Overview

overview

10

Static

static

10

980f4f8d01...c1.exe

windows7-x64

10

980f4f8d01...c1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    599s
  • max time network
    603s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/11/2024, 08:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe

  • Size

    30KB

  • MD5

    6a702ef477c5006b5a8f98ac6d10d4b2

  • SHA1

    1698df30c71382a2d14b56d5047ce4ef8db4eb54

  • SHA256

    980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1

  • SHA512

    3ff2bbcdf8b6eac5e6e513973309e096be857f90542ee1c79c50ef789fd207fc65c99f5daacd91f63745f05ad496ea483ada981427991563ef3364ccb4becf2c

  • SSDEEP

    384:PtkpcwLsYEaysekAM1PsLwApaKZ5IRvKztY2Gci0WhYzJjn2Cb1Bg3cW53Yllyt3:PAAxPuPsLwA9ZuYztzYhY0oBEcWGl

Score
10/10
phorphiexxmrigdiscoveryevasionexecutionloaderminerpersistencetrojanworm

Malware Config

Extracted

Family

phorphiex

C2

http://b0t.to/

http://gshrghirhgsgrao.to/

http://hehfaofiehgggao.to/

http://soghrrsoeuhugao.to/

http://eiiiaoihoaeruao.to/

http://roiriorisioroao.to/

http://ouhgousgoahutao.to/

http://oeoaoueuoeuoaao.to/

http://aiaizzzezeezeao.to/

http://ouauooaoaoeeuao.to/

http://oeeoeuueueuueao.to/

http://eobbeaubfeuueao.to/

http://aauaaaeieiieeao.to/

http://aaaeieiiiofffao.to/

http://infineinfinigao.to/

http://baoefubfbfigoao.to/

http://aaauuwiifoogeao.to/

http://plporsiszsgetao.to/

http://gshrghirhgsgrla.co/

http://hehfaofiehgggla.co/
Wallets

1L6sJ7pmk6EGMUoTmpdbLez9dXACcirRHh

qzgdgnfd805z83wpu04rhld0yqs4dlrd35ll0ltqql

Xt8ZtCcG9BFoc7NfUNBVnxcTvYT4mmzh5i

D7otx94yAiXMUuuff23v8PAYH5XpkdQ89M

0xa5228127395263575a4b4f532e4f132b14599d24

LUMrZN6GTetcrXtzMmRayLpRN9JrCNcTe7

t1PVHo3JR9ZAxMxRXgTziGBeDwfb5Gwm64z
Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0

Extracted

Family

phorphiex

C2

http://185.215.113.84

http://185.215.113.66

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
    evasiontrojan
  • Modifies security service 2 TTPs 3 IoCs
    evasion
  • Phorphiex family
    phorphiex
  • Phorphiex payload 3 IoCs
  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
  • Windows security bypass 2 TTPs 24 IoCs
    evasiontrojan
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 31 IoCs
    miner
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 25 IoCs
  • Windows security modification 2 TTPs 28 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 8 IoCs
  • Launches sc.exe 15 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 45 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 59 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3372
      • C:\Users\Admin\AppData\Local\Temp\980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe
        "C:\Users\Admin\AppData\Local\Temp\980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1.exe"
        2⤵
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2228
        • C:\Windows\37949668\sysddnr.exe
          C:\Windows\37949668\sysddnr.exe
          3⤵
          • Modifies Windows Defender Real-time Protection settings
          • Windows security bypass
          • Executes dropped EXE
          • Windows security modification
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4252
          • C:\Users\Admin\AppData\Local\Temp\23441.exe
            C:\Users\Admin\AppData\Local\Temp\23441.exe
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3872
            • C:\Windows\sysblvrvcr.exe
              C:\Windows\sysblvrvcr.exe
              5⤵
              • Modifies security service
              • Windows security bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Windows security modification
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4408
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5060
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3468
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1312
                • C:\Windows\SysWOW64\sc.exe
                  sc stop UsoSvc
                  7⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:536
                • C:\Windows\SysWOW64\sc.exe
                  sc stop WaaSMedicSvc
                  7⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:4632
                • C:\Windows\SysWOW64\sc.exe
                  sc stop wuauserv
                  7⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:4772
                • C:\Windows\SysWOW64\sc.exe
                  sc stop DoSvc
                  7⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:2496
                • C:\Windows\SysWOW64\sc.exe
                  sc stop BITS /wait
                  7⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:1968
              • C:\Users\Admin\AppData\Local\Temp\198133041.exe
                C:\Users\Admin\AppData\Local\Temp\198133041.exe
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:8
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2632
                  • C:\Windows\system32\reg.exe
                    reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                    8⤵
                      PID:1100
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
                    7⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2504
                    • C:\Windows\system32\schtasks.exe
                      schtasks /delete /f /tn "Windows Upgrade Manager"
                      8⤵
                        PID:2496
                  • C:\Users\Admin\AppData\Local\Temp\2090427174.exe
                    C:\Users\Admin\AppData\Local\Temp\2090427174.exe
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:1064
                  • C:\Users\Admin\AppData\Local\Temp\1915218797.exe
                    C:\Users\Admin\AppData\Local\Temp\1915218797.exe
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2464
                    • C:\Users\Admin\AppData\Local\Temp\3892412225.exe
                      C:\Users\Admin\AppData\Local\Temp\3892412225.exe
                      7⤵
                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3404
                  • C:\Users\Admin\AppData\Local\Temp\2285710112.exe
                    C:\Users\Admin\AppData\Local\Temp\2285710112.exe
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:5048
                  • C:\Users\Admin\AppData\Local\Temp\1892230035.exe
                    C:\Users\Admin\AppData\Local\Temp\1892230035.exe
                    6⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:1744
                    • C:\Windows\sysppvrdnvs.exe
                      C:\Windows\sysppvrdnvs.exe
                      7⤵
                      • Modifies security service
                      • Windows security bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Windows security modification
                      • System Location Discovery: System Language Discovery
                      PID:4556
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:2672
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                          9⤵
                          • Command and Scripting Interpreter: PowerShell
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4008
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:1100
                        • C:\Windows\SysWOW64\sc.exe
                          sc stop UsoSvc
                          9⤵
                          • Launches sc.exe
                          • System Location Discovery: System Language Discovery
                          PID:4032
                        • C:\Windows\SysWOW64\sc.exe
                          sc stop WaaSMedicSvc
                          9⤵
                          • Launches sc.exe
                          • System Location Discovery: System Language Discovery
                          PID:3552
                        • C:\Windows\SysWOW64\sc.exe
                          sc stop wuauserv
                          9⤵
                          • Launches sc.exe
                          • System Location Discovery: System Language Discovery
                          PID:1364
                        • C:\Windows\SysWOW64\sc.exe
                          sc stop DoSvc
                          9⤵
                          • Launches sc.exe
                          • System Location Discovery: System Language Discovery
                          PID:672
                        • C:\Windows\SysWOW64\sc.exe
                          sc stop BITS /wait
                          9⤵
                          • Launches sc.exe
                          • System Location Discovery: System Language Discovery
                          PID:3856
                      • C:\Users\Admin\AppData\Local\Temp\2876132126.exe
                        C:\Users\Admin\AppData\Local\Temp\2876132126.exe
                        8⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3104
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                          9⤵
                            PID:4608
                            • C:\Windows\system32\reg.exe
                              reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                              10⤵
                                PID:4688
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
                              9⤵
                                PID:2400
                                • C:\Windows\system32\schtasks.exe
                                  schtasks /delete /f /tn "Windows Upgrade Manager"
                                  10⤵
                                    PID:3268
                              • C:\Users\Admin\AppData\Local\Temp\783223494.exe
                                C:\Users\Admin\AppData\Local\Temp\783223494.exe
                                8⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:60
                              • C:\Users\Admin\AppData\Local\Temp\608015116.exe
                                C:\Users\Admin\AppData\Local\Temp\608015116.exe
                                8⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:624
                              • C:\Users\Admin\AppData\Local\Temp\153056533.exe
                                C:\Users\Admin\AppData\Local\Temp\153056533.exe
                                8⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:3876
                      • C:\Users\Admin\AppData\Local\Temp\12514.exe
                        C:\Users\Admin\AppData\Local\Temp\12514.exe
                        4⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:2968
                      • C:\Users\Admin\AppData\Local\Temp\21276.exe
                        C:\Users\Admin\AppData\Local\Temp\21276.exe
                        4⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:2656
                      • C:\Users\Admin\AppData\Local\Temp\12174.exe
                        C:\Users\Admin\AppData\Local\Temp\12174.exe
                        4⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:3540
                        • C:\Users\Admin\sysblvrvcr.exe
                          C:\Users\Admin\sysblvrvcr.exe
                          5⤵
                          • Modifies security service
                          • Windows security bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Windows security modification
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: SetClipboardViewer
                          PID:3236
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:4776
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                              7⤵
                              • Command and Scripting Interpreter: PowerShell
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3404
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:1596
                            • C:\Windows\SysWOW64\sc.exe
                              sc stop UsoSvc
                              7⤵
                              • Launches sc.exe
                              • System Location Discovery: System Language Discovery
                              PID:508
                            • C:\Windows\SysWOW64\sc.exe
                              sc stop WaaSMedicSvc
                              7⤵
                              • Launches sc.exe
                              • System Location Discovery: System Language Discovery
                              PID:2464
                            • C:\Windows\SysWOW64\sc.exe
                              sc stop wuauserv
                              7⤵
                              • Launches sc.exe
                              • System Location Discovery: System Language Discovery
                              PID:4108
                            • C:\Windows\SysWOW64\sc.exe
                              sc stop DoSvc
                              7⤵
                              • Launches sc.exe
                              • System Location Discovery: System Language Discovery
                              PID:1436
                            • C:\Windows\SysWOW64\sc.exe
                              sc stop BITS /wait
                              7⤵
                              • Launches sc.exe
                              • System Location Discovery: System Language Discovery
                              PID:2156
                          • C:\Users\Admin\AppData\Local\Temp\252852848.exe
                            C:\Users\Admin\AppData\Local\Temp\252852848.exe
                            6⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            PID:544
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                              7⤵
                                PID:1152
                                • C:\Windows\system32\reg.exe
                                  reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                                  8⤵
                                    PID:2612
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
                                  7⤵
                                    PID:1600
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks /delete /f /tn "Windows Upgrade Manager"
                                      8⤵
                                        PID:4568
                                  • C:\Users\Admin\AppData\Local\Temp\2899026932.exe
                                    C:\Users\Admin\AppData\Local\Temp\2899026932.exe
                                    6⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:1844
                                  • C:\Users\Admin\AppData\Local\Temp\3275818656.exe
                                    C:\Users\Admin\AppData\Local\Temp\3275818656.exe
                                    6⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:4528
                                  • C:\Users\Admin\AppData\Local\Temp\36959972.exe
                                    C:\Users\Admin\AppData\Local\Temp\36959972.exe
                                    6⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:3716
                              • C:\Users\Admin\AppData\Local\Temp\24716.exe
                                C:\Users\Admin\AppData\Local\Temp\24716.exe
                                4⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:2744
                              • C:\Users\Admin\AppData\Local\Temp\33749.exe
                                C:\Users\Admin\AppData\Local\Temp\33749.exe
                                4⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:4968
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
                            2⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4808
                          • C:\Windows\System32\schtasks.exe
                            C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
                            2⤵
                              PID:424
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
                              2⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2552
                            • C:\Windows\System32\conhost.exe
                              C:\Windows\System32\conhost.exe
                              2⤵
                                PID:4800
                              • C:\Windows\System32\dwm.exe
                                C:\Windows\System32\dwm.exe
                                2⤵
                                  PID:1776
                              • C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
                                "C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
                                1⤵
                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:4240

                              Network

                                    MITRE ATT&CK Enterprise v15

                                    Reconnaissance

                                    Resource Development

                                    Initial Access

                                    Execution

                                    Command and Scripting Interpreter

                                    1
                                    T1059

                                    PowerShell

                                    1
                                    T1059.001

                                    System Services

                                    1
                                    T1569

                                    Service Execution

                                    1
                                    T1569.002

                                    Persistence

                                    Boot or Logon Autostart Execution

                                    1
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Create or Modify System Process

                                    3
                                    T1543

                                    Windows Service

                                    3
                                    T1543.003

                                    Privilege Escalation

                                    Boot or Logon Autostart Execution

                                    1
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Create or Modify System Process

                                    3
                                    T1543

                                    Windows Service

                                    3
                                    T1543.003

                                    Defense Evasion

                                    Impair Defenses

                                    4
                                    T1562

                                    Disable or Modify Tools

                                    3
                                    T1562.001

                                    Modify Registry

                                    5
                                    T1112

                                    Credential Access

                                    Discovery

                                    Query Registry

                                    2
                                    T1012

                                    System Information Discovery

                                    2
                                    T1082

                                    System Location Discovery

                                    1
                                    T1614

                                    System Language Discovery

                                    1
                                    T1614.001

                                    Lateral Movement

                                    Collection

                                    Command and Control

                                    Exfiltration

                                    Impact

                                    Service Stop

                                    1
                                    T1489

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                      Filesize

                                      3KB

                                      MD5

                                      fee026663fcb662152188784794028ee

                                      SHA1

                                      3c02a26a9cb16648fad85c6477b68ced3cb0cb45

                                      SHA256

                                      dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b

                                      SHA512

                                      7b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                      Filesize

                                      2KB

                                      MD5

                                      968cb9309758126772781b83adb8a28f

                                      SHA1

                                      8da30e71accf186b2ba11da1797cf67f8f78b47c

                                      SHA256

                                      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                      SHA512

                                      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OIPZWEW8\2[1]
                                      Filesize

                                      8KB

                                      MD5

                                      39f45edb23427ebf63197ca138ddb282

                                      SHA1

                                      4be1b15912c08f73687c0e4c74af0979c17ff7d5

                                      SHA256

                                      77fbb0d8630024634880c37da59ce57d1b38c7e85bdcc14c697db9e79c24e0de

                                      SHA512

                                      410f6baad25b256daebfa5d8b8a495429c9e26e7de767b2a0e6e4a75e543b77dbd0abca0335fb1f0d91e49e292b42cedc6edd72d25a3c4c62330e2b31c054cc6

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OIPZWEW8\4[1]
                                      Filesize

                                      10KB

                                      MD5

                                      2266f0aecd351e1b4092e82b941211ea

                                      SHA1

                                      1dced8d943494aa2be39ca28c876f8f736c76ef1

                                      SHA256

                                      cbbad0ab02cd973c9c4e73336e3bcd0849aeb2232a7bdbc38f0b50696b5c28c3

                                      SHA512

                                      6691cd697bbe7f7a03d9de33869aab289d0a1438b4ee194d2047ded957a726b1d3fe93f08e4a0c677018b20e2521aeb021ab1dc4d1a67927604829ddfd9d59aa

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YB8IB6GH\3[1]
                                      Filesize

                                      15KB

                                      MD5

                                      1568efb715bd9797610f55aa48dfb18e

                                      SHA1

                                      076c40d61a821cf3069508ee873f3d4780774cb3

                                      SHA256

                                      f42ef51c4c7c8f607a0405848593369bfc193b771e8ed687540632cad1376216

                                      SHA512

                                      03d4357a8a1faa9110fb023e4c504bcb284d6665848c2918a543c1928ffac78fdf573d201932517c23a22a6e50c3ddd9d9035bbf8e735ddae3bc0fea8949f7e8

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YB8IB6GH\5[1]
                                      Filesize

                                      49KB

                                      MD5

                                      32b17c18ad69f9bce8ffb3066d3dcf61

                                      SHA1

                                      6e2ec5e1a5f8fb0f77465b529aa6fc93aa81ab96

                                      SHA256

                                      ce8fcda2b623fc2a8627cb5a4351ca35736e5bf98f90a2cf91348839ebcea3e6

                                      SHA512

                                      13adac7d6dfbf848a70b5821591e7e0f4625db3334f8d053262b350fa011e7473ded5ac4b69f895dea16b9387318b05c68bd1295a98c58a93db7ac2ed8c11fc1

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      Filesize

                                      18KB

                                      MD5

                                      67d863cd313cd88cc6896bfe11308f33

                                      SHA1

                                      b07ac885ea675afb243f92434b95eaea1eace9c0

                                      SHA256

                                      30be10b39c99210fab100b366a645911a4f815c586f1267d52495a4d2a65d444

                                      SHA512

                                      59408578523607abbe39b4ce6bb53bf32e16071c6dc7a76c0e63033b60581a2af5fa7501c8e2f1d4654e077e193c2c0034b47128902c8b5e01c1f12f5e0a38e4

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      Filesize

                                      1KB

                                      MD5

                                      d95b08252ed624f6d91b46523f110f29

                                      SHA1

                                      17577997bc1fb5d3fbe59be84013165534415dc3

                                      SHA256

                                      342ce7c39bf9992d31d4b61ef138b2b084c96c74736ed00bb19aae49be16ca02

                                      SHA512

                                      0c4288176d56f4ee6d8f08f568fba07ad859f50a395c39d2afd3baf55d3d29ca065a1ce305d1bd790477c35977c0ffa230543e805622f80a77bcee71b24eb257

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      Filesize

                                      1KB

                                      MD5

                                      62032a79f8416ef5fe25b81955c2f5dd

                                      SHA1

                                      9c996b27944668b8fe4a490d7c1a99e94efa190c

                                      SHA256

                                      02a537f84c804887adbfe6404b5b7e060cbe22204206d17cafb3f86c02e594fe

                                      SHA512

                                      f58610ff90367e6b4fa6eaeb9778e3d3032df44bf9577ddd338beaca7201a150709bcdfe38cf88039f4009cba22bcb11099562d2b01ac1089f4d6ee38cdead28

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      Filesize

                                      18KB

                                      MD5

                                      0177cd7db5118a92d9162b03f6ad88aa

                                      SHA1

                                      fcf9695d32c477fc8166954097dd52b1fe149ea7

                                      SHA256

                                      8de99d4f12031857de8e07cdc1f5630a256bc110919db9c8a0c7ae00e910bb1e

                                      SHA512

                                      7c18c9444b7fd93deeb69158a320da874cfee135b995ebf93d808e42ee8ef7d4ada8a9b7d4dcdb5856714264de95cdfbd12b4425ad312f3689d46420e228d99b

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\1892230035.exe
                                      Filesize

                                      83KB

                                      MD5

                                      06560b5e92d704395bc6dae58bc7e794

                                      SHA1

                                      fbd3e4ae28620197d1f02bfc24adaf4ddacd2372

                                      SHA256

                                      9eaaadf3857e4a3e83f4f78d96ab185213b6528c8e470807f9d16035daadf33d

                                      SHA512

                                      b55b49fc1bd526c47d88fcf8a20fcaed900bfb291f2e3e1186ec196a87127ed24df71385ae04fedcc802c362c4ebf38edfc182013febf4496ddeb66ce5195ee3

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\1915218797.exe
                                      Filesize

                                      10KB

                                      MD5

                                      96509ab828867d81c1693b614b22f41d

                                      SHA1

                                      c5f82005dbda43cedd86708cc5fc3635a781a67e

                                      SHA256

                                      a9de2927b0ec45cf900508fec18531c04ee9fa8a5dfe2fc82c67d9458cf4b744

                                      SHA512

                                      ff603117a06da8fb2386c1d2049a5896774e41f34d05951ecd4e7b5fc9da51a373e3fcf61af3577ff78490cf898471ce8e71eae848a12812fe98cd7e76e1a9ca

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\198133041.exe
                                      Filesize

                                      8KB

                                      MD5

                                      cb8420e681f68db1bad5ed24e7b22114

                                      SHA1

                                      416fc65d538d3622f5ca71c667a11df88a927c31

                                      SHA256

                                      5850892f67f85991b31fc90f62c8b7791afeb3c08ae1877d857aa2b59471a2ea

                                      SHA512

                                      baaabcc4ad5d409267a34ed7b20e4afb4d247974bfc581d39aae945e5bf8a673a1f8eacae2e6783480c8baaeb0a80d028274a202d456f13d0af956afa0110fdf

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\2090427174.exe
                                      Filesize

                                      15KB

                                      MD5

                                      0c37ee292fec32dba0420e6c94224e28

                                      SHA1

                                      012cbdddaddab319a4b3ae2968b42950e929c46b

                                      SHA256

                                      981d724feebc36777e99513dc061d1f009e589f965c920797285c46d863060d1

                                      SHA512

                                      2b60b571c55d0441ba0cfc695f9db5cd12660ebec7effc7e893c3b7a1c6cb6149df487c31b8d748697e260cbc4af29331592b705ea9638f64a711c7a6164628b

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\2219415501.exe
                                      Filesize

                                      108KB

                                      MD5

                                      1fcb78fb6cf9720e9d9494c42142d885

                                      SHA1

                                      fef9c2e728ab9d56ce9ed28934b3182b6f1d5379

                                      SHA256

                                      84652bb8c63ca4fd7eb7a2d6ef44029801f3057aa2961867245a3a765928dd02

                                      SHA512

                                      cdf58e463af1784aea86995b3e5d6b07701c5c4095e30ec80cc901ffd448c6f4f714c521bf8796ffa8c47538bf8bf5351e157596efaa7ab88155d63dc33f7dc3

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\2285710112.exe
                                      Filesize

                                      49KB

                                      MD5

                                      c1c2524e6fc9dc3f492248f09cf37d32

                                      SHA1

                                      fabcb2a675dcb31070d763a2fabc90259921a20d

                                      SHA256

                                      d7c3ed2599c214b4dbcdbb34d2f378cc5a99833cc051143338bf848cc87fda97

                                      SHA512

                                      ead31dbcd27538dcd734f7568441dc733ae472dbcc475308b69e90f13cc5b1fda5e13afab4241b18006e81b8e52ff9894685a4e8d2cf9161d2b77716119de89f

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\23441.exe
                                      Filesize

                                      107KB

                                      MD5

                                      f437204b3e1627d8b03eefdf360281ad

                                      SHA1

                                      c824e787a9786d5fdd19effdec54abef217e5b39

                                      SHA256

                                      d4bbc125a9e94de44f4deea9d6b10adc87a1ec1aedd753b39d26bb15817fdadb

                                      SHA512

                                      bdb6fc7d1e7f61df6a7ff3036fd56793e1096937fb07fbe033692f20de1bc81ca0215c5eff5a21627607c1ca514296d9598490c244bba5ec60c74653e1978910

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\3892412225.exe
                                      Filesize

                                      5.6MB

                                      MD5

                                      13b26b2c7048a92d6a843c1302618fad

                                      SHA1

                                      89c2dfc01ac12ef2704c7669844ec69f1700c1ca

                                      SHA256

                                      1753ad35ece25ab9a19048c70062e9170f495e313d7355ebbba59c38f5d90256

                                      SHA512

                                      d6aff89b61c9945002a6798617ad304612460a607ef1cfbdcb32f8932ca648bcee1d5f2e0321bb4c58c1f4642b1e0ececc1eb82450fdec7dff69b5389f195455

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_npcyakfu.q4y.ps1
                                      Filesize

                                      60B

                                      MD5

                                      d17fe0a3f47be24a6453e9ef58c94641

                                      SHA1

                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                      SHA256

                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                      SHA512

                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                      Download Submit

                                    • C:\Users\Admin\AppData\Roaming\Google\Libs\WR64.sys
                                      Filesize

                                      14KB

                                      MD5

                                      0c0195c48b6b8582fa6f6373032118da

                                      SHA1

                                      d25340ae8e92a6d29f599fef426a2bc1b5217299

                                      SHA256

                                      11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

                                      SHA512

                                      ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

                                      Download Submit

                                    • C:\Users\Admin\tbtcmds.dat
                                      Filesize

                                      286B

                                      MD5

                                      3dea10446b12b8b16638c64adee9cf7d

                                      SHA1

                                      79e5eba41ffd6d6d0c633e9851ff2bc8b6fcaea7

                                      SHA256

                                      e178e70155316bffabad28db3daf9f60a878243c5f3b8a59e37adc7664f1a669

                                      SHA512

                                      5247befa86704aeeb1ed782f025bd9b474e14f6a83e0e2b6dd4dc8800c23788fe2ca770aebf8f4c0c0b5be81311a0abf9385f182fb7d0379094fcdd565b7c56d

                                      Download Submit

                                    • C:\Users\Admin\tbtnds.dat
                                      Filesize

                                      4KB

                                      MD5

                                      0c26b4dd78085915c0605dac5bed22f6

                                      SHA1

                                      bcc22f7ee59d6f1eac4cf870853210c42bca15e6

                                      SHA256

                                      9d9b48ffeb14d059f2bfb83a024f867f511ec900098e0add782bf7878ceb5196

                                      SHA512

                                      4fb680312c5dbf82949e8e5d4c67ef5f83f60af66c1af44824e57ea43e392455a11f1fdf755a87597099bc4b8f42628a3ccadb269bcc03480bf35d9167ab7fe1

                                      Download Submit

                                    • C:\Users\Admin\tbtnds.dat
                                      Filesize

                                      4KB

                                      MD5

                                      6c31c8d5243bd27d3c7c0c5f27210666

                                      SHA1

                                      52f20846d2bf117d8ce7afcbe831a4b51bd51202

                                      SHA256

                                      3448c95369f16c92fc1f6e6de9727a9aa1a7e9c04f466182ae237428ee5ee0a9

                                      SHA512

                                      9c11e7cbd2a129878a133ca211bfd793270538c8d44725117a993a85511a42946e282e638a59e29c931d641ca9da1d499aba828f2f4cfb38baa30c4a1f6f335b

                                      Download Submit

                                    • C:\Windows\37949668\sysddnr.exe
                                      Filesize

                                      30KB

                                      MD5

                                      6a702ef477c5006b5a8f98ac6d10d4b2

                                      SHA1

                                      1698df30c71382a2d14b56d5047ce4ef8db4eb54

                                      SHA256

                                      980f4f8d01c746653b3a9b7fc41be0a66d88ac7c8d7f729eb8e123f3604f38c1

                                      SHA512

                                      3ff2bbcdf8b6eac5e6e513973309e096be857f90542ee1c79c50ef789fd207fc65c99f5daacd91f63745f05ad496ea483ada981427991563ef3364ccb4becf2c

                                      Download Submit

                                    • memory/8-120-0x0000000000260000-0x0000000000266000-memory.dmp

                                      Filesize

                                      24KB

                                      Download

                                    • memory/1776-194-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-299-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-312-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-310-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-308-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-303-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-301-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-297-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-264-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-250-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-247-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-245-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-243-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-241-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-239-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-188-0x000002A00F440000-0x000002A00F460000-memory.dmp

                                      Filesize

                                      128KB

                                      Download

                                    • memory/1776-237-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-234-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-190-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-232-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-192-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-230-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-196-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-198-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-200-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-203-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-205-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-207-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-224-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-226-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/1776-228-0x00007FF6A5100000-0x00007FF6A58EF000-memory.dmp

                                      Filesize

                                      7.9MB

                                      Download

                                    • memory/3404-392-0x0000000006150000-0x00000000064A4000-memory.dmp

                                      Filesize

                                      3.3MB

                                      Download

                                    • memory/3404-421-0x0000000007C70000-0x0000000007C84000-memory.dmp

                                      Filesize

                                      80KB

                                      Download

                                    • memory/3404-416-0x0000000007C30000-0x0000000007C41000-memory.dmp

                                      Filesize

                                      68KB

                                      Download

                                    • memory/3404-415-0x0000000007AC0000-0x0000000007B63000-memory.dmp

                                      Filesize

                                      652KB

                                      Download

                                    • memory/3404-405-0x000000006F890000-0x000000006F8DC000-memory.dmp

                                      Filesize

                                      304KB

                                      Download

                                    • memory/3404-397-0x0000000006900000-0x000000000694C000-memory.dmp

                                      Filesize

                                      304KB

                                      Download

                                    • memory/3404-168-0x00007FF697A00000-0x00007FF697F97000-memory.dmp

                                      Filesize

                                      5.6MB

                                      Download

                                    • memory/3468-74-0x0000000007D90000-0x0000000007DA4000-memory.dmp

                                      Filesize

                                      80KB

                                      Download

                                    • memory/3468-30-0x0000000005960000-0x0000000005982000-memory.dmp

                                      Filesize

                                      136KB

                                      Download

                                    • memory/3468-64-0x00000000081E0000-0x000000000885A000-memory.dmp

                                      Filesize

                                      6.5MB

                                      Download

                                    • memory/3468-44-0x0000000006850000-0x000000000689C000-memory.dmp

                                      Filesize

                                      304KB

                                      Download

                                    • memory/3468-65-0x0000000007B60000-0x0000000007B7A000-memory.dmp

                                      Filesize

                                      104KB

                                      Download

                                    • memory/3468-43-0x0000000006810000-0x000000000682E000-memory.dmp

                                      Filesize

                                      120KB

                                      Download

                                    • memory/3468-28-0x0000000005260000-0x0000000005296000-memory.dmp

                                      Filesize

                                      216KB

                                      Download

                                    • memory/3468-42-0x0000000006400000-0x0000000006754000-memory.dmp

                                      Filesize

                                      3.3MB

                                      Download

                                    • memory/3468-52-0x000000006FAA0000-0x000000006FAEC000-memory.dmp

                                      Filesize

                                      304KB

                                      Download

                                    • memory/3468-62-0x0000000006E30000-0x0000000006E4E000-memory.dmp

                                      Filesize

                                      120KB

                                      Download

                                    • memory/3468-29-0x0000000005A40000-0x0000000006068000-memory.dmp

                                      Filesize

                                      6.2MB

                                      Download

                                    • memory/3468-63-0x0000000007A10000-0x0000000007AB3000-memory.dmp

                                      Filesize

                                      652KB

                                      Download

                                    • memory/3468-75-0x0000000007E80000-0x0000000007E9A000-memory.dmp

                                      Filesize

                                      104KB

                                      Download

                                    • memory/3468-66-0x0000000007BB0000-0x0000000007BBA000-memory.dmp

                                      Filesize

                                      40KB

                                      Download

                                    • memory/3468-76-0x0000000007E60000-0x0000000007E68000-memory.dmp

                                      Filesize

                                      32KB

                                      Download

                                    • memory/3468-67-0x0000000007DC0000-0x0000000007E56000-memory.dmp

                                      Filesize

                                      600KB

                                      Download

                                    • memory/3468-68-0x0000000007D60000-0x0000000007D71000-memory.dmp

                                      Filesize

                                      68KB

                                      Download

                                    • memory/3468-32-0x00000000061D0000-0x0000000006236000-memory.dmp

                                      Filesize

                                      408KB

                                      Download

                                    • memory/3468-31-0x0000000006070000-0x00000000060D6000-memory.dmp

                                      Filesize

                                      408KB

                                      Download

                                    • memory/3468-73-0x0000000007D80000-0x0000000007D8E000-memory.dmp

                                      Filesize

                                      56KB

                                      Download

                                    • memory/3468-51-0x0000000006DF0000-0x0000000006E22000-memory.dmp

                                      Filesize

                                      200KB

                                      Download

                                    • memory/4008-290-0x0000000007420000-0x0000000007434000-memory.dmp

                                      Filesize

                                      80KB

                                      Download

                                    • memory/4008-289-0x00000000073F0000-0x0000000007401000-memory.dmp

                                      Filesize

                                      68KB

                                      Download

                                    • memory/4008-288-0x0000000006EB0000-0x0000000006F53000-memory.dmp

                                      Filesize

                                      652KB

                                      Download

                                    • memory/4008-278-0x000000006F9F0000-0x000000006FA3C000-memory.dmp

                                      Filesize

                                      304KB

                                      Download

                                    • memory/4008-277-0x0000000006430000-0x000000000647C000-memory.dmp

                                      Filesize

                                      304KB

                                      Download

                                    • memory/4008-266-0x00000000058D0000-0x0000000005C24000-memory.dmp

                                      Filesize

                                      3.3MB

                                      Download

                                    • memory/4240-187-0x00007FF75ECB0000-0x00007FF75F247000-memory.dmp

                                      Filesize

                                      5.6MB

                                      Download

                                    • memory/4800-189-0x00007FF706B60000-0x00007FF706B89000-memory.dmp

                                      Filesize

                                      164KB

                                      Download

                                    • memory/4800-191-0x00007FF706B60000-0x00007FF706B89000-memory.dmp

                                      Filesize

                                      164KB

                                      Download

                                    • memory/4808-153-0x000001EA1F7F0000-0x000001EA1F812000-memory.dmp

                                      Filesize

                                      136KB

                                      Download