePrivilege	1956	msiexec.exe
Token: SeSystemtimePrivilege	1956	msiexec.exe
Token: SeProfSingleProcessPrivilege	1956	msiexec.exe
Token: SeIncBasePriorityPrivilege	1956	msiexec.exe
Token: SeCreatePagefilePrivilege	1956	msiexec.exe
Token: SeCreatePermanentPrivilege	1956	msiexec.exe
Token: SeBackupPrivilege	1956	msiexec.exe
Token: SeRestorePrivilege	1956	msiexec.exe
Token: SeShutdownPrivilege	1956	msiexec.exe
Token: SeDebugPrivilege	1956	msiexec.exe
Token: SeAuditPrivilege	1956	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1956	msiexec.exe
Token: SeChangeNotifyPrivilege	1956	msiexec.exe
Token: SeRemoteShutdownPrivilege	1956	msiexec.exe
Token: SeUndockPrivilege	1956	msiexec.exe
Token: SeSyncAgentPrivilege	1956	msiexec.exe
Token: SeEnableDelegationPrivilege	1956	msiexec.exe
Token: SeManageVolumePrivilege	1956	msiexec.exe
Token: SeImpersonatePrivilege	1956	msiexec.exe
Token: SeCreateGlobalPrivilege	1956	msiexec.exe
Token: SeCreateTokenPrivilege	1956	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1956	msiexec.exe
Token: SeLockMemoryPrivilege	1956	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1956	msiexec.exe
Token: SeMachineAccountPrivilege	1956	msiexec.exe
Token: SeTcbPrivilege	1956	msiexec.exe
Token: SeSecurityPrivilege	1956	msiexec.exe
Token: SeTakeOwnershipPrivilege	1956	msiexec.exe
Token: SeLoadDriverPrivilege	1956	msiexec.exe
Token: SeSystemProfilePrivilege	1956	msiexec.exe
Token: SeSystemtimePrivilege	1956	msiexec.exe
Token: SeProfSingleProcessPrivilege	1956	msiexec.exe
Token: SeIncBasePriorityPrivilege	1956	msiexec.exe
Token: SeCreatePagefilePrivilege	1956	msiexec.exe
Token: SeCreatePermanentPrivilege	1956	msiexec.exe
Token: SeBackupPrivilege	1956	msiexec.exe
Token: SeRestorePrivilege	1956	msiexec.exe
Token: SeShutdownPrivilege	1956	msiexec.exe
Token: SeDebugPrivilege	1956	msiexec.exe
Token: SeAuditPrivilege	1956	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1956	msiexec.exe
Token: SeChangeNotifyPrivilege	1956	msiexec.exe
Token: SeRemoteShutdownPrivilege	1956	msiexec.exe
Token: SeUndockPrivilege	1956	msiexec.exe
Token: SeSyncAgentPrivilege	1956	msiexec.exe
Token: SeEnableDelegationPrivilege	1956	msiexec.exe
Token: SeManageVolumePrivilege	1956	msiexec.exe
Token: SeImpersonatePrivilege	1956	msiexec.exe
Token: SeCreateGlobalPrivilege	1956	msiexec.exe
Token: SeCreateTokenPrivilege	1956	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1956	msiexec.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2464	2688	msiexec.exe	29
PID 2688 wrote to memory of 2464	2688	msiexec.exe	29
PID 2688 wrote to memory of 2464	2688	msiexec.exe	29
PID 2688 wrote to memory of 2464	2688	msiexec.exe	29
PID 2688 wrote to memory of 2464	2688	msiexec.exe	29
PID 2688 wrote to memory of 2464	2688	msiexec.exe	29
PID 2688 wrote to memory of 2464	2688	msiexec.exe	29
PID 2688 wrote to memory of 1540	2688	msiexec.exe	33
PID 2688 wrote to memory of 1540	2688	msiexec.exe	33
PID 2688 wrote to memory of 1540	2688	msiexec.exe	33
PID 2688 wrote to memory of 1540	2688	msiexec.exe	33
PID 2688 wrote to memory of 1540	2688	msiexec.exe	33
PID 2688 wrote to memory of 1540	2688	msiexec.exe	33
PID 2688 wrote to memory of 1540	2688	msiexec.exe	33
PID 2688 wrote to memory of 1196	2688	msiexec.exe	34
PID 2688 wrote to memory of 1196	2688	msiexec.exe	34
PID 2688 wrote to memory of 1196	2688	msiexec.exe	34
PID 2688 wrote to memory of 1196	2688	msiexec.exe	34
PID 2688 wrote to memory of 1196	2688	msiexec.exe	34
PID 2688 wrote to memory of 1196	2688	msiexec.exe	34
PID 2688 wrote to memory of 1196	2688	msiexec.exe	34
PID 1196 wrote to memory of 1460	1196	MsiExec.exe	35
PID 1196 wrote to memory of 1460	1196	MsiExec.exe	35
PID 1196 wrote to memory of 1460	1196	MsiExec.exe	35
PID 1196 wrote to memory of 1460	1196	MsiExec.exe	35
PID 1460 wrote to memory of 1700	1460	cmd.exe	37
PID 1460 wrote to memory of 1700	1460	cmd.exe	37
PID 1460 wrote to memory of 1700	1460	cmd.exe	37
PID 1460 wrote to memory of 1700	1460	cmd.exe	37
PID 1196 wrote to memory of 1948	1196	MsiExec.exe	38
PID 1196 wrote to memory of 1948	1196	MsiExec.exe	38
PID 1196 wrote to memory of 1948	1196	MsiExec.exe	38
PID 1196 wrote to memory of 1948	1196	MsiExec.exe	38
PID 1196 wrote to memory of 1544	1196	MsiExec.exe	40
PID 1196 wrote to memory of 1544	1196	MsiExec.exe	40
PID 1196 wrote to memory of 1544	1196	MsiExec.exe	40
PID 1196 wrote to memory of 1544	1196	MsiExec.exe	40
PID 1196 wrote to memory of 2616	1196	MsiExec.exe	43
PID 1196 wrote to memory of 2616	1196	MsiExec.exe	43
PID 1196 wrote to memory of 2616	1196	MsiExec.exe	43
PID 1196 wrote to memory of 2616	1196	MsiExec.exe	43
PID 2688 wrote to memory of 2580	2688	msiexec.exe	45
PID 2688 wrote to memory of 2580	2688	msiexec.exe	45
PID 2688 wrote to memory of 2580	2688	msiexec.exe	45
PID 2688 wrote to memory of 2008	2688	msiexec.exe	47
PID 2688 wrote to memory of 2008	2688	msiexec.exe	47
PID 2688 wrote to memory of 2008	2688	msiexec.exe	47

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\$_4_.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1956

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DCAA05F1DD4D8C0EE929C2C5BB85A28E C
  2⤵
  - Loads dropped DLL
  PID:2464
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B1BAE7313417295F541B00861703A712
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1540
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9953B291D013A70FCEEBF4E9A85F1B87 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\SysWOW64\cmd.exe
    /C "C:\Users\Admin\AppData\Local\Temp\{2F31F1ED-92A3-4E22-A4B7-E1837DAAFB10}.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1460
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:1700
- - C:\Windows\SysWOW64\cmd.exe
    /C "C:\Users\Admin\AppData\Local\Temp\{2F31F1ED-92A3-4E22-A4B7-E1837DAAFB10}.bat"
    3⤵
    PID:1948
- - C:\Windows\SysWOW64\cmd.exe
    /C "C:\Users\Admin\AppData\Local\Temp\{2F31F1ED-92A3-4E22-A4B7-E1837DAAFB10}.bat"
    3⤵
    PID:1544
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe" /queue:1
    3⤵
    - Drops file in Windows directory
    PID:2616
- C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe
  "C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe" regserver initializeprofile quiet
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  PID:2580
- C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe
  "C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe" regserver quiet
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:2008

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1456

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005A0" "00000000000005A4"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2044

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f7678f9.rbs

Filesize
2.1MB

MD5
7f7d429d6c7e0be6d6d7f71df268d61d

SHA1
31bfc3d9b1635a3d2ff40de57a07a59838a36401

SHA256
d9cda56c85fbc2e25e0f87db4f13349ee9ce0b5d50359ce0e1087df89f5355f2

SHA512
80dee4d563056875ee66f085a8371db9045efcdda8146190424be290a0a039635c7491c3a1082a616940d77c843f2467aa53c2dc347a69397df27d4fbe403b04

Download Submit
C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.DataGrid.Contrib.Wpf.dll

Filesize
87KB

MD5
9c43eb18df357b00aaf31b6684e57a53

SHA1
6de6fc5c23b5ef38eb2faab1eb643c3161c2e9f6

SHA256
abf2ec51aff791bee7580e77502a90b28aa034d2e729580e0d2b10d7ee296fd6

SHA512
fea50d9884aef63e24546d0947608fee8fb3aad6b0f8b5a02fdf5fead5564c2d8f16828fae1c182f1350b209a8a9b2e99201822957c36787b6ff36d266412309

Download Submit
C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.Docking.Wpf.dll

Filesize
677KB

MD5
b9d27fbdd161b1879aa1b5bf390b8114

SHA1
1e9ffc3fcefc25581fd726087c74d257c713ffe4

SHA256
3866414e85e128dd761a894b63befed29fded32788ab79087d0abc79335f17a4

SHA512
4af0057663f74f65af501ec45bed8cc75e225395b1acbd318220cd97eb28123b3b7290c34b865129edc20255c6876c58c25308ae1a458a97f5df285f5a2444c6

Download Submit
C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.Editors.Wpf.dll

Filesize
929KB

MD5
6f0e2870c72222d5989e9842d7d9e275

SHA1
9a847f1d5efe181c945c60bcfeeb43132db3f599

SHA256
b637f6e4c87ac32276f92c609ee71bb3d482b36d5516e383e5c52d8f615359e8

SHA512
ff99918d8a8510d70d250695a583deb91953f6db2abf2a71069a2d67932532977529d3a50ec012cd4547a03601cf8f5367592187768fe4d8aa5a80d8dacfda0d

Download Submit
C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.PropertyGrid.Wpf.dll

Filesize
315KB

MD5
3e50933e28b0ac08f7158e3a783f6bf4

SHA1
2178728de734670785b749499e4cfda7e1e30f60

SHA256
7d0ee0f0aad53788758a43ccf295cad4b8e6afae6815f2a2800033b29b81c14a

SHA512
3324d40fdc9a82915b8323f5386d00361bea8ae42aa79fc85b4d9d95a087fbadfc557d9f77e34938ef4fdc8b04d0e6a9f24bbfca6569d981cf404626fb2eb7f6

Download Submit
C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.Shared.Wpf.dll

Filesize
1.9MB

MD5
674447f18caace5e1163fb227e4cf08d

SHA1
62082108201e8be712cd52806a66503cf51fe714

SHA256
56dfde9007145d5f6ed21730ecbb5ac04e7c6bc1370fb317acb0e29bffaf5c84

SHA512
89fcdc36bd040a554a3bf8be205541914a00e0eed741eed066831d7564fa0f2ede717fb21d1e85e9503d9d262145d2fef837e37ed40087bb7386159fa5411bb8

Download Submit
C:\Program Files (x86)\PingPlotter 5\ActiproSoftware.SyntaxEditor.Wpf.dll

Filesize
1.1MB

MD5
855914201fde2285b71d87c05c4bbcc2

SHA1
8bc1bdbb97c2775c0399e9d0e90a036f41357a4c

SHA256
580a06e4ff57218280a92877d2b5def390b563c86a16366882cfee5d30951bd6

SHA512
7040fcb1fa29171f10e9a6400deae3283a078899eb21c969d9fde51136ab5002d2cc95ef9b37ea1647fd28c18df1f1776bd80d12b16703a9b15f2776d97b7fbb

Download Submit
C:\Program Files (x86)\PingPlotter 5\CoreLib.dll

Filesize
2.2MB

MD5
4f79b56c4bebf4683f731c2fa68126ce

SHA1
be502d11260c83f3bdb67279f796b137094248b6

SHA256
28130a2c33fd8ac4a915bd2a695b1160e61ad179136860675b42bbebc878bb63

SHA512
3384c07d2378e87d9e7e85f5db6af6bbfe804b559057339b04fda64e744344255da4d309a75efed9ec3246afbb852d4b4dde9baa7d2a783230f25a56d5f6294f

Download Submit
C:\Program Files (x86)\PingPlotter 5\NGraphics.Net.dll

Filesize
24KB

MD5
50f77484e5ebbab4178d226457277f61

SHA1
f9ce26a5dac69bc620481e76ff4bcaa44610b4f1

SHA256
76a4ee07ad63c27d6d95b9e0cc9a903563514e9b8fb51744646a19e00c3175a5

SHA512
f094291b6097608443d168d7cc5cd6a288f98f6bdb418e22d6f606ea2f54a6c6c166f13fedd827a79e8812d598e4fca1d59f50af17264f80e8dd3621856c77da

Download Submit
C:\Program Files (x86)\PingPlotter 5\NGraphics.WPF.dll

Filesize
25KB

MD5
c15a90b02588f3c2e92086d729268d9a

SHA1
f3917545b0d2f1784d6c677940e184a8bdf199d7

SHA256
64c10c0c8c7e80b8697d395f4c89622f5323d89a1b5ae5bb5c2436d2b614667e

SHA512
821986403f4c2d96413f3b2f81ff570198d4445f6cbb5fca38dc43ce4f2f6d7fd571cec70ef047e93e24f32b2069695435344523ff3390d40a6a400e71144407

Download Submit
C:\Program Files (x86)\PingPlotter 5\NGraphics.dll

Filesize
100KB

MD5
36896e5b8ff559857c870c8d60470d79

SHA1
8abe9941ec44d19b2f079fa66c118d60ecd75141

SHA256
57f963ae4825b02214ccae01276708613cdda30d74c50289972f4a16bea3d823

SHA512
ddbd19c34fe0b38958778cb8e01ec0daf22882a5db774f24d5fbaf3f18938f71f48b55d6b8ed1d31ac31086d416c65f3e410168c891295412a3d67cbbf781793

Download Submit
C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe

Filesize
2.9MB

MD5
aea6964efb6bfc8723f85e191c6db9b0

SHA1
f213e8ae0088838ae76d9d5841f9e9a2376c78a9

SHA256
89a3e51a67ef4684952ab912be4e9fd379b4cf46991d6c17c6e59d34f6ec5eac

SHA512
84a8587ccc35cdb2392f2de20a7323bf626bfdef0cc1ba6957273921aa8336086edd58689fac446e342d3ecb9f0a00e7dd2dbb2e5de223a5b6a42e75d845ab8a

Download Submit
C:\Program Files (x86)\PingPlotter 5\PingPlotter.exe.config

Filesize
27KB

MD5
928b8e104bc50973bad9150c577aaa64

SHA1
33eb7ed6547d26bbb8dbb087a45baf41292d01d2

SHA256
b42eb2bb81f89946449c5b27315afec9c87070ac01a6d0d1df91bd9d46702629

SHA512
3b8ac3ce5365b27c8156dfb1ccfeff4f8a0e3b10360c2e5639d3516f2b5aa3c2dc524ddbbd6e3d1941ae0d15f8867eb2e19a0df1c31d1872d25f7758c481cff2

Download Submit
C:\Program Files (x86)\PingPlotter 5\System.IO.dll

Filesize
15KB

MD5
ba3845f4986d242d62641e1f6e14caba

SHA1
9278fe4d60ed3462835a90c56bf187cadc35ddda

SHA256
ab5d0fa375fd11f411293552ffa7b127a62ecc7bef74c5c3a49cad629413e38b

SHA512
4ccc206b30208cf1ceef1e7341cf7f28e36f3ba90daff5051ee706841a1f30d49d654399c33b2d336d330789b76e5d3fac39d22d6d45d6d76a3ef643750a70cf

Download Submit
C:\Program Files (x86)\PingPlotter 5\System.Runtime.dll

Filesize
23KB

MD5
351865b759999ab60da018c38878662d

SHA1
2c6d09dfe7a95f78af5b27d0ffab491ca47dc2e5

SHA256
cfc8576cd3f50e93ead20e4a08cb1623e95cd928e5afcbaab9ad8ec1eba2528d

SHA512
7e329b5072fe7eb47871368a357643a4ec59576c0c7dfd2a48b671a33c9fb2fdf24198540ca283797ec2b274946c33f99d10d6b5aa5174872369aa5b58677f3b

Download Submit
C:\Program Files (x86)\PingPlotter 5\System.Threading.Tasks.dll

Filesize
16KB

MD5
e7120b5779730efb615235cf0107e386

SHA1
455ea9f216bbfcd1876f142d7a1b634fd85ef819

SHA256
ace34e85a2e954ed07ec11390cbdea7097ae4e56efd8b1bcef35788ce08c6777

SHA512
91f893b93d771eb1ac9b9f666561375da5c9a282bf778bca76489306f8aa398fd31bfa59eaeca2f1b1b16a598dc0f5cfa9d3f3d98b0a4cd2ec9fd5539bc3efb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
2eee3865f16574bb2c8058a2b4977995

SHA1
9e65c7b29d8a121cbd4dbdd24161113b7ec774f2

SHA256
6de01a7f89ac9c20580975e0f3163a4d355006395a615c71d86c7d0c7c5c007e

SHA512
3ec5e1000906b083f0366703a8e660360c80c2c2706beddb2f0976fda723596f955ab9e75f0d5328d02755279cf28e4dd4fc29ae334901eb986e84b9b58cb2c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_B5408224970389A1C2D228B1F06E63F2

Filesize
727B

MD5
36f5d03cd7b13e5fe0e915b00f4034e9

SHA1
c989899d4758051248cbb3edf7300aa356b176ca

SHA256
91e9646cae08070083e277fed6d82a39ad9f8ac15e3dfc5f13c893dbc95099d7

SHA512
b8ec8a218e62b3de3f63a6de399c438f19f378f3c6fbcf386d2e7719255f8d26c3133bbba6b008ad2a7f22054db2011f4ebd48a50b64bf9500bc2cc68f532238

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
f3caf7a7e82ca0c660532a49d65858d4

SHA1
34a5babef00151e28ac420f3b84cd90a5e5ac99f

SHA256
cdb6c2f46d77119c126ad9b9be53fc57c3fa834e25fe0ae73a8398f10a18701e

SHA512
3b3e3f4de4fc948bb15b8ca5f7e4c630deea291092132878a91968501c407057e8be2405b2c6ada56e63682acd1bb27f897480c2ece2680212da66b3287607c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
c484afde21232d467b3676b931ee8035

SHA1
6d004007aca313562ee9eb2e501654287443f69c

SHA256
720cc261ac428096d2b7a3fceb4bd9c4b7c5e4ffc586f5a23fb28396c730fed0

SHA512
c8656fa7c23b3878f2f7effa80955b6d90ad7e9a4d782a1124aecc58105891e3940f3432b276e88f4b34a08a58044cdc9e36d36ca7e43035945bd9f3ce045d11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_B5408224970389A1C2D228B1F06E63F2

Filesize
408B

MD5
e51413d5c18afc8a30828af2fe0736a6

SHA1
26fd1d50d2344e7f2d31814dd3c63a17852804c8

SHA256
18e4ddfc072951660c164aa467d32651e987fcbecf2ca861df8a385e6262efe4

SHA512
eb8329e6ce0699ede44a30b4a6b492395f28b12467757b49216d360da378b5fcd4db157776a3e138667d279ec2b7257811ff1836193ebbb921c39540e5f8a1aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
961995babd1ba05949773189c46063db

SHA1
2c5de184d1ea021a6266e31dbcb43b7c9c158de8

SHA256
a68396490802073755e99737420143475ff3af3ca28ed460295c17cec7e87064

SHA512
d424421768b17f6bb03fc5e7e468cb8577be181ffa2bd5c5db359bba17322f15ed5445c646e1aa0a8213cd8d23e405412aa6a650ec974421947a13cd44dfc481

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
cc6505fb2abf05d8a2195a9d04c92c42

SHA1
c479d7b4d7bd03fef9670142d7c730e1b96f6b64

SHA256
34ec1b1df44902b208eba8e33a623c0e07e42da5aeddfb061b2b874e78ba9852

SHA512
74a0fd7a21f718c5a27c71962e77bd3ecc4c097534fede8c8fd60dd08b23f40c6e53c4c3af1a3f25ba03df890745f2437df275b423d3272e00639f395349f442

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab18E0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1B15.tmp

Filesize
364KB

MD5
ca95f207ec70ba34b46c785f7bcb5570

SHA1
25c0d45cb9f94892e2877033d06fe8909e5b9972

SHA256
8ac4b42fb36d10194a14c32f6f499a6ac6acb79adbec858647495ba64f6dd2bb

SHA512
c7003a2159f5adab0a3b4a4f3c0dd494d916062a57e84a23ccc18410fa394438d49208769027c641569b3025616e99ca1730a540846aaf1c5d91338b90008831

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1C22.tmp

Filesize
561KB

MD5
5576bf4d22dc695564e49a68cbc98bc2

SHA1
80e0e045162a65d84939e22a821ecbbbde3f31d6

SHA256
20f76ffd846155a41633d75cb2e784e54f6ec77ca9ca9d52d9510c3e2e918801

SHA512
4b952ce6ef08c86d8594fadd1069c3af39c3465314716dc7e7d9937befab8f4db5e4920a901920af4f937e5bb80ca02c33406d54cc766920b8ebba3855500972

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A97.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\n2qhommiz8.tmp

Filesize
48B

MD5
1445fa25a09d068f4ca1fabc6aea38e7

SHA1
3467086476596ff7bad26cd670cbe90ae95633f5

SHA256
5b7527733396164bbfa3d16d8eed2c70be0b8fc086e83404345fd217055fac45

SHA512
a965831cfb5c1c5956ae657831ef7177e7131964d58f549f59f3efa051bcfdad34464962679e29471a30a033f405fa8076d76fc1213e0bf25fa81e220734f1a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\n2qhommiz8.tmp

Filesize
48B

MD5
63a7646a06b0f17a2a54aab9d1704f27

SHA1
6dbb416c7436dd0507195d991e70621db18dd922

SHA256
4c8df8cf491c87d6bb1ec8dae3ff98ed8e99e9053026222f47776898325e61ea

SHA512
8cd1b204af36030252600f0a2a6eec2b52897135af3725bfc3e4030053a9c5cd68c387139835ffe89cface6c7763a915ef0f829f9ab8723a85fbbb73d4de714a

Download Submit
C:\Users\Admin\AppData\Local\Temp\{2F31F1ED-92A3-4E22-A4B7-E1837DAAFB10}.bat

Filesize
104B

MD5
9b4245792fbf2f351e72f42f9aea25f0

SHA1
bf789f52bc8a9b16ab2343851b32ab3105156995

SHA256
b6f2a284cc94faf4e6d4df7c87dd8e565fa1ca8719e9fe9cf055ae7a5c5bc6ab

SHA512
cf61621f7967788ad0ea68822ccb7208e37d57573ec0480136ebdd14a24c211153be617718167f961d817f2524e4bbffb4015fb65f0e87158d63a8604639efa5

Download Submit
C:\Windows\Installer\MSI7DFB.tmp

Filesize
195KB

MD5
71c143221c4d2f06e495ee3f9e51a7f0

SHA1
44a3aa0ca190243d6f21becbd5b0c5e923426135

SHA256
8d245ef042215b0e9211692c7deaef442f4d46bd5323d74aa1bf25d676525bd9

SHA512
98a97a4f45cb70eb671ddc3c8d26a9a4c3d34745f0d1b6ee052a2080e1b4b3dac11303eb9a0c8d38e34df624edc28864e52f13e4d79bc16fe9223c5663372445

Download Submit
C:\Windows\Installer\MSI7E5C.tmp

Filesize
196KB

MD5
94fa9ff9c26724e0b8ac910c1e7c40aa

SHA1
0cf47957200dec349d6b6da432e24165afd590eb

SHA256
adae076f90908818d67777c050c5b1b6cc94be728017bab6c638dfc7763d4d09

SHA512
becb8229e8ef77a673829c547d2520d6fec94218abf2a21e2948ae5c156bf4a1eb64bfec38653b49902bb31708d9cf770c38f042c1f869d4d4695313b2acfefb

Download Submit
C:\Windows\Installer\MSI7EDA.tmp

Filesize
849KB

MD5
99dc199a4a390a86f2728f5232a2f9a6

SHA1
21b03b2dacbc5e19f3334054703ce53c8ba4a15f

SHA256
12b9deeb6e80129593bae1439bcbc491c6f602bfff255f72eba627100a54e2f9

SHA512
8ba930b0fb37257bbb0d5ea97bbb581ec7d545b737bdce03a78e713b3ad95a2f4b2b6d101817102763100edfe8e46f4532946a7bd3ac24d2142358ac26ec45db

Download Submit
C:\Windows\Installer\MSI7FA6.tmp

Filesize
409KB

MD5
e34827bf55cae867e83cc6122d25154a

SHA1
e513c23028532a6997692965765e235d42d96efa

SHA256
7f8ce80c53a7a4c3cecfbf497ee443538fd126a6e369b9930a3b021db548b55a

SHA512
506143a220f58c4236e4736f404c9421b9d5e0caaa21eff950953258ccf783de3534ea702e476acf565719964da6aeaeed787fca2d66c2b8ef5aa51c9b6e38d2

Download Submit
memory/2008-603-0x000000001B420000-0x000000001B4D2000-memory.dmp

Filesize
712KB

Download
memory/2008-595-0x0000000000360000-0x000000000037A000-memory.dmp

Filesize
104KB

Download
memory/2008-618-0x000000001D420000-0x000000001D74E000-memory.dmp

Filesize
3.2MB

Download
memory/2008-610-0x00000000010E0000-0x00000000010F6000-memory.dmp

Filesize
88KB

Download
memory/2008-611-0x000000001AC50000-0x000000001AC68000-memory.dmp

Filesize
96KB

Download
memory/2008-614-0x000000001B830000-0x000000001B854000-memory.dmp

Filesize
144KB

Download
memory/2008-615-0x000000001C6B0000-0x000000001C6C2000-memory.dmp

Filesize
72KB

Download
memory/2008-612-0x000000001B6D0000-0x000000001B71C000-memory.dmp

Filesize
304KB

Download
memory/2008-613-0x000000001C5D0000-0x000000001C68A000-memory.dmp

Filesize
744KB

Download
memory/2008-609-0x0000000001030000-0x0000000001042000-memory.dmp

Filesize
72KB

Download
memory/2008-608-0x000000001C9C0000-0x000000001CFC6000-memory.dmp

Filesize
6.0MB

Download
memory/2008-607-0x0000000000C20000-0x0000000000C52000-memory.dmp

Filesize
200KB

Download
memory/2008-606-0x0000000000B70000-0x0000000000B94000-memory.dmp

Filesize
144KB

Download
memory/2008-594-0x000000001C040000-0x000000001C156000-memory.dmp

Filesize
1.1MB

Download
memory/2008-596-0x0000000000380000-0x000000000038A000-memory.dmp

Filesize
40KB

Download
memory/2008-597-0x0000000000480000-0x000000000049C000-memory.dmp

Filesize
112KB

Download
memory/2008-598-0x00000000004A0000-0x00000000004A8000-memory.dmp

Filesize
32KB

Download
memory/2008-599-0x0000000000690000-0x00000000006AA000-memory.dmp

Filesize
104KB

Download
memory/2008-600-0x00000000006B0000-0x00000000006B8000-memory.dmp

Filesize
32KB

Download
memory/2008-601-0x00000000006C0000-0x00000000006CA000-memory.dmp

Filesize
40KB

Download
memory/2008-602-0x0000000000B00000-0x0000000000B0A000-memory.dmp

Filesize
40KB

Download
memory/2008-604-0x000000001C160000-0x000000001C1FC000-memory.dmp

Filesize
624KB

Download
memory/2008-605-0x0000000000B40000-0x0000000000B6C000-memory.dmp

Filesize
176KB

Download
memory/2008-590-0x000000001B370000-0x000000001B41E000-memory.dmp

Filesize
696KB

Download
memory/2008-593-0x0000000000630000-0x0000000000682000-memory.dmp

Filesize
328KB

Download
memory/2008-592-0x000000001BE60000-0x000000001C03E000-memory.dmp

Filesize
1.9MB

Download
memory/2008-591-0x000000001B5E0000-0x000000001B6CC000-memory.dmp

Filesize
944KB

Download
memory/2008-588-0x0000000001100000-0x00000000013F0000-memory.dmp

Filesize
2.9MB

Download
memory/2008-589-0x000000001B120000-0x000000001B362000-memory.dmp

Filesize
2.3MB

Download
memory/2580-543-0x00000000003E0000-0x00000000003EA000-memory.dmp

Filesize
40KB

Download
memory/2580-565-0x000000001CD60000-0x000000001CE1A000-memory.dmp

Filesize
744KB

Download
memory/2580-533-0x000000001B590000-0x000000001B67C000-memory.dmp

Filesize
944KB

Download
memory/2580-566-0x000000001CE20000-0x000000001CE44000-memory.dmp

Filesize
144KB

Download
memory/2580-556-0x000000001B0F0000-0x000000001B18C000-memory.dmp

Filesize
624KB

Download
memory/2580-564-0x000000001BBE0000-0x000000001BC2C000-memory.dmp

Filesize
304KB

Download
memory/2580-531-0x000000001A980000-0x000000001AA2E000-memory.dmp

Filesize
696KB

Download
memory/2580-563-0x000000001BBC0000-0x000000001BBD8000-memory.dmp

Filesize
96KB

Download
memory/2580-562-0x000000001B470000-0x000000001B486000-memory.dmp

Filesize
88KB

Download
memory/2580-561-0x000000001AFD0000-0x000000001AFE2000-memory.dmp

Filesize
72KB

Download
memory/2580-560-0x000000001C740000-0x000000001CD46000-memory.dmp

Filesize
6.0MB

Download
memory/2580-555-0x000000001C090000-0x000000001C142000-memory.dmp

Filesize
712KB

Download
memory/2580-558-0x000000001BB90000-0x000000001BBB4000-memory.dmp

Filesize
144KB

Download
memory/2580-557-0x000000001AA50000-0x000000001AA7C000-memory.dmp

Filesize
176KB

Download
memory/2580-567-0x000000001CEC0000-0x000000001CED2000-memory.dmp

Filesize
72KB

Download
memory/2580-570-0x000000001D2E0000-0x000000001D60E000-memory.dmp

Filesize
3.2MB

Download
memory/2580-559-0x000000001ABB0000-0x000000001ABE2000-memory.dmp

Filesize
200KB

Download
memory/2580-554-0x0000000000EF0000-0x0000000000EFA000-memory.dmp

Filesize
40KB

Download
memory/2580-535-0x000000001BEB0000-0x000000001C08E000-memory.dmp

Filesize
1.9MB

Download
memory/2580-552-0x0000000000B70000-0x0000000000B7A000-memory.dmp

Filesize
40KB

Download
memory/2580-537-0x0000000000AE0000-0x0000000000B32000-memory.dmp

Filesize
328KB

Download
memory/2580-550-0x0000000000B60000-0x0000000000B68000-memory.dmp

Filesize
32KB

Download
memory/2580-541-0x00000000004F0000-0x000000000050A000-memory.dmp

Filesize
104KB

Download
memory/2580-548-0x0000000000B40000-0x0000000000B5A000-memory.dmp

Filesize
104KB

Download
memory/2580-547-0x0000000000530000-0x0000000000538000-memory.dmp

Filesize
32KB

Download
memory/2580-539-0x000000001BA70000-0x000000001BB86000-memory.dmp

Filesize
1.1MB

Download
memory/2580-545-0x0000000000510000-0x000000000052C000-memory.dmp

Filesize
112KB

Download
memory/2580-529-0x000000001B220000-0x000000001B462000-memory.dmp

Filesize
2.3MB

Download
memory/2580-527-0x0000000000F10000-0x0000000001200000-memory.dmp

Filesize
2.9MB

Download