a69f30c1b304b7f6c85facbbd598f1ebdfdc967488f1bf0617b3bddc3a3a4e86

Analysis

max time kernel
58s
max time network
59s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 17:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NeverLose.exe
Size

2.4MB
MD5

4a20d992a3e773d0fc70d29d27217fe5
SHA1

237ea4f9f0d167d3161ac8cba193b2e79b7cdd84
SHA256

a69f30c1b304b7f6c85facbbd598f1ebdfdc967488f1bf0617b3bddc3a3a4e86
SHA512

7bd12dbb3b051ee6b47ab734047ee06929ec5cbdda6c5be47513644257e75b10a6414e11503a7323ad3851a71c86932803e3d691e7d8f0cedb9625830ea0d270
SSDEEP

49152:tBELVoj3mruOsvEsgZpfyECvOhsX7/iEuHTClwGe:nQI0zLhpfTCWhsL/iEMUu

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\agentMonitornetcommon\\services.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\MoUsoCoreWorker.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\agentMonitornetcommon\\services.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\MoUsoCoreWorker.exe\", \"C:\\agentMonitornetcommon\\msedge.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\agentMonitornetcommon\\services.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\MoUsoCoreWorker.exe\", \"C:\\agentMonitornetcommon\\msedge.exe\", \"C:\\agentMonitornetcommon\\dllhost.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\agentMonitornetcommon\\services.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\MoUsoCoreWorker.exe\", \"C:\\agentMonitornetcommon\\msedge.exe\", \"C:\\agentMonitornetcommon\\dllhost.exe\", \"C:\\agentMonitornetcommon\\spoolsv.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\agentMonitornetcommon\\services.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\MoUsoCoreWorker.exe\", \"C:\\agentMonitornetcommon\\msedge.exe\", \"C:\\agentMonitornetcommon\\dllhost.exe\", \"C:\\agentMonitornetcommon\\spoolsv.exe\", \"C:\\agentMonitornetcommon\\Msfontruntime.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\agentMonitornetcommon\\services.exe\""	Msfontruntime.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4788	4860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	4860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3360	4860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1408	4860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	4860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4336	4860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	928	4860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4944	4860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	4860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3080	4860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	4860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4284	4860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3924	4860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	4860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	4860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3344	4860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4316	4860	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4120	4860	schtasks.exe	93

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	NeverLose.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	Msfontruntime.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	services.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	services.exe

Executes dropped EXE 7 IoCs

pid	Process
2972	Msfontruntime.exe
3944	services.exe
3300	services.exe
3080	services.exe
4132	services.exe
2460	services.exe
2776	services.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\agentMonitornetcommon\\services.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MoUsoCoreWorker = "\"C:\\Program Files\\Windows Multimedia Platform\\MoUsoCoreWorker.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MoUsoCoreWorker = "\"C:\\Program Files\\Windows Multimedia Platform\\MoUsoCoreWorker.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\agentMonitornetcommon\\msedge.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\agentMonitornetcommon\\msedge.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\agentMonitornetcommon\\dllhost.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\agentMonitornetcommon\\dllhost.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\agentMonitornetcommon\\spoolsv.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\agentMonitornetcommon\\services.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Msfontruntime = "\"C:\\agentMonitornetcommon\\Msfontruntime.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Msfontruntime = "\"C:\\agentMonitornetcommon\\Msfontruntime.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\agentMonitornetcommon\\spoolsv.exe\""	Msfontruntime.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCC8D45144760144B3A4E6B1AC95D025B1.TMP	csc.exe
File created	\??\c:\Windows\System32\3uu4gi.exe	csc.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Multimedia Platform\1f93f77a7f4778	Msfontruntime.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\CSCB7564BA7A1A1433D933247B6859686A0.TMP	csc.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	csc.exe
File created	C:\Program Files\Windows Multimedia Platform\MoUsoCoreWorker.exe	Msfontruntime.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NeverLose.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	NeverLose.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	Msfontruntime.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	services.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	services.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3360	schtasks.exe
4284	schtasks.exe
3924	schtasks.exe
3344	schtasks.exe
4620	schtasks.exe
4120	schtasks.exe
1408	schtasks.exe
2076	schtasks.exe
4944	schtasks.exe
3080	schtasks.exe
4788	schtasks.exe
2356	schtasks.exe
2996	schtasks.exe
4316	schtasks.exe
2340	schtasks.exe
4336	schtasks.exe
928	schtasks.exe
4928	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe
2972	Msfontruntime.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2972	Msfontruntime.exe
Token: SeDebugPrivilege	3944	services.exe
Token: SeDebugPrivilege	3300	services.exe
Token: SeDebugPrivilege	3080	services.exe
Token: SeDebugPrivilege	4132	services.exe
Token: SeDebugPrivilege	2460	services.exe
Token: SeDebugPrivilege	2776	services.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 3372	2096	NeverLose.exe	89
PID 2096 wrote to memory of 3372	2096	NeverLose.exe	89
PID 2096 wrote to memory of 3372	2096	NeverLose.exe	89
PID 3372 wrote to memory of 1920	3372	WScript.exe	99
PID 3372 wrote to memory of 1920	3372	WScript.exe	99
PID 3372 wrote to memory of 1920	3372	WScript.exe	99
PID 1920 wrote to memory of 2972	1920	cmd.exe	101
PID 1920 wrote to memory of 2972	1920	cmd.exe	101
PID 2972 wrote to memory of 1140	2972	Msfontruntime.exe	105
PID 2972 wrote to memory of 1140	2972	Msfontruntime.exe	105
PID 1140 wrote to memory of 2256	1140	csc.exe	107
PID 1140 wrote to memory of 2256	1140	csc.exe	107
PID 2972 wrote to memory of 3212	2972	Msfontruntime.exe	108
PID 2972 wrote to memory of 3212	2972	Msfontruntime.exe	108
PID 3212 wrote to memory of 4824	3212	csc.exe	110
PID 3212 wrote to memory of 4824	3212	csc.exe	110
PID 2972 wrote to memory of 3800	2972	Msfontruntime.exe	126
PID 2972 wrote to memory of 3800	2972	Msfontruntime.exe	126
PID 3800 wrote to memory of 1956	3800	cmd.exe	128
PID 3800 wrote to memory of 1956	3800	cmd.exe	128
PID 3800 wrote to memory of 5088	3800	cmd.exe	129
PID 3800 wrote to memory of 5088	3800	cmd.exe	129
PID 3800 wrote to memory of 3944	3800	cmd.exe	130
PID 3800 wrote to memory of 3944	3800	cmd.exe	130
PID 3944 wrote to memory of 1556	3944	services.exe	131
PID 3944 wrote to memory of 1556	3944	services.exe	131
PID 1556 wrote to memory of 1788	1556	cmd.exe	133
PID 1556 wrote to memory of 1788	1556	cmd.exe	133
PID 1556 wrote to memory of 4204	1556	cmd.exe	134
PID 1556 wrote to memory of 4204	1556	cmd.exe	134
PID 1556 wrote to memory of 3300	1556	cmd.exe	135
PID 1556 wrote to memory of 3300	1556	cmd.exe	135
PID 3300 wrote to memory of 928	3300	services.exe	137
PID 3300 wrote to memory of 928	3300	services.exe	137
PID 928 wrote to memory of 320	928	cmd.exe	139
PID 928 wrote to memory of 320	928	cmd.exe	139
PID 928 wrote to memory of 4420	928	cmd.exe	140
PID 928 wrote to memory of 4420	928	cmd.exe	140
PID 928 wrote to memory of 3080	928	cmd.exe	142
PID 928 wrote to memory of 3080	928	cmd.exe	142
PID 3080 wrote to memory of 2908	3080	services.exe	143
PID 3080 wrote to memory of 2908	3080	services.exe	143
PID 2908 wrote to memory of 4976	2908	cmd.exe	145
PID 2908 wrote to memory of 4976	2908	cmd.exe	145
PID 2908 wrote to memory of 4528	2908	cmd.exe	146
PID 2908 wrote to memory of 4528	2908	cmd.exe	146
PID 2908 wrote to memory of 4132	2908	cmd.exe	147
PID 2908 wrote to memory of 4132	2908	cmd.exe	147
PID 4132 wrote to memory of 1852	4132	services.exe	148
PID 4132 wrote to memory of 1852	4132	services.exe	148
PID 1852 wrote to memory of 3764	1852	cmd.exe	150
PID 1852 wrote to memory of 3764	1852	cmd.exe	150
PID 1852 wrote to memory of 2888	1852	cmd.exe	151
PID 1852 wrote to memory of 2888	1852	cmd.exe	151
PID 1852 wrote to memory of 2460	1852	cmd.exe	152
PID 1852 wrote to memory of 2460	1852	cmd.exe	152
PID 2460 wrote to memory of 3856	2460	services.exe	153
PID 2460 wrote to memory of 3856	2460	services.exe	153
PID 3856 wrote to memory of 4480	3856	cmd.exe	155
PID 3856 wrote to memory of 4480	3856	cmd.exe	155
PID 3856 wrote to memory of 4064	3856	cmd.exe	156
PID 3856 wrote to memory of 4064	3856	cmd.exe	156
PID 3856 wrote to memory of 2776	3856	cmd.exe	157
PID 3856 wrote to memory of 2776	3856	cmd.exe	157

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\NeverLose.exe
"C:\Users\Admin\AppData\Local\Temp\NeverLose.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\agentMonitornetcommon\GBi0Q8YazuDC5WsFvOE.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\agentMonitornetcommon\g9S8CVbETtCg5QN5yxxbdptY4CtSRTw.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\agentMonitornetcommon\Msfontruntime.exe
      "C:\agentMonitornetcommon/Msfontruntime.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2972
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4qysqrnt\4qysqrnt.cmdline"
        5⤵
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:1140
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8A97.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSCB7564BA7A1A1433D933247B6859686A0.TMP"
        6⤵
        
        PID:2256
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\q5yy3lqc\q5yy3lqc.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3212
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8B24.tmp" "c:\Windows\System32\CSCC8D45144760144B3A4E6B1AC95D025B1.TMP"
        6⤵
        
        PID:4824
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xeWzB1YUhp.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3800
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1956
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:5088
      - C:\agentMonitornetcommon\services.exe
        
        "C:\agentMonitornetcommon\services.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3944
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SbXYQ83spR.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1556
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:1788
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:4204
        
        C:\agentMonitornetcommon\services.exe
        
        "C:\agentMonitornetcommon\services.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3300
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Iwn65xDDbU.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:928
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:320
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:4420
        
        C:\agentMonitornetcommon\services.exe
        
        "C:\agentMonitornetcommon\services.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3080
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ahsqPXjhJl.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2908
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:4976
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:4528
        
        C:\agentMonitornetcommon\services.exe
        
        "C:\agentMonitornetcommon\services.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4132
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AC4J3hngkK.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1852
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:3764
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2888
        
        C:\agentMonitornetcommon\services.exe
        
        "C:\agentMonitornetcommon\services.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2460
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\s6L5myzuOs.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:3856
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:4480
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:4064
        
        C:\agentMonitornetcommon\services.exe
        
        "C:\agentMonitornetcommon\services.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2776
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TqMgut2j0M.bat"
        17⤵
        
        PID:1264
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:3476
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4444,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
1⤵
PID:3952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\agentMonitornetcommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\agentMonitornetcommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\agentMonitornetcommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Multimedia Platform\MoUsoCoreWorker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Multimedia Platform\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 9 /tr "'C:\agentMonitornetcommon\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\agentMonitornetcommon\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 10 /tr "'C:\agentMonitornetcommon\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\agentMonitornetcommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\agentMonitornetcommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\agentMonitornetcommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\agentMonitornetcommon\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\agentMonitornetcommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\agentMonitornetcommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MsfontruntimeM" /sc MINUTE /mo 5 /tr "'C:\agentMonitornetcommon\Msfontruntime.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Msfontruntime" /sc ONLOGON /tr "'C:\agentMonitornetcommon\Msfontruntime.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MsfontruntimeM" /sc MINUTE /mo 14 /tr "'C:\agentMonitornetcommon\Msfontruntime.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\services.exe.log

Filesize
1KB

MD5
f8b2fca3a50771154571c11f1c53887b

SHA1
2e83b0c8e2f4c10b145b7fb4832ed1c78743de3f

SHA256
0efa72802031a8f902c3a4ab18fe3d667dafc71c93eb3a1811e78353ecf4a6b6

SHA512
b98b8d5516593d13415199d4ac6fbe4ff924488487c4bd863cb677601048785d872a3ff30129148e2961cb6fb2fc33117540302980a132f57f7ec9a497813f1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AC4J3hngkK.bat

Filesize
213B

MD5
5c0f8cfea10f3a088ff0fec348f18177

SHA1
58b9307199032e5c020fc0ce6c6545f68e39a5f6

SHA256
c62fd9d7c2e63de4df2fc6620dd7023d77c1227d41285c72d2581276ccb21df9

SHA512
47b1d17e340a56eb9be04962c7fa713d63ae37eeb4764287a8c653d5a7160a464164d9bae0d273a9d2d9a4e14f20bb02422c26b79837786a624959dcb6fb0aa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Iwn65xDDbU.bat

Filesize
213B

MD5
b417b9795fa52ec915b59e7fadc07ecd

SHA1
ffac64b7255108b2ebce20b7cd57b7cc41ef597b

SHA256
804340398f768a19a736412e45003f8b911d1b653267b9784a51aae6f0f351ee

SHA512
7aba38dec0e05465bf63e34e1f1e772501d3b098cfc416ac1e13ddfcc6370adbbfd60eb2fe16b06f4cf6bae844af61e603f8a4537f8c69f5c28d72b5e1051453

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES8A97.tmp

Filesize
1KB

MD5
ddcfd8308469feeb0a97168b6fd8a2d4

SHA1
1e512c972aedfd368cc5c4db21b6368dba2dfc59

SHA256
29ff9fd5262463cb740b69da923610ba1a7f43334100d6f87af0de6c8ef0bcf4

SHA512
4059ba828f431b5325f751e517aef0306e7a87dfaf3a942708eb71782d0671488f204c2626107bccafcf94c6200bfcb68706ed421eeb2afb27eea0fcb585ce14

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES8B24.tmp

Filesize
1KB

MD5
948bab05474ecf7da668e081ee903727

SHA1
f8ac9af42a20f74f8fe489c392cfd30c30d41c8a

SHA256
7b80fc15390c31dbe36dbabb5f485422665503b53481721090408fef1afbdf3b

SHA512
5c0e32a785056936e41793982bd35168fd64212ee273a87913e84cd15ed8068aef008c34c176aedbaafe887288b9dbe2bdd62d8b68ee32f32acf933e358a0597

Download Submit
C:\Users\Admin\AppData\Local\Temp\SbXYQ83spR.bat

Filesize
213B

MD5
b3988785ace97a6901265fe0105c4bd1

SHA1
9fe8f335ca76b340c21dd867645778b9419a81a7

SHA256
cb8a7f961e3c7c5a514f1c49b54b1918774abc30cff755dda155c4eea5048fb9

SHA512
141e2082a702061b25f7874abfaceb3a765f1457429003787e3b9be12fb1da7c46c873a6982b9c44655766d3ddddf355ec6f261ec739acc10789597a903a872e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TqMgut2j0M.bat

Filesize
213B

MD5
25767abbf7b681883b35bfc1cea4fd8e

SHA1
8a5b20d13d90243545e91c48853ed45fae368978

SHA256
8fc95bc5bd424fecec1a7daec041a727448511b67ab5d3415b343bbea3381da1

SHA512
f80c72a08ce20f106fd7b0407c9cf303c0a589cbe067c5f5560308a1b518d7d67b051bcfe04ca44878b533507f92dbfe7012b340638502717d064228ed9faded

Download Submit
C:\Users\Admin\AppData\Local\Temp\ahsqPXjhJl.bat

Filesize
213B

MD5
3da76f9da2fa4db40fa99aac59c2b1ec

SHA1
387f7eb2de2df7fc08b6b9c38a23cb2cbc0b46f5

SHA256
949e1d767a6e09803fb5ee8af14b3db5d6e680fa259fafffffc44418dbbae474

SHA512
9dd63b478de8b207014ffd3b8d6f4a8e089e7fc9bd6af77ef276105220ef9780fe9b9d3552340f3369b445b948dba7e1edea9076d2a30c1476f6506a2c8e9978

Download Submit
C:\Users\Admin\AppData\Local\Temp\s6L5myzuOs.bat

Filesize
213B

MD5
cec40cb4975636240eb1e334fde3dd7d

SHA1
f5f55b1c1760012d3771d15c1548b14a09622659

SHA256
ce6431e5502103da5afd850a741b5434157deb73c5ea6f4a5dcaa58a32e88a16

SHA512
050f9902f56ee8b1ea49335c15dcf6318ec3dac6f2157e3cd3217602cbf02d4db89157bec54e104700aebcc54ea3d98b525ae32133aa6fd1f4cc40304deae87e

Download Submit
C:\Users\Admin\AppData\Local\Temp\xeWzB1YUhp.bat

Filesize
213B

MD5
17178c9f4a4e7a25f98fece51412dedc

SHA1
0bda896ec49c9c83e0990a4b441467bb22a7c5eb

SHA256
505a06bfe3c8af8444634a5e9b93fc07fc8a4d41732d9673534e62ea4eaa5f73

SHA512
c9bc29600a316a79c4ef7c37ef763bf0f2ef0c46970bc8a898a5bff9f3a8b69d7dbb944281f95886de79bf8e95a5ad1e539295cdc16f29137f3d9e4c261ee915

Download Submit
C:\agentMonitornetcommon\GBi0Q8YazuDC5WsFvOE.vbe

Filesize
231B

MD5
e9836fb94a627362459e478f344fe010

SHA1
ce16cdd9513923ac775a7498e4548d4a66bcef2c

SHA256
fe4eda0eca7f098fe7ad5ce5a5e8f68d8735e24e93654fb61e3187d6e6207235

SHA512
f589c484cea94694a9405a3cd49111671ba479f526a9068d46c30f59dd1f813b85eb08c1fb76d39ff4d268ee94da307b4fa70afe3454faa062ddaa71ad7e7f1b

Download Submit
C:\agentMonitornetcommon\Msfontruntime.exe

Filesize
1.8MB

MD5
769730d9ed728056adc3c69648deae26

SHA1
6c0a76de7715745eb3ca344d6ad5665c66f10ace

SHA256
c4f58fcf47c8897c4e3fe97b40c8ae6e3093242d37eecc325f5e89e1f7f1ca89

SHA512
9124c43ff1df0b56bfe9c1211abe997ce83bc4941546fd48c26414e43ec9117a2f009c7290019579fc09726cb93c78de90aa4d3589222a105985f287c28116ab

Download Submit
C:\agentMonitornetcommon\g9S8CVbETtCg5QN5yxxbdptY4CtSRTw.bat

Filesize
82B

MD5
8beb041aab9fe0aa4f76082b7329a1a5

SHA1
6c1dd365d03640042ff51a2a3ada9a764706efba

SHA256
4504697922de405075ca52ec9d6c636ad153e3cd06b1ad1ae33a9f5e6edb2646

SHA512
286a95f6182408207e0db553ee3b5ab67ff60d5238984db49abe0a4497ee0fdf9c4210d2adfb5a1257dcdedabff0b067a8bee27f1e581a02364f9e8fd6bda7e6

Download Submit
\??\c:\Program Files (x86)\Microsoft\Edge\Application\CSCB7564BA7A1A1433D933247B6859686A0.TMP

Filesize
1KB

MD5
b5189fb271be514bec128e0d0809c04e

SHA1
5dd625d27ed30fca234ec097ad66f6c13a7edcbe

SHA256
e1984ba1e3ff8b071f7a320a6f1f18e1d5f4f337d31dc30d5bdfb021df39060f

SHA512
f0fcb8f97279579beb59f58ea89527ee0d86a64c9de28300f14460bec6c32dda72f0e6466573b6654a1e992421d6fe81ae7cce50f27059f54cf9fdca6953602e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4qysqrnt\4qysqrnt.0.cs

Filesize
399B

MD5
2c0655bb5e22706329c197a2fbbec2d3

SHA1
ea8d350cae99088d0dcc7426e3111b692e371515

SHA256
a97ddf831a5e1f1355dfda08b35857468015e489f41603a5fce30566424f0ea0

SHA512
27862ff916f015ee3c4f689317202fee90323c8de49f251f47110b009d579985627a9901089f34d64feaaec3f13638b7f30333c5cb24d6d156f5f716eb99f5fd

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4qysqrnt\4qysqrnt.cmdline

Filesize
265B

MD5
fdc65103fc8762a41ed1a4f562e40d0d

SHA1
59a0e24393083fda28a06480bc83fb06a059396a

SHA256
0c697cfad4d9e4062bc249e4780f2b8c6d8a02bec008e6e9f6a633db0460b42b

SHA512
0dd94b428cb04b35cab793f3220bf0d46e7a80281332fcdef5820aa57c71591b61230ccbe2dced5ddfee03750868d1ff9ba834fd8ec8b5308121c83a26eced73

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\q5yy3lqc\q5yy3lqc.0.cs

Filesize
369B

MD5
4718956def87788e37e7e96b071333b9

SHA1
0a74876c62217776b1b2c70254d4fb55e4c53f76

SHA256
7e25a1bd279fe603d87656fe2d35fe6805f94de9192fb49dca831db85c6d25b9

SHA512
72e05ebf486b5f468f270fa93b58d6f33f807567fb4001a13417be60da4be97caf2808b2d30da0a2fd6b7d15c691dde6b5aece95172f71fe28fac8aca9bbebc7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\q5yy3lqc\q5yy3lqc.cmdline

Filesize
235B

MD5
9cc6308fc75d9223fa191b7cb89696c0

SHA1
02ef52b13f6a0ab037ae06d39491350ba2156bb1

SHA256
5965150df7d5a03ce378604cc0dcceb397083f50edd2b13f137c8e690c081b04

SHA512
1b8a36347150496b6cc3d421c46fb491623b52032450901295b7996b43be607fb824d6784d3c2769b8da6888e1fe206430dfe0995979225c85c94cfb9e90936e

Download Submit
\??\c:\Windows\System32\CSCC8D45144760144B3A4E6B1AC95D025B1.TMP

Filesize
1KB

MD5
defac805d7edc8907512384855c67e24

SHA1
b0b59b7f5f6b872236a383a2381fbdcc7b2b630e

SHA256
57cf2da2350701d9232969935334b4bbda42f10945aac7757c951108e0bd24fc

SHA512
5dcbdf30678b41c0916b0cf60575ea0029a0acb3ebf2f3a38019d2ce83619a007cc75c8109395d33e1c083cb10a92dc9e94b2b6208526051c0e563448eb10b1f

Download Submit
memory/2460-126-0x000000001D490000-0x000000001D539000-memory.dmp

Filesize
676KB

Download
memory/2776-137-0x000000001D7F0000-0x000000001D899000-memory.dmp

Filesize
676KB

Download
memory/2972-63-0x000000001B9D0000-0x000000001BA79000-memory.dmp

Filesize
676KB

Download
memory/2972-22-0x0000000002960000-0x000000000296C000-memory.dmp

Filesize
48KB

Download
memory/2972-12-0x00007FF9CD483000-0x00007FF9CD485000-memory.dmp

Filesize
8KB

Download
memory/2972-65-0x000000001BEE0000-0x000000001BF81000-memory.dmp

Filesize
644KB

Download
memory/2972-64-0x000000001BE80000-0x000000001BED6000-memory.dmp

Filesize
344KB

Download
memory/2972-13-0x0000000000540000-0x000000000071A000-memory.dmp

Filesize
1.9MB

Download
memory/2972-15-0x0000000002950000-0x000000000295E000-memory.dmp

Filesize
56KB

Download
memory/2972-17-0x0000000002980000-0x000000000299C000-memory.dmp

Filesize
112KB

Download
memory/2972-18-0x000000001B3F0000-0x000000001B440000-memory.dmp

Filesize
320KB

Download
memory/2972-20-0x00000000029A0000-0x00000000029B8000-memory.dmp

Filesize
96KB

Download
memory/3080-104-0x000000001D490000-0x000000001D539000-memory.dmp

Filesize
676KB

Download
memory/3300-92-0x000000001D300000-0x000000001D46A000-memory.dmp

Filesize
1.4MB

Download
memory/3300-93-0x000000001D470000-0x000000001D519000-memory.dmp

Filesize
676KB

Download
memory/3944-79-0x000000001CBE0000-0x000000001CD4A000-memory.dmp

Filesize
1.4MB

Download
memory/3944-80-0x000000001CD50000-0x000000001CDF9000-memory.dmp

Filesize
676KB

Download
memory/4132-115-0x000000001E290000-0x000000001E339000-memory.dmp

Filesize
676KB

Download