Overview

overview

10

Static

static

1

Sunlogin.msi

windows7-x64

10

Sunlogin.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2024, 01:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Sunlogin.msi
  • Size 64.5MB
  • Sample241003-bnt3aaxapj
  • SHA256 6778731439d35e8ba56caca738098ed7b573cf47296ff728b9e86f1896ce0ad9
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
rhadamanthysdiscoveryevasionpersistenceprivilege_escalationstealerupx

Malware Config

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Windows Firewall 2 TTPs 26 IoCs
    evasion
  • Drops file in System32 directory 34 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 20 IoCs
  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 22 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:612
      • C:\Windows\SysWOW64\openwith.exe
        "C:\Windows\system32\openwith.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1044
    • C:\Windows\system32\msiexec.exe
      msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Sunlogin.msi
      1⤵
      • Enumerates connected drives
      • Event Triggered Execution: Installer Packages
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:1588
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3592
      • C:\Windows\system32\srtasks.exe
        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4692
      • C:\Program Files (x86)\sunlogin\SunloginAnquan.exe
        "C:\Program Files (x86)\sunlogin\SunloginAnquan.exe" "C:\Program Files (x86)\sunlogin\config.ini"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4356
      • C:\Program Files (x86)\sunlogin\SunloginAnquan.exe
        "C:\Program Files (x86)\sunlogin\SunloginAnquan.exe" "C:\Program Files (x86)\sunlogin\sun_config.ini"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4128
      • C:\Program Files (x86)\sunlogin\SunloginClient.exe
        "C:\Program Files (x86)\sunlogin\SunloginClient.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:816
        • C:\Program Files (x86)\sunlogin\SunloginClient.exe
          "C:\Program Files (x86)\sunlogin\SunloginClient.exe" --mod=install --admin=1
          3⤵
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1564
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c install.bat SunloginClient
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:68
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ver
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1628
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c netsh advfirewall firewall delete rule name="SunloginClient"
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1688
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall delete rule name="SunloginClient"
                6⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:4960
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c netsh advfirewall firewall add rule name="SunloginClient" dir=in action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=tcp enable=yes profile=public
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4556
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall add rule name="SunloginClient" dir=in action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=tcp enable=yes profile=public
                6⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:4772
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c netsh advfirewall firewall add rule name="SunloginClient" dir=in action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=udp enable=yes profile=public
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1492
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall add rule name="SunloginClient" dir=in action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=udp enable=yes profile=public
                6⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:4048
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c netsh advfirewall firewall add rule name="SunloginClient" dir=out action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=tcp enable=yes profile=public
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4408
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall add rule name="SunloginClient" dir=out action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=tcp enable=yes profile=public
                6⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:3832
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c netsh advfirewall firewall add rule name="SunloginClient" dir=out action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=udp enable=yes profile=public
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4712
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall add rule name="SunloginClient" dir=out action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=udp enable=yes profile=public
                6⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:1016
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c netsh advfirewall firewall add rule name="SunloginClient" dir=in action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=tcp enable=yes profile=domain
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2148
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall add rule name="SunloginClient" dir=in action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=tcp enable=yes profile=domain
                6⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:3756
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c netsh advfirewall firewall add rule name="SunloginClient" dir=in action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=udp enable=yes profile=domain
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1192
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall add rule name="SunloginClient" dir=in action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=udp enable=yes profile=domain
                6⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:1992
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c netsh advfirewall firewall add rule name="SunloginClient" dir=out action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=tcp enable=yes profile=domain
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1060
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall add rule name="SunloginClient" dir=out action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=tcp enable=yes profile=domain
                6⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:4200
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c netsh advfirewall firewall add rule name="SunloginClient" dir=out action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=udp enable=yes profile=domain
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2636
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall add rule name="SunloginClient" dir=out action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=udp enable=yes profile=domain
                6⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:4280
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c netsh advfirewall firewall add rule name="SunloginClient" dir=in action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=tcp enable=yes profile=private
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1272
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall add rule name="SunloginClient" dir=in action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=tcp enable=yes profile=private
                6⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:4068
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c netsh advfirewall firewall add rule name="SunloginClient" dir=in action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=udp enable=yes profile=private
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4072
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall add rule name="SunloginClient" dir=in action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=udp enable=yes profile=private
                6⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:768
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c netsh advfirewall firewall add rule name="SunloginClient" dir=out action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=tcp enable=yes profile=private
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4532
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall add rule name="SunloginClient" dir=out action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=tcp enable=yes profile=private
                6⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:1588
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c netsh advfirewall firewall add rule name="SunloginClient" dir=out action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=udp enable=yes profile=private
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4592
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall add rule name="SunloginClient" dir=out action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" protocol=udp enable=yes profile=private
                6⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:816
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c netsh advfirewall firewall delete rule name="SunloginDesktopAgent"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2236
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall delete rule name="SunloginDesktopAgent"
                6⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:4100
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c netsh advfirewall firewall add rule name="SunloginDesktopAgent" dir=in action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\agent\SunloginClient.exe" protocol=tcp enable=yes profile=public
              5⤵
                PID:948
                • C:\Windows\SysWOW64\netsh.exe
                  netsh advfirewall firewall add rule name="SunloginDesktopAgent" dir=in action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\agent\SunloginClient.exe" protocol=tcp enable=yes profile=public
                  6⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:2040
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c netsh advfirewall firewall add rule name="SunloginDesktopAgent" dir=in action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\agent\SunloginClient.exe" protocol=udp enable=yes profile=public
                5⤵
                  PID:2064
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh advfirewall firewall add rule name="SunloginDesktopAgent" dir=in action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\agent\SunloginClient.exe" protocol=udp enable=yes profile=public
                    6⤵
                    • Modifies Windows Firewall
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:1688
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c netsh advfirewall firewall add rule name="SunloginDesktopAgent" dir=out action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\agent\SunloginClient.exe" protocol=tcp enable=yes profile=public
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:5012
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh advfirewall firewall add rule name="SunloginDesktopAgent" dir=out action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\agent\SunloginClient.exe" protocol=tcp enable=yes profile=public
                    6⤵
                    • Modifies Windows Firewall
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:4772
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c netsh advfirewall firewall add rule name="SunloginDesktopAgent" dir=out action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\agent\SunloginClient.exe" protocol=udp enable=yes profile=public
                  5⤵
                    PID:1176
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh advfirewall firewall add rule name="SunloginDesktopAgent" dir=out action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\agent\SunloginClient.exe" protocol=udp enable=yes profile=public
                      6⤵
                      • Modifies Windows Firewall
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:4272
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c netsh advfirewall firewall add rule name="SunloginDesktopAgent" dir=in action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\agent\SunloginClient.exe" protocol=tcp enable=yes profile=domain
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:4632
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh advfirewall firewall add rule name="SunloginDesktopAgent" dir=in action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\agent\SunloginClient.exe" protocol=tcp enable=yes profile=domain
                      6⤵
                      • Modifies Windows Firewall
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:736
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c netsh advfirewall firewall add rule name="SunloginDesktopAgent" dir=in action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\agent\SunloginClient.exe" protocol=udp enable=yes profile=domain
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:3612
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh advfirewall firewall add rule name="SunloginDesktopAgent" dir=in action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\agent\SunloginClient.exe" protocol=udp enable=yes profile=domain
                      6⤵
                      • Modifies Windows Firewall
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:3392
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c netsh advfirewall firewall add rule name="SunloginDesktopAgent" dir=out action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\agent\SunloginClient.exe" protocol=tcp enable=yes profile=domain
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:376
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh advfirewall firewall add rule name="SunloginDesktopAgent" dir=out action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\agent\SunloginClient.exe" protocol=tcp enable=yes profile=domain
                      6⤵
                      • Modifies Windows Firewall
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:4044
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c netsh advfirewall firewall add rule name="SunloginDesktopAgent" dir=out action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\agent\SunloginClient.exe" protocol=udp enable=yes profile=domain
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:3536
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh advfirewall firewall add rule name="SunloginDesktopAgent" dir=out action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\agent\SunloginClient.exe" protocol=udp enable=yes profile=domain
                      6⤵
                      • Modifies Windows Firewall
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:2052
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c netsh advfirewall firewall add rule name="SunloginDesktopAgent" dir=in action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\agent\SunloginClient.exe" protocol=tcp enable=yes profile=private
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:3412
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh advfirewall firewall add rule name="SunloginDesktopAgent" dir=in action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\agent\SunloginClient.exe" protocol=tcp enable=yes profile=private
                      6⤵
                      • Modifies Windows Firewall
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:4648
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c netsh advfirewall firewall add rule name="SunloginDesktopAgent" dir=in action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\agent\SunloginClient.exe" protocol=udp enable=yes profile=private
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:1156
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh advfirewall firewall add rule name="SunloginDesktopAgent" dir=in action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\agent\SunloginClient.exe" protocol=udp enable=yes profile=private
                      6⤵
                      • Modifies Windows Firewall
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:3000
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c netsh advfirewall firewall add rule name="SunloginDesktopAgent" dir=out action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\agent\SunloginClient.exe" protocol=tcp enable=yes profile=private
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:4700
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh advfirewall firewall add rule name="SunloginDesktopAgent" dir=out action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\agent\SunloginClient.exe" protocol=tcp enable=yes profile=private
                      6⤵
                      • Modifies Windows Firewall
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:4748
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c netsh advfirewall firewall add rule name="SunloginDesktopAgent" dir=out action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\agent\SunloginClient.exe" protocol=udp enable=yes profile=private
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:1272
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh advfirewall firewall add rule name="SunloginDesktopAgent" dir=out action=allow program="C:\Program Files (x86)\Oray\SunLogin\SunloginClient\agent\SunloginClient.exe" protocol=udp enable=yes profile=private
                      6⤵
                      • Modifies Windows Firewall
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:3372
                • C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe
                  "C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" --mod=install --cmd=driver_iddcx
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2764
                  • C:\Program Files (x86)\Oray\SunLogin\SunloginClient\Driver\Idd64\devcon.exe
                    "C:\Program Files (x86)\Oray\SunLogin\SunloginClient\Driver\Idd64\devcon.exe" remove Root\OrayIddDriver
                    5⤵
                    • Executes dropped EXE
                    • Checks SCSI registry key(s)
                    PID:3172
                  • C:\Program Files (x86)\Oray\SunLogin\SunloginClient\Driver\Idd64\devcon.exe
                    "C:\Program Files (x86)\Oray\SunLogin\SunloginClient\Driver\Idd64\devcon.exe" install "C:\Program Files (x86)\Oray\SunLogin\SunloginClient\Driver\Idd64\OrayIddDriver.inf" Root\OrayIddDriver
                    5⤵
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • Executes dropped EXE
                    • Checks SCSI registry key(s)
                    • Modifies data under HKEY_USERS
                    PID:4592
                • C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe
                  "C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" --mod=install --cmd=driver_vgc
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1628
                  • C:\Program Files (x86)\Oray\SunLogin\SunloginClient\Driver\VGC64\devcon.exe
                    "C:\Program Files (x86)\Oray\SunLogin\SunloginClient\Driver\VGC64\devcon.exe" remove oray\orayvgc
                    5⤵
                    • Executes dropped EXE
                    • Checks SCSI registry key(s)
                    PID:2428
                  • C:\Program Files (x86)\Oray\SunLogin\SunloginClient\Driver\VGC64\devcon.exe
                    "C:\Program Files (x86)\Oray\SunLogin\SunloginClient\Driver\VGC64\devcon.exe" install "C:\Program Files (x86)\Oray\SunLogin\SunloginClient\Driver\VGC64\orayvgc.inf" oray\orayvgc
                    5⤵
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • Executes dropped EXE
                    • Checks SCSI registry key(s)
                    • Modifies data under HKEY_USERS
                    PID:4812
                • C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe
                  "C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" --mod=install --cmd=driver_usbip_vhci
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1352
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:4616
          • C:\Program Files (x86)\sunlogin\SunloginAnquan.exe
            "C:\Program Files (x86)\sunlogin\SunloginAnquan.exe" "C:\Program Files (x86)\sunlogin\config.ini"
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:4016
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
            1⤵
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            PID:652
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "1" "c:\program files (x86)\oray\sunlogin\sunloginclient\driver\idd64\orayidddriver.inf" "9" "413a31447" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "c:\program files (x86)\oray\sunlogin\sunloginclient\driver\idd64"
              2⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              PID:4380
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "1" "c:\program files (x86)\oray\sunlogin\sunloginclient\driver\vgc64\orayvgc.inf" "9" "4bd6fcd83" "0000000000000174" "WinSta0\Default" "0000000000000178" "208" "c:\program files (x86)\oray\sunlogin\sunloginclient\driver\vgc64"
              2⤵
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              PID:3112
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "2" "211" "ROOT\DISPLAY\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:c14ce8840c48fa1f:OrayIddDriver_Install:17.1.58.818:root\orayidddriver," "413a31447" "0000000000000148"
              2⤵
              • Drops file in Drivers directory
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              PID:3080
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:c14ce884b119bfa2:OrayVGC_Device:1.0.0.0:oray\orayvgc," "4bd6fcd83" "0000000000000174"
              2⤵
              • Drops file in Drivers directory
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              PID:3824
          • C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe
            "C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" --mod=service
            1⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4632
            • C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe
              "C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" --mod=watch --pid=4632
              2⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:436
            • C:\Program Files (x86)\Oray\SunLogin\SunloginClient\sunlogin_guard\32\sunlogin_guard.exe
              "C:\Program Files (x86)\Oray\SunLogin\SunloginClient\sunlogin_guard\32\sunlogin_guard.exe" start -mode worker -server api-ti.sunlogin.oray.com -sunlogin -appname "Global\966DDA87-F543-42B4-B6CE-A1225068B7C7" -client_id "" -uid 0 -ua "SLRC/15.6.8.14962 (Windows,appname=sunloginRemoteClient)"
              2⤵
              • Drops file in Program Files directory
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies data under HKEY_USERS
              PID:4688
            • C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe
              "C:\Program Files (x86)\Oray\SunLogin\SunloginClient\SunloginClient.exe" --mod=update --cmd=check
              2⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2056

          Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Event Triggered Execution

                2
                T1546

                Installer Packages

                1
                T1546.016

                Netsh Helper DLL

                1
                T1546.007

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Event Triggered Execution

                2
                T1546

                Installer Packages

                1
                T1546.016

                Netsh Helper DLL

                1
                T1546.007

                Defense Evasion

                Impair Defenses

                1
                T1562

                Disable or Modify System Firewall

                1
                T1562.004

                Modify Registry

                1
                T1112

                System Binary Proxy Execution

                1
                T1218

                Msiexec

                1
                T1218.007

                Credential Access

                Discovery

                Peripheral Device Discovery

                2
                T1120

                Query Registry

                4
                T1012

                System Information Discovery

                3
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                Lateral Movement

                Collection

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                e57e2fe.rbs
                • Path C:\Config.Msi\e57e2fe.rbs
                • Size 8KB
                • SHA256 bf280b22e027c88f49dcb483353fb99c0792086630d3dbf3950a02358fefe86c
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                OrayIddDriver.inf
                • Path C:\Program Files (x86)\Oray\SunLogin\SunloginClient\Driver\Idd64\OrayIddDriver.inf
                • Size 3KB
                • SHA256 3a6461ceb7e5bdae8ec9aa737e95db47c0736e950133afe9c83ab452ee3f3e1f
                • MD5 SHA1 SHA512
                Submit Download

                devcon.exe
                • Path C:\Program Files (x86)\Oray\SunLogin\SunloginClient\Driver\Idd64\devcon.exe
                • Size 80KB
                • SHA256 a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                orayvgc.inf
                • Path C:\Program Files (x86)\Oray\SunLogin\SunloginClient\Driver\VGC64\orayvgc.inf
                • Size 1KB
                • SHA256 f461b2f8937641a72fe2303b7a16bf36bb67ad32adac6bdf8c842590107f9d47
                • MD5 SHA1 SHA512
                Submit Download

                config.ini
                • Path C:\Program Files (x86)\Oray\SunLogin\SunloginClient\config.ini
                • Size 62B
                • SHA256 b5daaa1c34505f56dcf46eea254970c1d53c8b80194bdfc562fb11ec73782b9c
                • MD5 SHA1 SHA512
                Submit Download

                config.ini
                • Path C:\Program Files (x86)\Oray\SunLogin\SunloginClient\config.ini
                • Size 199B
                • SHA256 0ba8de401a2d145ba33b1be4a2a41fbfa9d8a37d7313e3113dd7916efc461cde
                • MD5 SHA1 SHA512
                Submit Download

                config.ini
                • Path C:\Program Files (x86)\Oray\SunLogin\SunloginClient\config.ini
                • Size 234B
                • SHA256 40d566c2e8ff1984e6ebba09716b792adf81014e0c4da5127c9718ae5748ce6d
                • MD5 SHA1 SHA512
                Submit Download

                install.bat
                • Path C:\Program Files (x86)\Oray\SunLogin\SunloginClient\install.bat
                • Size 4KB
                • SHA256 77470fac948497f08c40f2d960db3dc3476bda636f176f5ba18eae3f8aec0f4f
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                process.dll
                • Path C:\Program Files (x86)\Oray\SunLogin\SunloginClient\sunlogin_guard\32\process.dll
                • Size 495KB
                • SHA256 c4227215b6864cb36cd85ffa642fb03ab3051993eac8d2688ed5898eb12a4506
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                sunlogin_guard.exe
                • Path C:\Program Files (x86)\Oray\SunLogin\SunloginClient\sunlogin_guard\32\sunlogin_guard.exe
                • Size 6.4MB
                • SHA256 ffd56a950ed5105934e02bf9a35e77b3db7cdba8b886df22b7c11346bb235327
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                SunloginAnquan.exe
                • Path C:\Program Files (x86)\sunlogin\SunloginAnquan.exe
                • Size 14KB
                • SHA256 737f08702f00e78dbe78acbeda63b73d04c1f8e741c5282a9aa1409369b6efa8
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                core.dll
                • Path C:\Program Files (x86)\sunlogin\alien\core.dll
                • Size 25KB
                • SHA256 9aa3ca96a84eb5606694adb58776c9e926020ef184828b6f7e6f9b50498f7071
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                config.ini
                • Path C:\Program Files (x86)\sunlogin\config.ini
                • Size 910KB
                • SHA256 ff61c8a6307b8f336964b97055b55229e901f4f0028cb75fab0449ad28e1a607
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                lua5.1.dll
                • Path C:\Program Files (x86)\sunlogin\lua5.1.dll
                • Size 164KB
                • SHA256 fbbe7ee073d0290ac13c98b92a8405ea04dcc6837b4144889885dd70679e933f
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                sun_config.ini
                • Path C:\Program Files (x86)\sunlogin\sun_config.ini
                • Size 636KB
                • SHA256 36ee754501adbc921845f9976038cabf8154db88384fbf89cf315cf14eac6ea7
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                sys_config.ini
                • Path C:\ProgramData\Oray\SunloginClient\sys_config.ini
                • Size 175B
                • SHA256 0e4e6cb213821ae040f88823fb7baa51c877f5f955657808a19837b696679aef
                • MD5 SHA1 SHA512
                Submit Download

                sys_config.ini
                • Path C:\ProgramData\Oray\SunloginClient\sys_config.ini
                • Size 199B
                • SHA256 f5018fed3efb544dc1d79b7d329e9606c1eb37630ce3371b411488a6684267a8
                • MD5 SHA1 SHA512
                Submit Download

                SunloginAnquan.exe.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SunloginAnquan.exe.log
                • Size 521B
                • SHA256 a57a4a3a9e484a52872a0c105ac939bf91e97033f4e40c21e5fd03f0bf8bc548
                • MD5 SHA1 SHA512
                Submit Download

                check_sign_test.log
                • Path C:\Users\Admin\AppData\Local\Temp\check_sign_test.log
                • Size 320B
                • SHA256 419f42dbbeb6db92948a9e58f7245a06be4259f64b85d20f6abec6ff9a975f8d
                • MD5 SHA1 SHA512
                Submit Download

                check_sign_test.log
                • Path C:\Users\Admin\AppData\Local\Temp\check_sign_test.log
                • Size 280B
                • SHA256 ce1a9341dd467c3c10dbca934cb6155e2553dca2130772b936c32fecdfe33aae
                • MD5 SHA1 SHA512
                Submit Download

                dberr.txt
                • Path C:\Windows\System32\CatRoot2\dberr.txt
                • Size 19KB
                • SHA256 8a9a6023b3d5a9459fe9a7efc410efa0fc48ddb444a840f2c9bff6804adb719b
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                OrayVGC.sys
                • Path C:\Windows\System32\DriverStore\Temp\{1841169c-bb61-dd4e-a15a-292eb21224c2}\OrayVGC.sys
                • Size 247KB
                • SHA256 1eb9bb3123a12935b96dd99da432662a7c99393592e3c9fe1d9e67913d0fc7d5
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                dnscache.json
                • Path C:\Windows\TEMP\dnscache.json
                • Size 319B
                • SHA256 cf411f77fb4f6a13d5a77b2d3d680bd9ad2e2861bd77dfdc23b3c3e949bfe797
                • MD5 SHA1 SHA512
                Submit Download

                metadata-2
                • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                • Size 23.7MB
                • SHA256 d50a74ece0e06595ae8b0b34d343841e4b519df64540445403e6a1893408c7bb
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                {34705588-52bf-42ad-86ce-18cb9cbce2bb}_OnDiskSnapshotProp
                • Path \??\Volume{848480a2-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{34705588-52bf-42ad-86ce-18cb9cbce2bb}_OnDiskSnapshotProp
                • Size 6KB
                • SHA256 70f9c51275c8fa66e5ab59c8539e675713fdeda1b86824e993a1e82383fe839b
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                OrayIddDriver.dll
                • Path \??\c:\PROGRA~2\oray\sunlogin\SUNLOG~1\driver\idd64\OrayIddDriver.dll
                • Size 167KB
                • SHA256 1a691b009af202cab4592c6efd145b10d884194d42172463cd8048074465d569
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                OrayIddDriver.cat
                • Path \??\c:\program files (x86)\oray\sunlogin\sunloginclient\driver\idd64\OrayIddDriver.cat
                • Size 11KB
                • SHA256 2e72198be953959f84ebc972d4484134ff2bbb12c4273f754f53a175f379c9b6
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                OrayVGC.cat
                • Path \??\c:\program files (x86)\oray\sunlogin\sunloginclient\driver\vgc64\OrayVGC.cat
                • Size 11KB
                • SHA256 fcecf081baad018376c87b40b05e0822339943d5432376b723d6d023e9bdd740
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                memory/436-431-0x0000000000AE0000-0x0000000006E32000-memory.dmp
                Download

                memory/816-72-0x0000000000530000-0x0000000006882000-memory.dmp
                Download

                memory/816-73-0x0000000000530000-0x0000000006882000-memory.dmp
                Download

                memory/816-80-0x0000000000530000-0x0000000006882000-memory.dmp
                Download

                memory/1044-42-0x0000000000750000-0x0000000000759000-memory.dmp
                Download

                memory/1044-45-0x0000000002530000-0x0000000002930000-memory.dmp
                Download

                memory/1044-46-0x00007FFCECFF0000-0x00007FFCED1E5000-memory.dmp
                Download

                memory/1044-48-0x0000000075E00000-0x0000000076015000-memory.dmp
                Download

                memory/1352-294-0x0000000000AE0000-0x0000000006E32000-memory.dmp
                Download

                memory/1564-435-0x0000000000530000-0x0000000006882000-memory.dmp
                Download

                memory/1564-265-0x0000000000530000-0x0000000006882000-memory.dmp
                Download

                memory/1564-208-0x0000000000530000-0x0000000006882000-memory.dmp
                Download

                memory/1564-429-0x0000000000530000-0x0000000006882000-memory.dmp
                Download

                memory/1564-79-0x0000000000530000-0x0000000006882000-memory.dmp
                Download

                memory/1628-261-0x0000000000AE0000-0x0000000006E32000-memory.dmp
                Download

                memory/2056-433-0x0000000000AE0000-0x0000000006E32000-memory.dmp
                Download

                memory/2056-434-0x0000000000AE0000-0x0000000006E32000-memory.dmp
                Download

                memory/2764-217-0x0000000000AE0000-0x0000000006E32000-memory.dmp
                Download

                memory/4016-77-0x00000000057B0000-0x0000000005816000-memory.dmp
                Download

                memory/4016-76-0x0000000005700000-0x000000000579C000-memory.dmp
                Download

                memory/4128-36-0x0000000000900000-0x0000000000909000-memory.dmp
                Download

                memory/4128-38-0x0000000002270000-0x0000000002670000-memory.dmp
                Download

                memory/4128-39-0x00007FFCECFF0000-0x00007FFCED1E5000-memory.dmp
                Download

                memory/4128-41-0x0000000075E00000-0x0000000076015000-memory.dmp
                Download

                memory/4128-37-0x0000000002270000-0x0000000002670000-memory.dmp
                Download

                memory/4356-44-0x0000000004A20000-0x0000000004A88000-memory.dmp
                Download

                memory/4356-49-0x0000000002500000-0x0000000002522000-memory.dmp
                Download

                memory/4356-50-0x0000000004AE0000-0x0000000004AE7000-memory.dmp
                Download

                memory/4632-430-0x0000000000AE0000-0x0000000006E32000-memory.dmp
                Download

                memory/4632-444-0x0000000000AE0000-0x0000000006E32000-memory.dmp
                Download

                memory/4632-452-0x0000000000AE0000-0x0000000006E32000-memory.dmp
                Download

                memory/4688-432-0x0000000000320000-0x0000000000F28000-memory.dmp
                Download

                memory/4688-439-0x0000000000320000-0x0000000000F28000-memory.dmp
                Download

                memory/4688-446-0x0000000000320000-0x0000000000F28000-memory.dmp
                Download

                memory/4688-450-0x0000000000320000-0x0000000000F28000-memory.dmp
                Download

                memory/4688-454-0x0000000000320000-0x0000000000F28000-memory.dmp
                Download

                memory/4688-458-0x0000000000320000-0x0000000000F28000-memory.dmp
                Download

                memory/4688-462-0x0000000000320000-0x0000000000F28000-memory.dmp
                Download

                memory/4688-466-0x0000000000320000-0x0000000000F28000-memory.dmp
                Download