aurora | af28c04f796374b21521aeb2ea9c9c12b6f468d58ebe306838836dc5d9f16f8f

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28-07-2024 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe
Size

21.3MB
MD5

416de11d210ae0ff50214021ff57b32b
SHA1

3142453c18080b83d8dbdeba89524beea1c94ff3
SHA256

72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850
SHA512

e1f061f99e9e4e42c21269a32c9f3cfa711a8a95caf7628637d5606ae7846fc73ae982b0ee78646026c41e5c1e61e21a15829967d2fed534070e3c40e2731e4c
SSDEEP

393216:TYTogFuaMaKQy6SSTMX3q7wLta40K3pNPS4n+yubbcEVPxEV+aqdvx1LB1x8NFN:TYT1Fu/6SSTMq+YK3Hx+3r5Np1FL8NF

Score

10^/10

aurora quasar redline sectoprat shurk xmrig cheat themdas discovery evasion execution infostealer miner persistence rat spyware stealer themida trojan

Malware Config

Extracted

Family

redline

Botnet

cheat

154.81.220.233:28105

Extracted

Family

quasar

Version

1.4.1

Botnet

themdas

auroraforge.art:55326

thesirenmika.com:55713

Mutex

0cbdfe7f-0215-41e8-a7b5-d4fbbc555089

Attributes

encryption_key
A730DFF691ED1723ED88E36A2C5E7ED5CCF91DD1
install_name
up2.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 5 IoCs

resource	yara_rule
behavioral1/memory/1980-70-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar
behavioral1/memory/1980-72-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar
behavioral1/memory/1980-71-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar
behavioral1/memory/1980-67-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar
behavioral1/memory/1980-65-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000016398-14.dat	family_redline
behavioral1/memory/2064-26-0x00000000010B0000-0x00000000010CE000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000016398-14.dat	family_sectoprat
behavioral1/memory/2064-26-0x00000000010B0000-0x00000000010CE000-memory.dmp	family_sectoprat

Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk

Shurk Stealer payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0006000000016de2-42.dat	shurk_stealer
behavioral1/memory/1784-100-0x000000013F4B0000-0x0000000140D7F000-memory.dmp	shurk_stealer

Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs

description	pid	Process	procid_target
PID 2296 created 1200	2296	vlc.exe	21
PID 2296 created 1200	2296	vlc.exe	21
PID 2296 created 1200	2296	vlc.exe	21
PID 2488 created 1200	2488	svchost.exe	21
PID 2488 created 1200	2488	svchost.exe	21
PID 2488 created 1200	2488	svchost.exe	21
PID 2488 created 1200	2488	svchost.exe	21

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral1/memory/2488-126-0x000000013F350000-0x000000013F8EA000-memory.dmp	xmrig
behavioral1/memory/3036-129-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/3036-131-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/3036-134-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/3036-136-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/3036-138-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/3036-140-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/3036-142-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/3036-144-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/3036-146-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/3036-148-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/3036-150-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2364	attrib.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe

Executes dropped EXE 7 IoCs

pid	Process
2560	AdobeUpdate.exe
2064	build.exe
2732	OneDrive.exe
2296	vlc.exe
2812	Msedge.exe
1784	Aurora.exe
2488	svchost.exe

Loads dropped DLL 9 IoCs

pid	Process
2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe
2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe
2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe
2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe
2636	cmd.exe
2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe
2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe
3000	Process not Found
492	taskeng.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2764	icacls.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2676-51-0x00000000003C0000-0x0000000001E8A000-memory.dmp	themida

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Edge = "C:\\Users\\Admin\\AppData\\Local\\Msedge.exe"	AdobeUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\OneDriveUpdate\\OneDrive Updater.exe"	powershell.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2600	powershell.exe
1852	powershell.exe
2312	powershell.exe

Power Settings 1 TTPs 10 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
968	powercfg.exe
784	powercfg.exe
2116	powercfg.exe
1776	cmd.exe
2928	powercfg.exe
1884	powercfg.exe
1944	powercfg.exe
2368	cmd.exe
2952	powercfg.exe
1048	powercfg.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2732 set thread context of 1980	2732	OneDrive.exe	52
PID 2488 set thread context of 2268	2488	svchost.exe	76
PID 2488 set thread context of 3036	2488	svchost.exe	77

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OneDrive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2848	PING.EXE
2800	cmd.exe
2920	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2848	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1792	schtasks.exe
1192	schtasks.exe
2388	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe
2600	powershell.exe
2732	OneDrive.exe
2732	OneDrive.exe
2296	vlc.exe
2296	vlc.exe
2296	vlc.exe
2296	vlc.exe
1852	powershell.exe
2296	vlc.exe
2296	vlc.exe
2488	svchost.exe
2488	svchost.exe
2488	svchost.exe
2488	svchost.exe
2312	powershell.exe
2488	svchost.exe
2488	svchost.exe
2488	svchost.exe
2488	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	2064	build.exe
Token: SeDebugPrivilege	2732	OneDrive.exe
Token: SeDebugPrivilege	1980	RegAsm.exe
Token: SeShutdownPrivilege	2928	powercfg.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeShutdownPrivilege	1884	powercfg.exe
Token: SeShutdownPrivilege	1944	powercfg.exe
Token: SeShutdownPrivilege	968	powercfg.exe
Token: SeShutdownPrivilege	2952	powercfg.exe
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeShutdownPrivilege	784	powercfg.exe
Token: SeShutdownPrivilege	2116	powercfg.exe
Token: SeShutdownPrivilege	1048	powercfg.exe
Token: SeLockMemoryPrivilege	3036	svchost.exe
Token: SeLockMemoryPrivilege	3036	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe
3036	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2560	2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe	30
PID 2676 wrote to memory of 2560	2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe	30
PID 2676 wrote to memory of 2560	2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe	30
PID 2676 wrote to memory of 2560	2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe	30
PID 2676 wrote to memory of 2064	2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe	31
PID 2676 wrote to memory of 2064	2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe	31
PID 2676 wrote to memory of 2064	2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe	31
PID 2676 wrote to memory of 2064	2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe	31
PID 2676 wrote to memory of 2732	2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe	33
PID 2676 wrote to memory of 2732	2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe	33
PID 2676 wrote to memory of 2732	2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe	33
PID 2676 wrote to memory of 2732	2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe	33
PID 2560 wrote to memory of 2800	2560	AdobeUpdate.exe	34
PID 2560 wrote to memory of 2800	2560	AdobeUpdate.exe	34
PID 2560 wrote to memory of 2800	2560	AdobeUpdate.exe	34
PID 2800 wrote to memory of 2920	2800	cmd.exe	36
PID 2800 wrote to memory of 2920	2800	cmd.exe	36
PID 2800 wrote to memory of 2920	2800	cmd.exe	36
PID 2920 wrote to memory of 2848	2920	cmd.exe	38
PID 2920 wrote to memory of 2848	2920	cmd.exe	38
PID 2920 wrote to memory of 2848	2920	cmd.exe	38
PID 2676 wrote to memory of 2296	2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe	39
PID 2676 wrote to memory of 2296	2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe	39
PID 2676 wrote to memory of 2296	2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe	39
PID 2676 wrote to memory of 2296	2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe	39
PID 2920 wrote to memory of 2364	2920	cmd.exe	40
PID 2920 wrote to memory of 2364	2920	cmd.exe	40
PID 2920 wrote to memory of 2364	2920	cmd.exe	40
PID 2920 wrote to memory of 2764	2920	cmd.exe	41
PID 2920 wrote to memory of 2764	2920	cmd.exe	41
PID 2920 wrote to memory of 2764	2920	cmd.exe	41
PID 2920 wrote to memory of 2636	2920	cmd.exe	42
PID 2920 wrote to memory of 2636	2920	cmd.exe	42
PID 2920 wrote to memory of 2636	2920	cmd.exe	42
PID 2636 wrote to memory of 2812	2636	cmd.exe	43
PID 2636 wrote to memory of 2812	2636	cmd.exe	43
PID 2636 wrote to memory of 2812	2636	cmd.exe	43
PID 2732 wrote to memory of 2600	2732	OneDrive.exe	44
PID 2732 wrote to memory of 2600	2732	OneDrive.exe	44
PID 2732 wrote to memory of 2600	2732	OneDrive.exe	44
PID 2732 wrote to memory of 2600	2732	OneDrive.exe	44
PID 2732 wrote to memory of 2640	2732	OneDrive.exe	46
PID 2732 wrote to memory of 2640	2732	OneDrive.exe	46
PID 2732 wrote to memory of 2640	2732	OneDrive.exe	46
PID 2732 wrote to memory of 2640	2732	OneDrive.exe	46
PID 2676 wrote to memory of 1784	2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe	48
PID 2676 wrote to memory of 1784	2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe	48
PID 2676 wrote to memory of 1784	2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe	48
PID 2676 wrote to memory of 1784	2676	72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe	48
PID 2640 wrote to memory of 1792	2640	cmd.exe	50
PID 2640 wrote to memory of 1792	2640	cmd.exe	50
PID 2640 wrote to memory of 1792	2640	cmd.exe	50
PID 2640 wrote to memory of 1792	2640	cmd.exe	50
PID 2732 wrote to memory of 1928	2732	OneDrive.exe	51
PID 2732 wrote to memory of 1928	2732	OneDrive.exe	51
PID 2732 wrote to memory of 1928	2732	OneDrive.exe	51
PID 2732 wrote to memory of 1928	2732	OneDrive.exe	51
PID 2732 wrote to memory of 1928	2732	OneDrive.exe	51
PID 2732 wrote to memory of 1928	2732	OneDrive.exe	51
PID 2732 wrote to memory of 1928	2732	OneDrive.exe	51
PID 2732 wrote to memory of 1980	2732	OneDrive.exe	52
PID 2732 wrote to memory of 1980	2732	OneDrive.exe	52
PID 2732 wrote to memory of 1980	2732	OneDrive.exe	52
PID 2732 wrote to memory of 1980	2732	OneDrive.exe	52

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2364	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe
  "C:\Users\Admin\AppData\Local\Temp\72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe
    "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c start cmd /Q /C " ping localhost -n 1 && copy "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\Admin\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\Admin\AppData\Local\Msedge.exe" && icacls "C:\Users\Admin\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\Admin\AppData\Local\Msedge.exe" && exit" && && exit "
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:2800
    - - C:\Windows\system32\cmd.exe
        
        cmd /Q /C " ping localhost -n 1 && copy "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\Admin\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\Admin\AppData\Local\Msedge.exe" && icacls "C:\Users\Admin\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\Admin\AppData\Local\Msedge.exe"
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2920
      - C:\Windows\system32\PING.EXE
        
        ping localhost -n 1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2848
      - C:\Windows\system32\attrib.exe
        
        attrib +r +h +a "C:\Users\Admin\AppData\Local\Msedge.exe"
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2364
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA)
        6⤵
        Modifies file permissions
        
        PID:2764
      - C:\Windows\system32\cmd.exe
        
        cmd /C "start "C:\Users\Admin\AppData\Local\Msedge.exe
        6⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Msedge.exe
        
        C:\Users\Admin\AppData\Local\Msedge.exe
        7⤵
        Executes dropped EXE
        
        PID:2812
- - C:\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2064
- - C:\Users\Admin\AppData\Roaming\OneDrive Update Tool\OneDrive.exe
    "C:\Users\Admin\AppData\Roaming\OneDrive Update Tool\OneDrive.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate' -Value '"C:\Users\Admin\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"' -PropertyType 'String'
      4⤵
      Adds Run key to start application
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2600
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /C schtasks /create /tn \OneDriveUpdate /tr "C:\Users\Admin\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2640
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn \OneDriveUpdate /tr "C:\Users\Admin\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1792
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      #cmd
      4⤵
      PID:1928
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      #cmd
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1980
- - C:\Users\Admin\AppData\Roaming\VLC Media Player\vlc.exe
    "C:\Users\Admin\AppData\Roaming\VLC Media Player\vlc.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2296
- - C:\Users\Admin\AppData\Local\Temp\Aurora.exe
    "C:\Users\Admin\AppData\Local\Temp\Aurora.exe"
    3⤵
    - Executes dropped EXE
    PID:1784
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:1776
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2928
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1884
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1944
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1852
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn ConsoleWindowsHost /tr 'C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1192
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "ConsoleWindowsHost"
  2⤵
  PID:964
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:2368
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2952
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:784
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2116
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2312
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn ConsoleWindowsHost /tr 'C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2388
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:2268
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3036

C:\Windows\system32\taskeng.exe
taskeng.exe {187C5A8E-AFCC-4AA2-8A3D-2982E44E624A} S-1-5-21-1506706701-1246725540-2219210854-1000:MUYDDIIS\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
PID:492
- C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe
  C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabC63E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC6DD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\63TEVR8FT6FJPE6EB91M.temp

Filesize
7KB

MD5
4e853e8d815fbe75e21f31331bff5ce3

SHA1
fa7586233a7c2759776cf6e5b15850cc4c44317e

SHA256
cda970ea164b8338c202645411da1574aca3956b893c4cd81ed2681b84618a0f

SHA512
04d8aa5017f33fc9a1cf3de263911879ae95d5fd1fafee80a625254f9770016d11f69490ceec2c6a6ac8cb4e82b69efe7e0ae7096d7bfbe7a76a5885e85197b7

Download Submit
C:\Users\Admin\AppData\Roaming\OneDrive Update Tool\OneDrive.exe

Filesize
3.2MB

MD5
3b4f58cd4bca7274be25e885be00798b

SHA1
eb57c281d8324a1079db97c9da43483a65debbed

SHA256
a6832546e1d261c33deea58e1cbb8a391af91628b130454d55aef3e292862d80

SHA512
dc909730b2feacba3c14c98a2b443d5c12dfd74ce74db53cf7e564e01707ac365811e4d3b95c0cefe2b87ebd1b074fb4a395360911c3d11de4fa8957e9bad121

Download Submit
C:\Users\Admin\AppData\Roaming\VLC Media Player\vlc.exe

Filesize
5.6MB

MD5
b9fc8581b52abfc6b563da731438e27d

SHA1
43111fe9b307c850a379fe2d64d279e994680de3

SHA256
e03debe75b2f4f4c937c50773064b9a692b262bfce4472e67900edf3f7726058

SHA512
c62540e73870caf9a93fbc2396ac99867f8f6e87661240d7642022130008bdb769954f1e8a58d13698172e62cc5b7d44a73b2f1d999db47822eb294c629436a5

Download Submit
\Users\Admin\AppData\Local\Temp\Aurora.exe

Filesize
25.2MB

MD5
1504c863a05885816d2c8874137ae7a7

SHA1
5b16d440a7e9b5887886549f016f252900b5c0ac

SHA256
33fc61e81efa609df51277aef261623bb291e2dd5359362d50070f7a441df0ad

SHA512
055d2650ac996443130c05a742bcaabc576dbde29cc21ea956f66132f7e6da8a5771beb9cd51ff2384b2230ebe68990b35d8b14611613db2b8d2764846a487f9

Download Submit
\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe

Filesize
80KB

MD5
65f0a85c4b056d6bcee60c49e2372e35

SHA1
6af820a2030950617bf150777af4a43a06a17184

SHA256
d64768ea74224057220bff451504b6128ddfb6161617b668626c490c84b3ae8e

SHA512
7a50bd0b3908f830494b2bff13a051ba0cdc7900934dbf8a62616f6d29b914f05f8029bbcc429a095254ebb6ab2a2d92c05dd6aebf57e34cde20f152243df383

Download Submit
\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe

Filesize
95KB

MD5
c9a9d471428a5f92068c0823e6454254

SHA1
8b8ee8612b9b8bfbb165b3a8ca0d4a377b589dd2

SHA256
b0ffaa8c7d8fe1e804afc87e6f7659483c69d421911ddbfc410270011b91bfb5

SHA512
ca34022e99a48639fb3566ec4eb901a2f91121aee6a1f1bc601492dd94387873afc8af499aefed8d644aef8f564ca46a12ea40176da7f8d7b4e60f4b505ac8af

Download Submit
memory/1784-100-0x000000013F4B0000-0x0000000140D7F000-memory.dmp

Filesize
24.8MB

Download
memory/1852-107-0x0000000002830000-0x0000000002838000-memory.dmp

Filesize
32KB

Download
memory/1852-106-0x000000001B400000-0x000000001B6E2000-memory.dmp

Filesize
2.9MB

Download
memory/1980-69-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1980-67-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/1980-63-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/1980-70-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/1980-72-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/1980-61-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/1980-65-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/1980-71-0x0000000000400000-0x0000000000724000-memory.dmp

Filesize
3.1MB

Download
memory/2064-26-0x00000000010B0000-0x00000000010CE000-memory.dmp

Filesize
120KB

Download
memory/2268-128-0x0000000140000000-0x0000000140029000-memory.dmp

Filesize
164KB

Download
memory/2268-133-0x0000000140000000-0x0000000140029000-memory.dmp

Filesize
164KB

Download
memory/2296-110-0x000000013F960000-0x000000013FEFA000-memory.dmp

Filesize
5.6MB

Download
memory/2296-101-0x000000013F960000-0x000000013FEFA000-memory.dmp

Filesize
5.6MB

Download
memory/2312-120-0x000000001B510000-0x000000001B7F2000-memory.dmp

Filesize
2.9MB

Download
memory/2312-121-0x0000000001DD0000-0x0000000001DD8000-memory.dmp

Filesize
32KB

Download
memory/2488-126-0x000000013F350000-0x000000013F8EA000-memory.dmp

Filesize
5.6MB

Download
memory/2488-114-0x000000013F350000-0x000000013F8EA000-memory.dmp

Filesize
5.6MB

Download
memory/2676-1-0x00000000764AE000-0x00000000764AF000-memory.dmp

Filesize
4KB

Download
memory/2676-50-0x00000000764A0000-0x00000000764E7000-memory.dmp

Filesize
284KB

Download
memory/2676-6-0x00000000764A0000-0x00000000764E7000-memory.dmp

Filesize
284KB

Download
memory/2676-2-0x00000000764A0000-0x00000000764E7000-memory.dmp

Filesize
284KB

Download
memory/2676-0-0x00000000003C0000-0x0000000001E8A000-memory.dmp

Filesize
26.8MB

Download
memory/2676-51-0x00000000003C0000-0x0000000001E8A000-memory.dmp

Filesize
26.8MB

Download
memory/2732-27-0x0000000000970000-0x0000000000C9E000-memory.dmp

Filesize
3.2MB

Download
memory/3036-134-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/3036-131-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/3036-129-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/3036-127-0x00000000000B0000-0x00000000000D0000-memory.dmp

Filesize
128KB

Download
memory/3036-136-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/3036-138-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/3036-140-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/3036-142-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/3036-144-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/3036-146-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/3036-148-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/3036-150-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download