b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
Size 1.5MB
Sample240614-b65azavanm
SHA256 b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740
MD5 5c654e6ee5fb74c7a96efcc802084ba1
SHA1 819d99656516c90c41d5a6e218f643c8249fe08e
SHA512 cba406ffa777e0b5998468f72a84e60a393b7a6b25d0e1c6a6198b9135813a88cb8601a248f03222c37ed9a4855a9ef545a76378455a8af94c0af2366f1b0805
SSDEEP 12288:Ggl1nun57FdMyU3hYJQDCCpW3Ari4VVyZC0+1cCWAvAk1pTnWfSEkVU39wyr7vTo:GslWgyqhCQr3iE0nOlNxUXHet61+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Java\\jdk-1.8\\include\\win32\\winlogon.exe\""	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Java\\jdk-1.8\\include\\win32\\winlogon.exe\", \"C:\\Users\\Public\\Documents\\unsecapp.exe\""	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Java\\jdk-1.8\\include\\win32\\winlogon.exe\", \"C:\\Users\\Public\\Documents\\unsecapp.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\RuntimeBroker.exe\""	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Java\\jdk-1.8\\include\\win32\\winlogon.exe\", \"C:\\Users\\Public\\Documents\\unsecapp.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Java\\jdk-1.8\\include\\win32\\winlogon.exe\", \"C:\\Users\\Public\\Documents\\unsecapp.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\StartMenuExperienceHost.exe\""	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	4992	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4724	4992	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	4992	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	4992	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	4992	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	4992	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	4992	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3384	4992	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	4992	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	4992	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3644	4992	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	4992	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4740	4992	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	4992	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	4992	schtasks.exe	85

Detects executables containing bas64 encoded gzip files 2 IoCs

resource	yara_rule
behavioral2/memory/2900-0-0x0000000000970000-0x0000000000AEA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File
behavioral2/files/0x0007000000023400-34.dat	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	StartMenuExperienceHost.exe

Executes dropped EXE 5 IoCs

pid	Process
556	StartMenuExperienceHost.exe
2688	StartMenuExperienceHost.exe
3780	StartMenuExperienceHost.exe
1448	StartMenuExperienceHost.exe
3736	StartMenuExperienceHost.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\Java\\jdk-1.8\\include\\win32\\winlogon.exe\""	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Users\\Public\\Documents\\unsecapp.exe\""	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\RuntimeBroker.exe\""	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\StartMenuExperienceHost.exe\""	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\StartMenuExperienceHost.exe\""	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\Java\\jdk-1.8\\include\\win32\\winlogon.exe\""	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Users\\Public\\Documents\\unsecapp.exe\""	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\RuntimeBroker.exe\""	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCC4E2E6D31A5B43A5AC10B552DD8BDB6C.TMP	csc.exe
File created	\??\c:\Windows\System32\cwwwvr.exe	csc.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\winlogon.exe	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\cc11b995f2a76d	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\RuntimeBroker.exe	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\9e8d7a4ca61bd9	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\StartMenuExperienceHost.exe	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\55b276f4edf653	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\winlogon.exe	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3384	schtasks.exe
4740	schtasks.exe
1472	schtasks.exe
2632	schtasks.exe
4544	schtasks.exe
2240	schtasks.exe
468	schtasks.exe
1800	schtasks.exe
2500	schtasks.exe
4876	schtasks.exe
4724	schtasks.exe
3644	schtasks.exe
4832	schtasks.exe
2804	schtasks.exe
1688	schtasks.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	StartMenuExperienceHost.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4344	PING.EXE
1628	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
Token: SeDebugPrivilege	556	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	2688	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	3780	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	1448	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	3736	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 3368	2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe	89
PID 2900 wrote to memory of 3368	2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe	89
PID 3368 wrote to memory of 3568	3368	csc.exe	91
PID 3368 wrote to memory of 3568	3368	csc.exe	91
PID 2900 wrote to memory of 3668	2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe	104
PID 2900 wrote to memory of 3668	2900	b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe	104
PID 3668 wrote to memory of 5008	3668	cmd.exe	106
PID 3668 wrote to memory of 5008	3668	cmd.exe	106
PID 3668 wrote to memory of 4624	3668	cmd.exe	107
PID 3668 wrote to memory of 4624	3668	cmd.exe	107
PID 3668 wrote to memory of 556	3668	cmd.exe	108
PID 3668 wrote to memory of 556	3668	cmd.exe	108
PID 556 wrote to memory of 1796	556	StartMenuExperienceHost.exe	110
PID 556 wrote to memory of 1796	556	StartMenuExperienceHost.exe	110
PID 1796 wrote to memory of 4336	1796	cmd.exe	112
PID 1796 wrote to memory of 4336	1796	cmd.exe	112
PID 1796 wrote to memory of 4344	1796	cmd.exe	113
PID 1796 wrote to memory of 4344	1796	cmd.exe	113
PID 1796 wrote to memory of 2688	1796	cmd.exe	114
PID 1796 wrote to memory of 2688	1796	cmd.exe	114
PID 2688 wrote to memory of 2044	2688	StartMenuExperienceHost.exe	120
PID 2688 wrote to memory of 2044	2688	StartMenuExperienceHost.exe	120
PID 2044 wrote to memory of 4008	2044	cmd.exe	122
PID 2044 wrote to memory of 4008	2044	cmd.exe	122
PID 2044 wrote to memory of 2344	2044	cmd.exe	123
PID 2044 wrote to memory of 2344	2044	cmd.exe	123
PID 2044 wrote to memory of 3780	2044	cmd.exe	124
PID 2044 wrote to memory of 3780	2044	cmd.exe	124
PID 3780 wrote to memory of 2016	3780	StartMenuExperienceHost.exe	125
PID 3780 wrote to memory of 2016	3780	StartMenuExperienceHost.exe	125
PID 2016 wrote to memory of 4148	2016	cmd.exe	127
PID 2016 wrote to memory of 4148	2016	cmd.exe	127
PID 2016 wrote to memory of 1628	2016	cmd.exe	128
PID 2016 wrote to memory of 1628	2016	cmd.exe	128
PID 2016 wrote to memory of 1448	2016	cmd.exe	129
PID 2016 wrote to memory of 1448	2016	cmd.exe	129
PID 1448 wrote to memory of 3752	1448	StartMenuExperienceHost.exe	130
PID 1448 wrote to memory of 3752	1448	StartMenuExperienceHost.exe	130
PID 3752 wrote to memory of 1568	3752	cmd.exe	132
PID 3752 wrote to memory of 1568	3752	cmd.exe	132
PID 3752 wrote to memory of 2876	3752	cmd.exe	133
PID 3752 wrote to memory of 2876	3752	cmd.exe	133
PID 3752 wrote to memory of 3736	3752	cmd.exe	134
PID 3752 wrote to memory of 3736	3752	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe
"C:\Users\Admin\AppData\Local\Temp\b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0xtrheck\0xtrheck.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4EEB.tmp" "c:\Windows\System32\CSCC4E2E6D31A5B43A5AC10B552DD8BDB6C.TMP"
    3⤵
    PID:3568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QPFZEBcOgW.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5008
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4624
- - C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\StartMenuExperienceHost.exe
    "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\StartMenuExperienceHost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:556
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EEIicgEf1j.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1796
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4336
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:4344
    - - C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\StartMenuExperienceHost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\StartMenuExperienceHost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2688
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yIUjElxALT.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2044
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:4008
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2344
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\StartMenuExperienceHost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\StartMenuExperienceHost.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3780
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9cbgcnWXuE.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2016
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:4148
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        Runs ping.exe
        
        PID:1628
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\StartMenuExperienceHost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\StartMenuExperienceHost.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1448
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bviytIjYVg.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3752
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:1568
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2876
        
        C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\StartMenuExperienceHost.exe
        
        "C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\StartMenuExperienceHost.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\jdk-1.8\include\win32\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Java\jdk-1.8\include\win32\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jdk-1.8\include\win32\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Documents\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\Public\Documents\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Documents\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartMenuExperienceHost.exe

Path C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\StartMenuExperienceHost.exe
Size 1.5MB
SHA256 b030885b9e94a1bc5bbe4d8108f44a7db71e9d7c8add3e5ae51342c332429740
MD5 5c654e6ee5fb74c7a96efcc802084ba1
SHA1 819d99656516c90c41d5a6e218f643c8249fe08e
SHA512 cba406ffa777e0b5998468f72a84e60a393b7a6b25d0e1c6a6198b9135813a88cb8601a248f03222c37ed9a4855a9ef545a76378455a8af94c0af2366f1b0805
SSDEEP 12288:Ggl1nun57FdMyU3hYJQDCCpW3Ari4VVyZC0+1cCWAvAk1pTnWfSEkVU39wyr7vTo:GslWgyqhCQr3iE0nOlNxUXHet61+
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartMenuExperienceHost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\StartMenuExperienceHost.exe.log
Size 1KB
SHA256 eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a
MD5 bbb951a34b516b66451218a3ec3b0ae1
SHA1 7393835a2476ae655916e0a9687eeaba3ee876e9
SHA512 63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f
MD5 SHA1 SHA512

Submit Download

9cbgcnWXuE.bat

Path C:\Users\Admin\AppData\Local\Temp\9cbgcnWXuE.bat
Size 229B
SHA256 a326fc9fa1f9a154c5b688ec8b73fc0c269743ec813c9b6379e815003c59b1f6
MD5 d5240b741f24bc2e4ade183a81093c0b
SHA1 075affea58e19c7877eeddda72743792ab7777f1
SHA512 3d2058b7059b3cf1857c7198ce4c58408730a4974cf7e2cf595957f93acb1acf327afa3f191b81c52d3ca703c1b409108bc05463c7696fc1ffdbafb2db0402ae
MD5 SHA1 SHA512

Submit Download

EEIicgEf1j.bat

Path C:\Users\Admin\AppData\Local\Temp\EEIicgEf1j.bat
Size 229B
SHA256 936aa644bc159a4499f395e3f54c159d017b0d4dba15268139229bb966e5bd59
MD5 a030389b4921c6ed83fde94985748780
SHA1 48c39c277cf718bf1ef3d561e88a697abbad4a16
SHA512 030be8d98f95b28c124cb986e5ef19e4d89f49d29eb0906ee375d474174a47580f2828d5be556c629db1669a16d72568054a5c935ec7309f19280a31cbac2a9f
MD5 SHA1 SHA512

Submit Download

QPFZEBcOgW.bat

Path C:\Users\Admin\AppData\Local\Temp\QPFZEBcOgW.bat
Size 277B
SHA256 e8bccaa767e24c55b9c764e99983888ff6a89157586a3f64eb4acf611d5ee240
MD5 533e4179a2e1bd3887152064546d1e8f
SHA1 159c42d6135f96380b48b82704126ddc23fce4e5
SHA512 3937aa0efa3e4a631fdcf8998c631b448c97c1e5902d093b67efefef8cf7ffb18f344348c132795870fedf576d0df36ef6b0207a5b42700f47a27ded67ddb6b4
MD5 SHA1 SHA512

Submit Download

RES4EEB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4EEB.tmp
Size 1KB
SHA256 0f3d3e1448bc3023e6d50a267c91c4a3e615064015bef083c71bbc3edcf6b294
MD5 bfa7432a20825bc13fcaa08b1a8ec9dd
SHA1 1c5b538889a6eb45198383b428d638d9c1601fb9
SHA512 9efaa35c4a93a64d10c82b9b3c22c5b6932eea4fcff0fba95f5bea47cb9222c0c190924d2524130014ca0c531c70971b54f4809eccabee3999ce657ae0e3f3b1
MD5 SHA1 SHA512

Submit Download

bviytIjYVg.bat

Path C:\Users\Admin\AppData\Local\Temp\bviytIjYVg.bat
Size 277B
SHA256 1b0fcd097059370c76eb84cf4210fab4d4c393f2c1111ce921c09b600fa89d2d
MD5 5118781abd4757c182eece17ec5ca221
SHA1 9cd2606d3e22ac2d14b1648b9d4dac9c74cd5077
SHA512 338b556a5416132f1c7ae363a05b8d05a34a58fd654373292d8b5b22bd7331607d003abff1ebf6dbe19a72add02f654803e2f8d40af1da888b06dc4ed63ea948
MD5 SHA1 SHA512

Submit Download

yIUjElxALT.bat

Path C:\Users\Admin\AppData\Local\Temp\yIUjElxALT.bat
Size 277B
SHA256 325f63c8ec106658b759b382dc39e80716c77128fde8f8dd162a434f97798401
MD5 27f160a7ada9af51de599c6998c69035
SHA1 89bffe665053ee7ffc3dfe21448ceb82ee0fb65c
SHA512 976ba365df8c58b0ae9bffa453199f0df0fb347d344edf3ad0df2868fea5aee55254c150cdf591acdfcfc156bc7797ef75a25be9e5f160c628bb8504d89ba490
MD5 SHA1 SHA512

Submit Download

0xtrheck.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\0xtrheck\0xtrheck.0.cs
Size 388B
SHA256 903c4ff3465dc9240f392a86c1214b6f50e2dc39f6bcd7e8b6c3a65330cb2464
MD5 bc7f9239eccb00f2be6568b2d92a1c75
SHA1 bed2895abbdb055431366a5336bbb2847b9aa664
SHA512 d3ce44464155b94cd5ceeda87725b4ba44ea1e7eed1415190823f0d495f4645cad96677445b5cfca53a1086c73dc0e858c4547ef9f683d50a782aec9aed174ea
MD5 SHA1 SHA512

Submit Download

0xtrheck.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\0xtrheck\0xtrheck.cmdline
Size 235B
SHA256 a07b2870bdb053357feac58ec0d69488b9dcb5a000b0af2ef766c3bd82cc20f6
MD5 57238454da54d2df7ac5eaef5ec31fcd
SHA1 b9da310d879b40bd9b39bcf6542c1bfa220285b6
SHA512 cae9a543e00e9fb98ec66c9a1873c8806fce995e95af1bf6fab38cdad86b24afd0b4853f3a47e2422e96b6d59d8e6a3a15688124bd8a3f6892d9f5a894f98da3
MD5 SHA1 SHA512

Submit Download

CSCC4E2E6D31A5B43A5AC10B552DD8BDB6C.TMP

Path \??\c:\Windows\System32\CSCC4E2E6D31A5B43A5AC10B552DD8BDB6C.TMP
Size 1KB
SHA256 24e424d4d217bc9b5e76e0867e2715aabb09d7e49ab1e716eefb40d718e4f135
MD5 913b41bbe173c6878eae5b8d8b62f5b7
SHA1 386047df3df2b03e486bc87c4b7a3fee5f68ad73
SHA512 c71d73ccf422818dce69b867726b04c54b6418b99d67227e7dc328c3c3df86f0235630feb91494f8102540aa94fce68674707db991222ce4c79934c17b9c0cc9
MD5 SHA1 SHA512

Submit Download

memory/556-81-0x000000001B0F0000-0x000000001B0F8000-memory.dmp

Download

memory/556-71-0x000000001BD50000-0x000000001BE52000-memory.dmp

Download

memory/556-82-0x000000001BD50000-0x000000001BE52000-memory.dmp

Download

memory/556-80-0x000000001B490000-0x000000001B539000-memory.dmp

Download

memory/556-69-0x000000001B490000-0x000000001B539000-memory.dmp

Download

memory/556-70-0x000000001B0F0000-0x000000001B0F8000-memory.dmp

Download

memory/1448-149-0x000000001B2C0000-0x000000001B369000-memory.dmp

Download

memory/1448-151-0x000000001BB80000-0x000000001BC82000-memory.dmp

Download

memory/1448-150-0x000000001AF30000-0x000000001AF38000-memory.dmp

Download

memory/1448-160-0x000000001AF30000-0x000000001AF38000-memory.dmp

Download

memory/1448-161-0x000000001BB80000-0x000000001BC82000-memory.dmp

Download

memory/1448-159-0x000000001B2C0000-0x000000001B369000-memory.dmp

Download

memory/2688-99-0x000000001BF60000-0x000000001C062000-memory.dmp

Download

memory/2688-98-0x000000001B300000-0x000000001B308000-memory.dmp

Download

memory/2688-97-0x000000001B6A0000-0x000000001B749000-memory.dmp

Download

memory/2688-109-0x000000001BF60000-0x000000001C062000-memory.dmp

Download

memory/2688-108-0x000000001B300000-0x000000001B308000-memory.dmp

Download

memory/2688-107-0x000000001B6A0000-0x000000001B749000-memory.dmp

Download

memory/2900-23-0x0000000001400000-0x000000000140E000-memory.dmp

Download

memory/2900-10-0x00000000013B0000-0x00000000013BE000-memory.dmp

Download

memory/2900-25-0x000000001B940000-0x000000001B98E000-memory.dmp

Download

memory/2900-0-0x0000000000970000-0x0000000000AEA000-memory.dmp

Download

memory/2900-21-0x00000000013F0000-0x0000000001400000-memory.dmp

Download

memory/2900-19-0x00000000013D0000-0x00000000013E0000-memory.dmp

Download

memory/2900-17-0x000000001BE20000-0x000000001C348000-memory.dmp

Download

memory/2900-16-0x000000001B8D0000-0x000000001B8E2000-memory.dmp

Download

memory/2900-1-0x00007FFA67CD0000-0x00007FFA67CF2000-memory.dmp

Download

memory/2900-3-0x00000000013A0000-0x00000000013AE000-memory.dmp

Download

memory/2900-5-0x0000000001410000-0x000000000142C000-memory.dmp

Download

memory/2900-6-0x0000000002D50000-0x0000000002DA0000-memory.dmp

Download

memory/2900-8-0x0000000001430000-0x0000000001448000-memory.dmp

Download

memory/2900-53-0x000000001C550000-0x000000001C5F9000-memory.dmp

Download

memory/2900-14-0x0000000002DC0000-0x0000000002DD6000-memory.dmp

Download

memory/2900-12-0x0000000002DA0000-0x0000000002DB2000-memory.dmp

Download

memory/3736-176-0x0000000002BE0000-0x0000000002BE8000-memory.dmp

Download

memory/3736-175-0x000000001BB20000-0x000000001BBC9000-memory.dmp

Download

memory/3780-133-0x000000001BD00000-0x000000001BDA9000-memory.dmp

Download

memory/3780-135-0x000000001C5C0000-0x000000001C6C2000-memory.dmp

Download

memory/3780-134-0x000000001B980000-0x000000001B988000-memory.dmp

Download

memory/3780-124-0x000000001B980000-0x000000001B988000-memory.dmp

Download

memory/3780-125-0x000000001C5C0000-0x000000001C6C2000-memory.dmp

Download

memory/3780-123-0x000000001BD00000-0x000000001BDA9000-memory.dmp

Download