9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
Size 3.2MB
Sample240613-bxkj7sshjp
SHA256 9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5
MD5 069d8565f208c71cb5496278392a3e8d
SHA1 2276be9129c6e50c4bb38ebe34e209ced3538492
SHA512 b85064722385adcea34546f6729eacf99612807abf3603fd011bd464254d61c1748b76c93f6eff07fc0324cac941a57e3b2f024f5c0b15a089138b39c923f431
SSDEEP 49152:/QswzIgfd2FhMj0pPKEg5QlLCO0pMHBVlFP2R7Yt5ibo0/1lliJEq1pC1G:/9+kFOj+PKEaQlLNBDRtuo9Eq10
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

execution persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Java\\sysmon.exe\""	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Java\\sysmon.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe\""	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3388	1288	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	1288	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	1288	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3088	1288	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	1288	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4484	1288	schtasks.exe	95

Detects executables packed with unregistered version of .NET Reactor 2 IoCs

resource	yara_rule
behavioral2/memory/4664-1-0x0000000000650000-0x0000000000982000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor
behavioral2/files/0x000700000002327a-127.dat	INDICATOR_EXE_Packed_DotNetReactor

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1088	powershell.exe
3456	powershell.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	sysmon.exe

Executes dropped EXE 6 IoCs

pid	Process
368	msedge.exe
2656	sysmon.exe
4304	sysmon.exe
1416	sysmon.exe
4416	sysmon.exe
2104	sysmon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Program Files (x86)\\Java\\sysmon.exe\""	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe\""	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe\""	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Program Files (x86)\\Java\\sysmon.exe\""	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC2F669E1A6B824F2D84F9EA8CF8ED6740.TMP	csc.exe
File created	\??\c:\Windows\System32\_iyiwy.exe	csc.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\CSC1E8503963D1F44B9BC839A6B8F1E1BD8.TMP	csc.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	csc.exe
File created	C:\Program Files (x86)\Java\sysmon.exe	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
File opened for modification	C:\Program Files (x86)\Java\sysmon.exe	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
File created	C:\Program Files (x86)\Java\121e5b5079f7c0	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2556	schtasks.exe
4484	schtasks.exe
3388	schtasks.exe
4236	schtasks.exe
536	schtasks.exe
3088	schtasks.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	sysmon.exe

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
3556	PING.EXE
3140	PING.EXE
5052	PING.EXE
3088	PING.EXE
1912	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
Token: SeDebugPrivilege	3456	powershell.exe
Token: SeDebugPrivilege	1088	powershell.exe
Token: SeDebugPrivilege	2656	sysmon.exe
Token: SeDebugPrivilege	4304	sysmon.exe
Token: SeDebugPrivilege	1416	sysmon.exe
Token: SeDebugPrivilege	4416	sysmon.exe
Token: SeDebugPrivilege	2104	sysmon.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 2544	4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe	100
PID 4664 wrote to memory of 2544	4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe	100
PID 2544 wrote to memory of 2316	2544	csc.exe	104
PID 2544 wrote to memory of 2316	2544	csc.exe	104
PID 4664 wrote to memory of 3252	4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe	105
PID 4664 wrote to memory of 3252	4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe	105
PID 3252 wrote to memory of 2496	3252	csc.exe	107
PID 3252 wrote to memory of 2496	3252	csc.exe	107
PID 4664 wrote to memory of 1088	4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe	111
PID 4664 wrote to memory of 1088	4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe	111
PID 4664 wrote to memory of 3456	4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe	112
PID 4664 wrote to memory of 3456	4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe	112
PID 4664 wrote to memory of 3968	4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe	115
PID 4664 wrote to memory of 3968	4664	9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe	115
PID 3968 wrote to memory of 2744	3968	cmd.exe	117
PID 3968 wrote to memory of 2744	3968	cmd.exe	117
PID 3968 wrote to memory of 3556	3968	cmd.exe	118
PID 3968 wrote to memory of 3556	3968	cmd.exe	118
PID 3968 wrote to memory of 2656	3968	cmd.exe	120
PID 3968 wrote to memory of 2656	3968	cmd.exe	120
PID 2656 wrote to memory of 4296	2656	sysmon.exe	121
PID 2656 wrote to memory of 4296	2656	sysmon.exe	121
PID 4296 wrote to memory of 1468	4296	cmd.exe	123
PID 4296 wrote to memory of 1468	4296	cmd.exe	123
PID 4296 wrote to memory of 3140	4296	cmd.exe	124
PID 4296 wrote to memory of 3140	4296	cmd.exe	124
PID 4296 wrote to memory of 4304	4296	cmd.exe	125
PID 4296 wrote to memory of 4304	4296	cmd.exe	125
PID 4304 wrote to memory of 3456	4304	sysmon.exe	126
PID 4304 wrote to memory of 3456	4304	sysmon.exe	126
PID 3456 wrote to memory of 1480	3456	cmd.exe	128
PID 3456 wrote to memory of 1480	3456	cmd.exe	128
PID 3456 wrote to memory of 5052	3456	cmd.exe	129
PID 3456 wrote to memory of 5052	3456	cmd.exe	129
PID 3456 wrote to memory of 1416	3456	cmd.exe	130
PID 3456 wrote to memory of 1416	3456	cmd.exe	130
PID 1416 wrote to memory of 1136	1416	sysmon.exe	131
PID 1416 wrote to memory of 1136	1416	sysmon.exe	131
PID 1136 wrote to memory of 4396	1136	cmd.exe	133
PID 1136 wrote to memory of 4396	1136	cmd.exe	133
PID 1136 wrote to memory of 3088	1136	cmd.exe	134
PID 1136 wrote to memory of 3088	1136	cmd.exe	134
PID 1136 wrote to memory of 4416	1136	cmd.exe	135
PID 1136 wrote to memory of 4416	1136	cmd.exe	135
PID 4416 wrote to memory of 3104	4416	sysmon.exe	136
PID 4416 wrote to memory of 3104	4416	sysmon.exe	136
PID 3104 wrote to memory of 4740	3104	cmd.exe	138
PID 3104 wrote to memory of 4740	3104	cmd.exe	138
PID 3104 wrote to memory of 1912	3104	cmd.exe	139
PID 3104 wrote to memory of 1912	3104	cmd.exe	139
PID 3104 wrote to memory of 2104	3104	cmd.exe	140
PID 3104 wrote to memory of 2104	3104	cmd.exe	140

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe
"C:\Users\Admin\AppData\Local\Temp\9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w40e0esj\w40e0esj.cmdline"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA66C.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC1E8503963D1F44B9BC839A6B8F1E1BD8.TMP"
    3⤵
    PID:2316
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\orpwwf2c\orpwwf2c.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA9B8.tmp" "c:\Windows\System32\CSC2F669E1A6B824F2D84F9EA8CF8ED6740.TMP"
    3⤵
    PID:2496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Java\sysmon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ilhaUWIZb6.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2744
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - Runs ping.exe
    PID:3556
- - C:\Program Files (x86)\Java\sysmon.exe
    "C:\Program Files (x86)\Java\sysmon.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZI9TpMxUin.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4296
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1468
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:3140
    - - C:\Program Files (x86)\Java\sysmon.exe
        
        "C:\Program Files (x86)\Java\sysmon.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4304
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZI9TpMxUin.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:1480
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:5052
        
        C:\Program Files (x86)\Java\sysmon.exe
        
        "C:\Program Files (x86)\Java\sysmon.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1416
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CwMiVtjst0.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1136
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:4396
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        Runs ping.exe
        
        PID:3088
        
        C:\Program Files (x86)\Java\sysmon.exe
        
        "C:\Program Files (x86)\Java\sysmon.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4416
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RDnCqwGfES.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3104
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:4740
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        Runs ping.exe
        
        PID:1912
        
        C:\Program Files (x86)\Java\sysmon.exe
        
        "C:\Program Files (x86)\Java\sysmon.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2104
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Qyx4MBHo2X.bat"
        12⤵
        
        PID:3380
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:3684
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:4788
        
        C:\Program Files (x86)\Java\sysmon.exe
        
        "C:\Program Files (x86)\Java\sysmon.exe"
        13⤵
        
        PID:4672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Java\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Java\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Java\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c59" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\Temp\9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c59" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Local\Temp\9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
- Executes dropped EXE
PID:368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sysmon.exe

Path C:\Program Files (x86)\Java\sysmon.exe
Size 3.2MB
SHA256 9d7ce3ddff107c5a4815c7ae9c459a66b545a7706b5485d66eda8b2cfdc0a4c5
MD5 069d8565f208c71cb5496278392a3e8d
SHA1 2276be9129c6e50c4bb38ebe34e209ced3538492
SHA512 b85064722385adcea34546f6729eacf99612807abf3603fd011bd464254d61c1748b76c93f6eff07fc0324cac941a57e3b2f024f5c0b15a089138b39c923f431
SSDEEP 49152:/QswzIgfd2FhMj0pPKEg5QlLCO0pMHBVlFP2R7Yt5ibo0/1lliJEq1pC1G:/9+kFOj+PKEaQlLNBDRtuo9Eq10
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4KB
SHA256 f8a22c2b9b0b22fe4d5cbfd5fa9536d0bc727da5da00664836b07e3d641aedf6
MD5 e32a993047ffebbddaa8d9e9bb764787
SHA1 1bbfe3fb9d4cad147ac8818cc6c3c04bf658b8c9
SHA512 3d38de5cd52f8d32dc5b8844f7c721796dc92dbd2b555b1bbf7d3f30a0a3a35b933daa7f286aecdc011d58b65391dcdce2e54ef0b94926594bd3290d75547378
SSDEEP 48:67mZt5xZ8RxeOAkFJOcV4MKe28dUd9vqBHjuulB+hnqXSfbNtm:3mxvxVx9wvkVTkZzNt
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

sysmon.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sysmon.exe.log
Size 1KB
SHA256 c45f52a36b283b46aae313b5a4fcbfbfb67b3c5ac4ee3ecd921087ddadb691a1
MD5 8ee01a9d8d8d1ecf515b687bf5e354ca
SHA1 c3b943dce30e425ae34e6737c7d5c3cdd92f79c5
SHA512 6cb43253ddb3d2e5bdedcf76bc299e91ce970c6ccc53a2d9df7ba621435a6a704ce3990bdf59d939e513e609bab3daf8f110c1cca8485e1a9fe8536a67d41dda
MD5 SHA1 SHA512

Submit Download

CwMiVtjst0.bat

Path C:\Users\Admin\AppData\Local\Temp\CwMiVtjst0.bat
Size 166B
SHA256 533632fabad5249936b14301bef5fb2e016ff21168a2bec94b8c97aace5afd29
MD5 4508710ec66010c3c5692a30c43211d2
SHA1 b6a2aeb322274e2fb9ceda37f36414a93a3e3f1e
SHA512 7a64911824cda4c92033ce92dadb896bd4002d9c6a706f19c1e34296564a27948fa8800614bdfb73a3ff23c4ac07505282930b61f36d4d1d0c86cacd9106168d
MD5 SHA1 SHA512

Submit Download

Qyx4MBHo2X.bat

Path C:\Users\Admin\AppData\Local\Temp\Qyx4MBHo2X.bat
Size 214B
SHA256 b5577a786b2232a85f336ba9f681af4ada39bde923db428223fca148cfb1b816
MD5 83c3238c9c10c13ec624f0053f4ab6fa
SHA1 f177431a320a98d924794e39df0e35268af64bd3
SHA512 f8680aef8038074d62d2077b5a0d7d84cd65718d1fa1adfea1737c9521a93d5a3588a46db64f5cfe0938e181b174d8caf5571f4fa705d74e04489d25f029d4ef
MD5 SHA1 SHA512

Submit Download

RDnCqwGfES.bat

Path C:\Users\Admin\AppData\Local\Temp\RDnCqwGfES.bat
Size 166B
SHA256 25f317238728c485d2f73be22fce0d0034aafe33e4e93eb4b45b664f68eb334e
MD5 271a247fea65a562fb49bc11ffcd98d6
SHA1 21c45e77e55f3ebf6a3836939fb40607760029ae
SHA512 7ba4cbbf45401bce94bcd84efdea8b1fe4da0f24e2d342dce01708720df8508d9eaecca679e3f0c3675eea559d58c24c7de8ae3b9219bea63f66825a40085e5e
MD5 SHA1 SHA512

Submit Download

RESA66C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA66C.tmp
Size 1KB
SHA256 ffa019e05bf1f781f87b20845b197d18a405878e064c4fbdab21e672e80701af
MD5 67afc6d83d635006dba10bfc0bfb9f5e
SHA1 3ab53213a6ec595e2ca66256d3ba85415acec930
SHA512 54f7b8c5c8a050646bbd6e7b3ddff7a37bf309378bc9a342d273e095fdc684400b02db26dc4814f0162a4d466276f506adb976f6d771e0e1e0a6d6e2b94c3a63
MD5 SHA1 SHA512

Submit Download

RESA9B8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA9B8.tmp
Size 1KB
SHA256 aab4d28a62194a4bca0308b0f13b3d750c72f4f87f247aa157878d4ddd30a433
MD5 f5bb835135798624232916bf3e5e7393
SHA1 4222681a31efc30dd22a7ef837a9323fd6b6cc4e
SHA512 c860ad8b3a80b1c3dbe2be99cf1e11277926b048f7841d4c9b5485936562e84a68f3026348b08212cda3051ce1539f6df7f0c8412606546582d15005e5a9e9ed
MD5 SHA1 SHA512

Submit Download

ZI9TpMxUin.bat

Path C:\Users\Admin\AppData\Local\Temp\ZI9TpMxUin.bat
Size 166B
SHA256 f09d84146852aa05c401e065d57544ee401fa42be570089ccfe2e0597796b0bf
MD5 b4674a5b8f2d95a4768aaee4676d6d4a
SHA1 e50cd72f3b9393a1dd785885493ba2198fe4fa25
SHA512 49a71bf021f1506a1878770d0bbae686f824da594d1fe08208d999ca660f4060f1061e316b7bfa9c8c149fe4456ddec81d6979356c6b6dde032d09e83ed17a2c
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_i0rpkboe.ryo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i0rpkboe.ryo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

ilhaUWIZb6.bat

Path C:\Users\Admin\AppData\Local\Temp\ilhaUWIZb6.bat
Size 166B
SHA256 57381235c1e967af3756f77abb085d04d2f5fb348835098fbcfac6076c937432
MD5 2dd2d43bb3ab3b8240f7d4cf86560323
SHA1 2c703d6e503c7f4b2f06bd701dd1db8dab886de2
SHA512 3714b14f7089a64af971bd4026560c796623caf2ece785bbfabff9d4f9854fd2fe4a90ba639b02b5958fc50d4546a51e6e893b3ce5a4d799043ec3281a1d93f7
MD5 SHA1 SHA512

Submit Download

CSC1E8503963D1F44B9BC839A6B8F1E1BD8.TMP

Path \??\c:\Program Files (x86)\Microsoft\Edge\Application\CSC1E8503963D1F44B9BC839A6B8F1E1BD8.TMP
Size 1KB
SHA256 e1984ba1e3ff8b071f7a320a6f1f18e1d5f4f337d31dc30d5bdfb021df39060f
MD5 b5189fb271be514bec128e0d0809c04e
SHA1 5dd625d27ed30fca234ec097ad66f6c13a7edcbe
SHA512 f0fcb8f97279579beb59f58ea89527ee0d86a64c9de28300f14460bec6c32dda72f0e6466573b6654a1e992421d6fe81ae7cce50f27059f54cf9fdca6953602e
MD5 SHA1 SHA512

Submit Download

orpwwf2c.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\orpwwf2c\orpwwf2c.0.cs
Size 370B
SHA256 6b7e05f1424686c38783e073042fbacf844fdd796dbd52dc9fb06d42ac93a83e
MD5 e2ff42442cba610dc6867861c2ee27aa
SHA1 9b36def613bb9f9d8ec6bff4381522b757cb2fbd
SHA512 81ea77185ac5b68f1d991a01b6b46b1b2ae3e85a969ea25f8cbc38840e25598906317a494324844ce39bc95d42059725c302d6a3eac3448a5c373d1cbca28931
MD5 SHA1 SHA512

Submit Download

orpwwf2c.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\orpwwf2c\orpwwf2c.cmdline
Size 235B
SHA256 bc50f8e34896c130a7b14c8969f7c9a915834872f531af4999919d206b80a27f
MD5 9af4ba05fdb1000986d2016e9b9b654a
SHA1 e915ed92d7ef9beb973a28baf77fc03110a5ecbe
SHA512 83be52889c62d396fe43e4f882490e7be2a030ea3f0de409616856af666f9ee76dd7bb3f5fab29fa528ce9c23565fc94778f34f44decb3d7a03ef015ac416400
MD5 SHA1 SHA512

Submit Download

w40e0esj.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\w40e0esj\w40e0esj.0.cs
Size 400B
SHA256 2a744f857bd28f6eb66addef4aeaf55be75fe716b90fdf7f66f9610540dc435f
MD5 3cb1884beadab1b01df6da2ac7256693
SHA1 e19c87819ee3f86ef824a36e09dc38dc9023b0df
SHA512 e33f8e6be4a6955166d3047948208ec136890c7b86eed9a11ed820afb31576d3c3d0ef6270b92ca0419c5621fb1307f4751efcc9169c81753ce99c7cdd2438a4
MD5 SHA1 SHA512

Submit Download

w40e0esj.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\w40e0esj\w40e0esj.cmdline
Size 265B
SHA256 a3d95aded7b275e952c3718e63f555f694bcd70bbdba828edcd334ea73f37bcb
MD5 5744834a74fa1baad6b58c758a033363
SHA1 43654e520fd837bc277972426f4a29f7ea7fffb7
SHA512 30d3c8ed968cfcf0e54f6324d710aef1d7e433680ddcb6c38d8265692336e797fcb903b139614aa7cefce9ff20a08578bd29ee4ebe7eb0692c2af872859e2f0f
MD5 SHA1 SHA512

Submit Download

CSC2F669E1A6B824F2D84F9EA8CF8ED6740.TMP

Path \??\c:\Windows\System32\CSC2F669E1A6B824F2D84F9EA8CF8ED6740.TMP
Size 1KB
SHA256 1bf68148c555d0e84720c497dcf3ad708da300ee7472df12c9307a3acd4abde1
MD5 188249e3f31caa0264351fc374794895
SHA1 323a707d1a37ac8cbae6d6e502cc850f69ae2e15
SHA512 28a0d97e83b6b6d10c0114166e8f23845663a34c8f262aa5a31ffb885abe232badb6f95bba99b8688559cac81f8ff93c3609ac363d8903d35f535d7c5e1e02d5
MD5 SHA1 SHA512

Submit Download

memory/1416-216-0x000000001C640000-0x000000001C648000-memory.dmp

Download

memory/1416-215-0x000000001CBC0000-0x000000001CC69000-memory.dmp

Download

memory/2104-274-0x000000001C9B0000-0x000000001C9B8000-memory.dmp

Download

memory/2104-273-0x000000001C5F0000-0x000000001C699000-memory.dmp

Download

memory/2656-150-0x000000001BF30000-0x000000001BFD9000-memory.dmp

Download

memory/2656-157-0x000000001C1F0000-0x000000001C1F8000-memory.dmp

Download

memory/2656-156-0x000000001BF30000-0x000000001BFD9000-memory.dmp

Download

memory/3456-107-0x000001965CD90000-0x000001965CDB2000-memory.dmp

Download

memory/4304-187-0x000000001BD90000-0x000000001BD98000-memory.dmp

Download

memory/4304-186-0x000000001BAD0000-0x000000001BB79000-memory.dmp

Download

memory/4416-245-0x000000001BCA0000-0x000000001BCA8000-memory.dmp

Download

memory/4416-244-0x000000001B8F0000-0x000000001B999000-memory.dmp

Download

memory/4664-50-0x000000001B6B0000-0x000000001B6BE000-memory.dmp

Download

memory/4664-94-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

Download

memory/4664-39-0x000000001CBF0000-0x000000001CC02000-memory.dmp

Download

memory/4664-40-0x000000001D140000-0x000000001D668000-memory.dmp

Download

memory/4664-42-0x000000001B660000-0x000000001B66E000-memory.dmp

Download

memory/4664-44-0x000000001B690000-0x000000001B6A0000-memory.dmp

Download

memory/4664-46-0x000000001B6A0000-0x000000001B6B0000-memory.dmp

Download

memory/4664-48-0x000000001CC70000-0x000000001CCCA000-memory.dmp

Download

memory/4664-35-0x000000001B650000-0x000000001B660000-memory.dmp

Download

memory/4664-52-0x000000001CC10000-0x000000001CC20000-memory.dmp

Download

memory/4664-54-0x000000001CC20000-0x000000001CC2E000-memory.dmp

Download

memory/4664-55-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

Download

memory/4664-57-0x000000001CC50000-0x000000001CC68000-memory.dmp

Download

memory/4664-59-0x000000001CC30000-0x000000001CC3C000-memory.dmp

Download

memory/4664-63-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

Download

memory/4664-64-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

Download

memory/4664-65-0x000000001CFD0000-0x000000001D079000-memory.dmp

Download

memory/4664-66-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

Download

memory/4664-69-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

Download

memory/4664-32-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

Download

memory/4664-33-0x000000001B670000-0x000000001B682000-memory.dmp

Download

memory/4664-30-0x000000001B530000-0x000000001B53E000-memory.dmp

Download

memory/4664-83-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

Download

memory/4664-37-0x000000001CBD0000-0x000000001CBE6000-memory.dmp

Download

memory/4664-28-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

Download

memory/4664-27-0x0000000002B90000-0x0000000002BA0000-memory.dmp

Download

memory/4664-23-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

Download

memory/4664-120-0x000000001CFD0000-0x000000001D079000-memory.dmp

Download

memory/4664-121-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

Download

memory/4664-25-0x0000000002B80000-0x0000000002B90000-memory.dmp

Download

memory/4664-22-0x000000001B510000-0x000000001B528000-memory.dmp

Download

memory/4664-20-0x00007FFCA3103000-0x00007FFCA3105000-memory.dmp

Download

memory/4664-19-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

Download

memory/4664-18-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

Download

memory/4664-17-0x0000000002B70000-0x0000000002B80000-memory.dmp

Download

memory/4664-15-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

Download

memory/4664-14-0x000000001CB80000-0x000000001CBD0000-memory.dmp

Download

memory/4664-13-0x000000001B4F0000-0x000000001B50C000-memory.dmp

Download

memory/4664-11-0x0000000002B60000-0x0000000002B6E000-memory.dmp

Download

memory/4664-9-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

Download

memory/4664-8-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

Download

memory/4664-7-0x000000001B4C0000-0x000000001B4E6000-memory.dmp

Download

memory/4664-5-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

Download

memory/4664-4-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

Download

memory/4664-3-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

Download

memory/4664-2-0x00007FFCA3100000-0x00007FFCA3BC1000-memory.dmp

Download

memory/4664-1-0x0000000000650000-0x0000000000982000-memory.dmp

Download

memory/4664-0-0x00007FFCA3103000-0x00007FFCA3105000-memory.dmp

Download