remcos | ff389718792f877fbdabe5cb02a1b3d5de5be988f9b5690250ffdf3409f04000

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 03:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff389718792f877fbdabe5cb02a1b3d5de5be988f9b5690250ffdf3409f04000.msi
Size

1.7MB
MD5

7c26877fcd894cc1355f2a31a551243c
SHA1

80104216da4cd3449eabf0e0de2bb3a5b2de85ca
SHA256

ff389718792f877fbdabe5cb02a1b3d5de5be988f9b5690250ffdf3409f04000
SHA512

a57a961a3339b105f9d5653b69269ed7aab952a4e16600426edee80d628a9ac62a13b5ea642ffd9765fdada7b0db5c5a85a21bc88c125be122bf3c4e89d0cfb8
SSDEEP

49152:BpRhaYJ+2/8yJ5OA4COg9lyp31X01clj+u1GTsF:BpDJ+2pgA4+6p31is+u1G4

Score

10^/10

remcos zip collection discovery persistence privilege_escalation rat spyware stealer

Malware Config

Extracted

Family

remcos

Version

4.9.4 Pro

Botnet

zip

rm.anonbaba.net:3393

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-RNN6CM
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

task.exe

description pid process target process

PID 3064 created 2832 3064 task.exe sihost.exe

description	pid	process	target process
PID 3064 created 2832	3064	task.exe	sihost.exe

Detected Nirsoft tools 7 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

Processes:

resource	yara_rule
behavioral2/memory/2360-171-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/2360-169-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4936-160-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4936-155-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/2256-154-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/2256-175-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4936-177-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/4936-160-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/4936-155-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/4936-177-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/2256-154-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/2256-175-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

ICACLS.EXEICACLS.EXE

pid process

3392 ICACLS.EXE
1780 ICACLS.EXE

pid	process
3392	ICACLS.EXE
1780	ICACLS.EXE

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

task.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	task.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

task.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\apps = "C:\\Users\\Admin\\apps.bat"	task.exe

Blocklisted process makes network request 2 IoCs

Processes:

msiexec.exe

flow pid process

4 3412 msiexec.exe
6 3412 msiexec.exe

flow	pid	process
4	3412	msiexec.exe
6	3412	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

task.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation task.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	task.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

task.exe

description	pid	process	target process
PID 5060 set thread context of 2256	5060	task.exe	task.exe
PID 5060 set thread context of 4936	5060	task.exe	task.exe
PID 5060 set thread context of 3064	5060	task.exe	task.exe
PID 5060 set thread context of 2360	5060	task.exe	task.exe

Drops file in Windows directory 9 IoCs

Processes:

msiexec.exeEXPAND.EXE

description	ioc	process
File opened for modification	C:\Windows\Installer\e57ee77.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0028494D-9E28-4DD9-A336-17E8D634DF88}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEFA0.tmp	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File created	C:\Windows\Installer\e57ee77.msi	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\	msiexec.exe

Executes dropped EXE 6 IoCs

Processes:

task.exetask.exetask.exetask.exetask.exetask.exe

pid process

432 task.exe
5060 task.exe
2256 task.exe
4936 task.exe
3064 task.exe
2360 task.exe
Loads dropped DLL 3 IoCs

Processes:

MsiExec.exetask.exetask.exe

pid process

3600 MsiExec.exe
432 task.exe
5060 task.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
persistence privilege_escalation

Installer Packages
T1546.016

Msiexec
T1218.007

Processes:

msiexec.exe

pid process

3412 msiexec.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3048 432 WerFault.exe task.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

pid	process
432	task.exe
5060	task.exe
2256	task.exe
4936	task.exe
3064	task.exe
2360	task.exe

pid	process
3600	MsiExec.exe
432	task.exe
5060	task.exe

pid	process
3412	msiexec.exe

pid	pid_target	process	target process
3048	432	WerFault.exe	task.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

task.exeICACLS.EXEtask.exesvchost.exeICACLS.EXEEXPAND.EXEtask.execmd.execmd.exetask.exetask.exetask.exeMsiExec.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	task.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	task.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ICACLS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXPAND.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	task.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	task.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	task.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	task.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001d4141155d34ac580000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001d4141150000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001d414115000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1d414115000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001d41411500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

msiexec.exetask.exetask.exetask.exesvchost.exe

pid	process
1372	msiexec.exe
1372	msiexec.exe
2256	task.exe
2256	task.exe
2360	task.exe
2360	task.exe
2256	task.exe
2256	task.exe
3064	task.exe
3064	task.exe
3064	task.exe
3064	task.exe
1088	svchost.exe
1088	svchost.exe
1088	svchost.exe
1088	svchost.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

task.exe

pid process

5060 task.exe
5060 task.exe
5060 task.exe
5060 task.exe

pid	process
5060	task.exe
5060	task.exe
5060	task.exe
5060	task.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exesrtasks.exetask.exe

description	pid	process
Token: SeShutdownPrivilege	3412	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3412	msiexec.exe
Token: SeSecurityPrivilege	1372	msiexec.exe
Token: SeCreateTokenPrivilege	3412	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3412	msiexec.exe
Token: SeLockMemoryPrivilege	3412	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3412	msiexec.exe
Token: SeMachineAccountPrivilege	3412	msiexec.exe
Token: SeTcbPrivilege	3412	msiexec.exe
Token: SeSecurityPrivilege	3412	msiexec.exe
Token: SeTakeOwnershipPrivilege	3412	msiexec.exe
Token: SeLoadDriverPrivilege	3412	msiexec.exe
Token: SeSystemProfilePrivilege	3412	msiexec.exe
Token: SeSystemtimePrivilege	3412	msiexec.exe
Token: SeProfSingleProcessPrivilege	3412	msiexec.exe
Token: SeIncBasePriorityPrivilege	3412	msiexec.exe
Token: SeCreatePagefilePrivilege	3412	msiexec.exe
Token: SeCreatePermanentPrivilege	3412	msiexec.exe
Token: SeBackupPrivilege	3412	msiexec.exe
Token: SeRestorePrivilege	3412	msiexec.exe
Token: SeShutdownPrivilege	3412	msiexec.exe
Token: SeDebugPrivilege	3412	msiexec.exe
Token: SeAuditPrivilege	3412	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3412	msiexec.exe
Token: SeChangeNotifyPrivilege	3412	msiexec.exe
Token: SeRemoteShutdownPrivilege	3412	msiexec.exe
Token: SeUndockPrivilege	3412	msiexec.exe
Token: SeSyncAgentPrivilege	3412	msiexec.exe
Token: SeEnableDelegationPrivilege	3412	msiexec.exe
Token: SeManageVolumePrivilege	3412	msiexec.exe
Token: SeImpersonatePrivilege	3412	msiexec.exe
Token: SeCreateGlobalPrivilege	3412	msiexec.exe
Token: SeBackupPrivilege	3456	vssvc.exe
Token: SeRestorePrivilege	3456	vssvc.exe
Token: SeAuditPrivilege	3456	vssvc.exe
Token: SeBackupPrivilege	1372	msiexec.exe
Token: SeRestorePrivilege	1372	msiexec.exe
Token: SeRestorePrivilege	1372	msiexec.exe
Token: SeTakeOwnershipPrivilege	1372	msiexec.exe
Token: SeRestorePrivilege	1372	msiexec.exe
Token: SeTakeOwnershipPrivilege	1372	msiexec.exe
Token: SeBackupPrivilege	4008	srtasks.exe
Token: SeRestorePrivilege	4008	srtasks.exe
Token: SeSecurityPrivilege	4008	srtasks.exe
Token: SeTakeOwnershipPrivilege	4008	srtasks.exe
Token: SeBackupPrivilege	4008	srtasks.exe
Token: SeRestorePrivilege	4008	srtasks.exe
Token: SeSecurityPrivilege	4008	srtasks.exe
Token: SeTakeOwnershipPrivilege	4008	srtasks.exe
Token: SeDebugPrivilege	2360	task.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

3412 msiexec.exe
3412 msiexec.exe

pid	process
3412	msiexec.exe
3412	msiexec.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

msiexec.exeMsiExec.exetask.execmd.exetask.exetask.exe

description	pid	process	target process
PID 1372 wrote to memory of 4008	1372	msiexec.exe	srtasks.exe
PID 1372 wrote to memory of 4008	1372	msiexec.exe	srtasks.exe
PID 1372 wrote to memory of 3600	1372	msiexec.exe	MsiExec.exe
PID 1372 wrote to memory of 3600	1372	msiexec.exe	MsiExec.exe
PID 1372 wrote to memory of 3600	1372	msiexec.exe	MsiExec.exe
PID 3600 wrote to memory of 1780	3600	MsiExec.exe	ICACLS.EXE
PID 3600 wrote to memory of 1780	3600	MsiExec.exe	ICACLS.EXE
PID 3600 wrote to memory of 1780	3600	MsiExec.exe	ICACLS.EXE
PID 3600 wrote to memory of 2172	3600	MsiExec.exe	EXPAND.EXE
PID 3600 wrote to memory of 2172	3600	MsiExec.exe	EXPAND.EXE
PID 3600 wrote to memory of 2172	3600	MsiExec.exe	EXPAND.EXE
PID 3600 wrote to memory of 432	3600	MsiExec.exe	task.exe
PID 3600 wrote to memory of 432	3600	MsiExec.exe	task.exe
PID 3600 wrote to memory of 432	3600	MsiExec.exe	task.exe
PID 432 wrote to memory of 3276	432	task.exe	cmd.exe
PID 432 wrote to memory of 3276	432	task.exe	cmd.exe
PID 432 wrote to memory of 3276	432	task.exe	cmd.exe
PID 3276 wrote to memory of 5060	3276	cmd.exe	task.exe
PID 3276 wrote to memory of 5060	3276	cmd.exe	task.exe
PID 3276 wrote to memory of 5060	3276	cmd.exe	task.exe
PID 3600 wrote to memory of 1212	3600	MsiExec.exe	cmd.exe
PID 3600 wrote to memory of 1212	3600	MsiExec.exe	cmd.exe
PID 3600 wrote to memory of 1212	3600	MsiExec.exe	cmd.exe
PID 3600 wrote to memory of 3392	3600	MsiExec.exe	ICACLS.EXE
PID 3600 wrote to memory of 3392	3600	MsiExec.exe	ICACLS.EXE
PID 3600 wrote to memory of 3392	3600	MsiExec.exe	ICACLS.EXE
PID 5060 wrote to memory of 2256	5060	task.exe	task.exe
PID 5060 wrote to memory of 2256	5060	task.exe	task.exe
PID 5060 wrote to memory of 2256	5060	task.exe	task.exe
PID 5060 wrote to memory of 4936	5060	task.exe	task.exe
PID 5060 wrote to memory of 4936	5060	task.exe	task.exe
PID 5060 wrote to memory of 4936	5060	task.exe	task.exe
PID 5060 wrote to memory of 3064	5060	task.exe	task.exe
PID 5060 wrote to memory of 3064	5060	task.exe	task.exe
PID 5060 wrote to memory of 3064	5060	task.exe	task.exe
PID 5060 wrote to memory of 2360	5060	task.exe	task.exe
PID 5060 wrote to memory of 2360	5060	task.exe	task.exe
PID 5060 wrote to memory of 2360	5060	task.exe	task.exe
PID 5060 wrote to memory of 3064	5060	task.exe	task.exe
PID 3064 wrote to memory of 1088	3064	task.exe	svchost.exe
PID 3064 wrote to memory of 1088	3064	task.exe	svchost.exe
PID 3064 wrote to memory of 1088	3064	task.exe	svchost.exe
PID 3064 wrote to memory of 1088	3064	task.exe	svchost.exe
PID 3064 wrote to memory of 1088	3064	task.exe	svchost.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2832
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1088

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ff389718792f877fbdabe5cb02a1b3d5de5be988f9b5690250ffdf3409f04000.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3412

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4008
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 42E48A7C3D57E2D471DB6FD0BDB4BD80
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-24a51166-b283-40bd-8fd3-5e16ad5eb61b\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:1780
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2172
- - C:\Users\Admin\AppData\Local\Temp\MW-24a51166-b283-40bd-8fd3-5e16ad5eb61b\files\task.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-24a51166-b283-40bd-8fd3-5e16ad5eb61b\files\task.exe"
    3⤵
    - Adds Run key to start application
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\apps.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3276
    - - C:\Users\Admin\task.exe
        
        "task.exe"
        5⤵
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:5060
      - C:\Users\Admin\task.exe
        
        C:\Users\Admin\task.exe /stext "C:\Users\Admin\AppData\Local\Temp\bsuiijypyvjvek"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2256
      - C:\Users\Admin\task.exe
        
        C:\Users\Admin\task.exe /stext "C:\Users\Admin\AppData\Local\Temp\emztibjimdbagypoqj"
        6⤵
        Accesses Microsoft Outlook accounts
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4936
      - C:\Users\Admin\task.exe
        
        C:\Users\Admin\task.exe
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3064
      - C:\Users\Admin\task.exe
        
        C:\Users\Admin\task.exe /stext "C:\Users\Admin\AppData\Local\Temp\opfljmukalteredshujcp"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2360
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 960
      4⤵
      Program crash
      PID:3048
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-24a51166-b283-40bd-8fd3-5e16ad5eb61b\files"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1212
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-24a51166-b283-40bd-8fd3-5e16ad5eb61b\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3392

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 432 -ip 432
1⤵
PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
719182e07998ae9226d45680aa1fe178

SHA1
8f8b03c110c129cb3a35841ed959de7a7266ffec

SHA256
8f1d64c2c4dbb6ca892083e4b4a8bdb4585597e1269c218340c6b12517bb3dbe

SHA512
2df474f0ac4d1ef93b14deda32c5476da130bc41f37c0a5cd0c271c990914613c3c788116a4b87d44876695f71e5a131847fdf96d609364c06cb2f5ed6ce76a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_6F243E053ACC5B86B13C52D626927FC5

Filesize
751B

MD5
20160bc3c7d11c08009f481fdd6e9aaa

SHA1
eec31aa7573632ec555d1ae21086e2cc21d39c46

SHA256
b847e2554ddb230d842476c8df308b899f4b9010e80d83bbf935f6ae1ca95552

SHA512
561e8a98d137a13f91e1c162fb2ff8b0a642cf0121d1d2619194ad82235dcae6b4381a66f69eec7622682c9304c3816c0bacb86910061e204b2b05591afcb7cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
c59fe2122c01472472b32153f9357db9

SHA1
ffd45432839790442f659390e16b2b4f96c066c5

SHA256
fbe269cbc7e81263ef32c8a3b320697dc8d0b9f90d72c13b7e74b482a640b71b

SHA512
51ae31fd5603d1b6038a3ed1134143bfb757372b8daf06f471d7ca5e54c4fb2bb27c4b257149861e5e3e841070f7d1bc7488bf3f799ea39c7daa7ec62fe5eb31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
3116e740d4b35f728991060d3a56a217

SHA1
94c1e1742fbcbcfefba8d2159d581195ecd37d47

SHA256
c062c669408aac4b4693dedd1a3cf816ba9b2f4b802a61376ecc9b7b90a2dc58

SHA512
fc21ae93c2338fbe0753d9a84453ddfd42e0142763e35640150fd17e481407914c2410fd093636dbd744d2d853f237620f1214152117dcbaafe69b118e913004

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_6F243E053ACC5B86B13C52D626927FC5

Filesize
408B

MD5
1067fd2fa30db5198f8f9ea799f96a0f

SHA1
92471611a7665554954b41c84ff78ed51b697222

SHA256
e21cbe6f0ffa45b2801d3161bac63d124c262a500df89cd24bb8ed7233397cc4

SHA512
244a0f4fdc32046fac36e0827aedb8383d20fb76f5ad9361b22a7ddfd8ea29873f86208e25ad29d37e333d5ceb522b35fbf40348d12d674e969e808d82c51288

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
9678486c6382c9e0b8cf855ccffb6846

SHA1
a0151ce99c4325d0555cfe8d9e3ddbf763d99e3f

SHA256
ab37daa012c00fc47623c5340ca0caa355ce9f2b14fb6e281e7c97c0c5190d42

SHA512
76b6180dcd1e7f6a7d4c0621231adde7fd3bd24cc5f9af7945fc642f3a7e6a9a0673c1f2e1c019db45f8e822b65afba9306e3e1b5fa9f6a0faf20c1e0a76fc92

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-24a51166-b283-40bd-8fd3-5e16ad5eb61b\files.cab

Filesize
1.4MB

MD5
240f5d10d0fdc6e3a73b6793e0ea260f

SHA1
b6b7549b2c1a98fe88dea9f9fb462cb203647dbc

SHA256
5afa0071f63b662d93ab35e8a9a6a44b8ad439c62160388690e5e5793cb2b2d4

SHA512
faa0654a4359a90338905bcf627cb75d10d277ce8e2aafc07eca75ea887f54750b118042dd1e25e45c02706791ea5f5741202309928140789c319988e05f5029

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-24a51166-b283-40bd-8fd3-5e16ad5eb61b\files\YOUR_P~1.DLL

Filesize
601KB

MD5
8522cf224cb875847762353c89d2dce2

SHA1
4947ef0a7b3da4972106a6a97fff8c03f9db6799

SHA256
3dc24e9a42d9230f4c0db64bf11b9df544066c80c49b2aa66ce9a01ddb8c4088

SHA512
8933f0add139fd10f452ad18bcc400ab288aebe5bf764da66eb332b9b97dc56f7aaab66fd396b0ca1bf3c29a1487255b562a97fdeffaacc142347a95cd503350

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-24a51166-b283-40bd-8fd3-5e16ad5eb61b\files\data.bin

Filesize
741KB

MD5
8d9b3ca29d78cda545cf0a3131536f17

SHA1
d823975e67320244f3f02a59e5d29b53e16a828b

SHA256
97978ec89a58611cdeeffc623805c91966bf1d861395082804efe05302daf7cd

SHA512
287799d662bf3f113aab8009503afe7306f489b7fdad69ceffb190c9757412e00f6d3eedf5d5254d90319b27577d9567dc4b67860dc0148e249c042575f4dc0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-24a51166-b283-40bd-8fd3-5e16ad5eb61b\files\g2m.dll

Filesize
603KB

MD5
fc284eee599385a7ae9f098d123e983f

SHA1
acaa1c92d85afd92184d49592aed3aeab6ad2ded

SHA256
16414419a8248a4a55c05859c467d1fafc298694f3f71916261fe2e08ebf4abd

SHA512
c2538a98de60aeddb72cb14513ecce3493f04e94135182af658d3fc6425ad890560945efb02c956b11aa10606c95e7cb286e73c0d27e71f2b17d3494506e7123

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-24a51166-b283-40bd-8fd3-5e16ad5eb61b\files\task.exe

Filesize
39KB

MD5
f1b14f71252de9ac763dbfbfbfc8c2dc

SHA1
dcc2dcb26c1649887f1d5ae557a000b5fe34bb98

SHA256
796ea1d27ed5825e300c3c9505a87b2445886623235f3e41258de90ba1604cd5

SHA512
636a32fb8a88a542783aa57fe047b6bca47b2bd23b41b3902671c4e9036c6dbb97576be27fd2395a988653e6b63714277873e077519b4a06cdc5f63d3c4224e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-24a51166-b283-40bd-8fd3-5e16ad5eb61b\files\task22.msi

Filesize
1.2MB

MD5
6406cce810c8aaa887ca6b8e004776d2

SHA1
1698d3d12341f3824e14f4dae75300eea9670797

SHA256
fbfde6f43c30f454b07dbd2fdcd83685ae0016227f5489c13ccb510a0cff00a6

SHA512
3cd6f24c1892abd1b12a02dac5ab53e2afe1c68bc366d1ddb26df1e56312da7ff5caca255e78cb61e3fcbbed21cd03fb8909c61302af4dbcdda7ad37eac73ffa

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-24a51166-b283-40bd-8fd3-5e16ad5eb61b\msiwrapper.ini

Filesize
1KB

MD5
cc892773811ac6d1c6c8502afe2113b2

SHA1
f5da4a764cce98192fc3b733a768399cf4deca66

SHA256
9741e5c317feac4e0ea4a05c3dfd2f85e2d79326021de1555845df29bf78cc7a

SHA512
83f2b4e98d1fde8f96762b03ce71e17445ccd90f4a37072fff891183e3e78074fda7719049b2a0a501c995a61e20c30c2c3094025ea4703bae7778828ce82f75

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-24a51166-b283-40bd-8fd3-5e16ad5eb61b\msiwrapper.ini

Filesize
1KB

MD5
ac8e4e916f824782fa12a1ad67349fde

SHA1
b8b2ccb6d7f668a7f7e9c14dda029a88b0e8e39f

SHA256
0a3559446dcdc149da354261f41aed10d135acce1f179f12c19df212b5f838e1

SHA512
2dcfa16142d36b07d6b93ef0439f4a0720ba33104e8d1e2e7edda8cab968a82cb1bea471a466778874aa78dcdb8598bf60b77acda9ed2ec253183cca23ab611e

Download Submit
C:\Users\Admin\AppData\Local\Temp\bsuiijypyvjvek

Filesize
4KB

MD5
bc25ccf39db8626dc249529bcc8c5639

SHA1
3e9cbdb20a0970a3c13719a2f289d210cdcc9e1d

SHA256
b333f8c736c701bc826886f395d928731850cbce6db77be752b3cf7979114904

SHA512
9a546127bddc1d187e674cda82e6c5046cac7f3e6f9515aed68d5bff2264b9d679d857dd97270e10826cd11ce2d92d82dd7f9801e19027e346b60bcc814cca1a

Download Submit
C:\Users\Admin\apps.bat

Filesize
70B

MD5
f8abf91d350d39ff1a48934b88624291

SHA1
88ef29fd18441c628a43925a8b32535d39e07979

SHA256
5b4e3e3f739b1ae3cd907a0abe9d5aaf51455551f69f9da57e668f749584efd6

SHA512
3c572c7415fbc8ee5f976ac9b6cce43c901174777c859e9461451676bd5158e940e0bd173d83d980958295cb9daacc489f0d596d98e93f71cb81d2603f037876

Download Submit
C:\Users\Admin\data.bin

Filesize
471KB

MD5
1cb29ef9003e93f65b93ce8b8b7c24dd

SHA1
9be4aa7ab2e4c71dc70d03af435330c6bfb5c470

SHA256
9be5145baeb34d733af9a7fa55139a4917ef080d777ac8ec7f5e8b42620605e6

SHA512
259efb3fe2842908dcf4e4950da40dbdc6803ddf0dd5ba6716486cb715f356068a94e066ceefd4ed42d949787d6fc9190483c799add5d08620e16b4bc00bba3c

Download Submit
C:\Windows\Installer\MSIEFA0.tmp

Filesize
208KB

MD5
0c8921bbcc37c6efd34faf44cf3b0cb5

SHA1
dcfa71246157edcd09eecaf9d4c5e360b24b3e49

SHA256
fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1

SHA512
ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108

Download Submit
C:\Windows\Installer\e57ee77.msi

Filesize
1.7MB

MD5
7c26877fcd894cc1355f2a31a551243c

SHA1
80104216da4cd3449eabf0e0de2bb3a5b2de85ca

SHA256
ff389718792f877fbdabe5cb02a1b3d5de5be988f9b5690250ffdf3409f04000

SHA512
a57a961a3339b105f9d5653b69269ed7aab952a4e16600426edee80d628a9ac62a13b5ea642ffd9765fdada7b0db5c5a85a21bc88c125be122bf3c4e89d0cfb8

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
ef8187fd4d0f5061c9412fed9fbaf5f8

SHA1
197416380db2c31be24760dbb1dbb393f9413c7d

SHA256
aa6c26c9dce46533448b341cc3fb53a06c4ca20c1c0040776bb575d97cc31a78

SHA512
4ddcc61b3e975eec1031e1cc5650237224873bb2646c190ba5bce930dd8f925dc8bcecbac63b12204214b940bdded18b04ef3bc08b4ec4cc165f626aedf59b90

Download Submit
\??\Volume{1541411d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{69290d48-4dbd-4668-b231-778b13da0829}_OnDiskSnapshotProp

Filesize
6KB

MD5
f93ade2788310991df83ac253a22fcdf

SHA1
735a1bf51887ada6d1bdeb4f97dfb3b979874b67

SHA256
7c57c6f754a4db033573052524f1b77dc841d1f54029f78e8d913161fc5ae983

SHA512
123822dfd32f804d17620d117d2d71e1305ce04009d1845642ce2d2e80990d2f4a07bbbdb7915bf427d4ad4b6b57212164a69cb995f762f615cfbd31225d91d1

Download Submit
memory/432-106-0x00000000051B0000-0x000000000524C000-memory.dmp

Filesize
624KB

Download
memory/432-105-0x0000000005270000-0x0000000005328000-memory.dmp

Filesize
736KB

Download
memory/1088-196-0x0000000077480000-0x0000000077695000-memory.dmp

Filesize
2.1MB

Download
memory/1088-191-0x0000000000CE0000-0x0000000000CEA000-memory.dmp

Filesize
40KB

Download
memory/1088-193-0x0000000001280000-0x0000000001680000-memory.dmp

Filesize
4.0MB

Download
memory/1088-194-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

Filesize
2.0MB

Download
memory/2256-147-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2256-175-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2256-154-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2256-159-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2256-144-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2360-169-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2360-171-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2360-166-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2360-161-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2360-168-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3064-158-0x0000000000410000-0x0000000000491000-memory.dmp

Filesize
516KB

Download
memory/3064-190-0x0000000077480000-0x0000000077695000-memory.dmp

Filesize
2.1MB

Download
memory/3064-156-0x0000000000410000-0x0000000000491000-memory.dmp

Filesize
516KB

Download
memory/3064-188-0x00007FFC4C3F0000-0x00007FFC4C5E5000-memory.dmp

Filesize
2.0MB

Download
memory/3064-187-0x00000000007E0000-0x0000000000BE0000-memory.dmp

Filesize
4.0MB

Download
memory/3064-179-0x00000000007E0000-0x0000000000BE0000-memory.dmp

Filesize
4.0MB

Download
memory/4936-160-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4936-146-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4936-155-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4936-177-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4936-153-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4936-151-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/5060-181-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/5060-142-0x00000000007E0000-0x0000000000860000-memory.dmp

Filesize
512KB

Download
memory/5060-136-0x00000000007E0000-0x0000000000860000-memory.dmp

Filesize
512KB

Download
memory/5060-135-0x00000000007E0000-0x0000000000860000-memory.dmp

Filesize
512KB

Download
memory/5060-143-0x00000000007E0000-0x0000000000860000-memory.dmp

Filesize
512KB

Download
memory/5060-185-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/5060-186-0x00000000007E0000-0x0000000000860000-memory.dmp

Filesize
512KB

Download
memory/5060-184-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/5060-133-0x00000000007E0000-0x0000000000860000-memory.dmp

Filesize
512KB

Download
memory/5060-173-0x00000000007E0000-0x0000000000860000-memory.dmp

Filesize
512KB

Download
memory/5060-138-0x00000000007E0000-0x0000000000860000-memory.dmp

Filesize
512KB

Download
memory/5060-134-0x00000000007E0000-0x0000000000860000-memory.dmp

Filesize
512KB

Download
memory/5060-127-0x00000000007E0000-0x0000000000860000-memory.dmp

Filesize
512KB

Download
memory/5060-126-0x00000000007E0000-0x0000000000860000-memory.dmp

Filesize
512KB

Download
memory/5060-125-0x00000000007E0000-0x0000000000860000-memory.dmp

Filesize
512KB

Download
memory/5060-124-0x00000000007E0000-0x0000000000860000-memory.dmp

Filesize
512KB

Download
memory/5060-197-0x00000000007E0000-0x0000000000860000-memory.dmp

Filesize
512KB

Download
memory/5060-198-0x00000000007E0000-0x0000000000860000-memory.dmp

Filesize
512KB

Download
memory/5060-199-0x00000000007E0000-0x0000000000860000-memory.dmp

Filesize
512KB

Download
memory/5060-200-0x00000000007E0000-0x0000000000860000-memory.dmp

Filesize
512KB

Download
memory/5060-204-0x00000000007E0000-0x0000000000860000-memory.dmp

Filesize
512KB

Download
memory/5060-205-0x00000000007E0000-0x0000000000860000-memory.dmp

Filesize
512KB

Download
memory/5060-208-0x00000000007E0000-0x0000000000860000-memory.dmp

Filesize
512KB

Download
memory/5060-209-0x00000000007E0000-0x0000000000860000-memory.dmp

Filesize
512KB

Download