0b3a483bcce3e09fd52c015488fc14cb85ae61f1cf63ff2647ca5d65125f377c

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 08:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 12.8MB
Sample260415-j3aaescv31
SHA256 0b3a483bcce3e09fd52c015488fc14cb85ae61f1cf63ff2647ca5d65125f377c
MD5 de23460d2f26ceb38423bce05a2066fe
SHA1 eec89c91e824e06165f113427e6323c43a1129c7
SHA512 1ac243c67b37e16f1b6c20d229d4f8cd3e88b5aad4a59ebd90570ef4833cbcf8203e8a42cdad4f3da4c65cdc25653efa5ada3b333a3d0cf2abc4176b66717bcb
SSDEEP 196608:CPI/bIL5ToIhVb9f1ElhTLCaf5Wcr+SWxM+yedHJJJD7pKHvY54AqAVWyJFJXut6:ZkdpLEHyer+SuMtYHJJFQv0duMS0UOwa
TLSH
T144D63315B483C371E3A5C0706577A175CA36BE7B96A60096781C73A6FF7B200BEE02D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables packed with 9Rays.Net Spices.Net Obfuscator. 10 IoCs

resource	yara_rule
behavioral1/memory/3156-1-0x0000000007EE0000-0x0000000008C40000-memory.dmp	INDICATOR_EXE_Packed_Spices
behavioral1/memory/3156-4-0x0000000009C40000-0x000000000A99E000-memory.dmp	INDICATOR_EXE_Packed_Spices
behavioral1/memory/2920-130-0x0000000002190000-0x00000000021C2000-memory.dmp	INDICATOR_EXE_Packed_Spices
behavioral1/memory/2920-131-0x0000000002340000-0x0000000002372000-memory.dmp	INDICATOR_EXE_Packed_Spices
behavioral1/files/0x000e00000001f1aa-185.dat	INDICATOR_EXE_Packed_Spices
behavioral1/memory/2596-229-0x0000000002490000-0x00000000024C2000-memory.dmp	INDICATOR_EXE_Packed_Spices
behavioral1/memory/2596-230-0x0000000004950000-0x0000000004982000-memory.dmp	INDICATOR_EXE_Packed_Spices
behavioral1/memory/3296-238-0x000000001BE80000-0x000000001BECA000-memory.dmp	INDICATOR_EXE_Packed_Spices
behavioral1/memory/3296-239-0x000000001B440000-0x000000001B456000-memory.dmp	INDICATOR_EXE_Packed_Spices
behavioral1/memory/3908-274-0x0000000002480000-0x00000000024B2000-memory.dmp	INDICATOR_EXE_Packed_Spices

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1680	Powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	MicrosoftMsmqRuntimeInterop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	MicrosoftEnvelope.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\App.ico.lnk	SecurityServiceHub.exe

Executes dropped EXE 7 IoCs

pid	Process
4552	ServiceHubSecuritySystemServiceHub.dll
2920	SecurityServiceHub.exe
4512	MicrosoftEnvelope.exe
4960	MicrosoftResourceManagementresources.dll
3296	MicrosoftMsmqRuntimeInterop.exe
2596	SecurityServiceHub.exe
3908	SecurityServiceHub.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	MicrosoftEnvelope.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	MicrosoftEnvelope.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	checkip.dyndns.org

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	MicrosoftEnvelope.exe
File created	C:\Windows\assembly\Desktop.ini	MicrosoftEnvelope.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	MicrosoftEnvelope.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityServiceHub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityServiceHub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEnvelope.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityServiceHub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ServiceHubSecuritySystemServiceHub.dll
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftResourceManagementresources.dll
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2792	WMIC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3248	schtasks.exe
3908	schtasks.exe
3732	schtasks.exe
4492	schtasks.exe
2644	schtasks.exe
1824	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1680	Powershell.exe
1680	Powershell.exe
2920	SecurityServiceHub.exe
2920	SecurityServiceHub.exe
2920	SecurityServiceHub.exe
2596	SecurityServiceHub.exe
2596	SecurityServiceHub.exe
2596	SecurityServiceHub.exe
2596	SecurityServiceHub.exe
2596	SecurityServiceHub.exe
2596	SecurityServiceHub.exe
2596	SecurityServiceHub.exe
2596	SecurityServiceHub.exe
3908	SecurityServiceHub.exe
3908	SecurityServiceHub.exe
3908	SecurityServiceHub.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1680	Powershell.exe
Token: SeIncreaseQuotaPrivilege	396	WMIC.exe
Token: SeSecurityPrivilege	396	WMIC.exe
Token: SeTakeOwnershipPrivilege	396	WMIC.exe
Token: SeLoadDriverPrivilege	396	WMIC.exe
Token: SeSystemProfilePrivilege	396	WMIC.exe
Token: SeSystemtimePrivilege	396	WMIC.exe
Token: SeProfSingleProcessPrivilege	396	WMIC.exe
Token: SeIncBasePriorityPrivilege	396	WMIC.exe
Token: SeCreatePagefilePrivilege	396	WMIC.exe
Token: SeBackupPrivilege	396	WMIC.exe
Token: SeRestorePrivilege	396	WMIC.exe
Token: SeShutdownPrivilege	396	WMIC.exe
Token: SeDebugPrivilege	396	WMIC.exe
Token: SeSystemEnvironmentPrivilege	396	WMIC.exe
Token: SeRemoteShutdownPrivilege	396	WMIC.exe
Token: SeUndockPrivilege	396	WMIC.exe
Token: SeManageVolumePrivilege	396	WMIC.exe
Token: 33	396	WMIC.exe
Token: 34	396	WMIC.exe
Token: 35	396	WMIC.exe
Token: 36	396	WMIC.exe
Token: SeIncreaseQuotaPrivilege	396	WMIC.exe
Token: SeSecurityPrivilege	396	WMIC.exe
Token: SeTakeOwnershipPrivilege	396	WMIC.exe
Token: SeLoadDriverPrivilege	396	WMIC.exe
Token: SeSystemProfilePrivilege	396	WMIC.exe
Token: SeSystemtimePrivilege	396	WMIC.exe
Token: SeProfSingleProcessPrivilege	396	WMIC.exe
Token: SeIncBasePriorityPrivilege	396	WMIC.exe
Token: SeCreatePagefilePrivilege	396	WMIC.exe
Token: SeBackupPrivilege	396	WMIC.exe
Token: SeRestorePrivilege	396	WMIC.exe
Token: SeShutdownPrivilege	396	WMIC.exe
Token: SeDebugPrivilege	396	WMIC.exe
Token: SeSystemEnvironmentPrivilege	396	WMIC.exe
Token: SeRemoteShutdownPrivilege	396	WMIC.exe
Token: SeUndockPrivilege	396	WMIC.exe
Token: SeManageVolumePrivilege	396	WMIC.exe
Token: 33	396	WMIC.exe
Token: 34	396	WMIC.exe
Token: 35	396	WMIC.exe
Token: 36	396	WMIC.exe
Token: SeDebugPrivilege	3156	2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Token: SeIncreaseQuotaPrivilege	1736	WMIC.exe
Token: SeSecurityPrivilege	1736	WMIC.exe
Token: SeTakeOwnershipPrivilege	1736	WMIC.exe
Token: SeLoadDriverPrivilege	1736	WMIC.exe
Token: SeSystemProfilePrivilege	1736	WMIC.exe
Token: SeSystemtimePrivilege	1736	WMIC.exe
Token: SeProfSingleProcessPrivilege	1736	WMIC.exe
Token: SeIncBasePriorityPrivilege	1736	WMIC.exe
Token: SeCreatePagefilePrivilege	1736	WMIC.exe
Token: SeBackupPrivilege	1736	WMIC.exe
Token: SeRestorePrivilege	1736	WMIC.exe
Token: SeShutdownPrivilege	1736	WMIC.exe
Token: SeDebugPrivilege	1736	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1736	WMIC.exe
Token: SeRemoteShutdownPrivilege	1736	WMIC.exe
Token: SeUndockPrivilege	1736	WMIC.exe
Token: SeManageVolumePrivilege	1736	WMIC.exe
Token: 33	1736	WMIC.exe
Token: 34	1736	WMIC.exe
Token: 35	1736	WMIC.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 1680	3156	2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	85
PID 3156 wrote to memory of 4552	3156	2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	87
PID 3156 wrote to memory of 1824	3156	2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	88
PID 3156 wrote to memory of 3248	3156	2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	92
PID 3156 wrote to memory of 3908	3156	2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	94
PID 3156 wrote to memory of 4544	3156	2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	98
PID 4544 wrote to memory of 396	4544	cmd.exe	100
PID 4512 wrote to memory of 3732	4512	MicrosoftEnvelope.exe	101
PID 2920 wrote to memory of 3896	2920	SecurityServiceHub.exe	104
PID 3896 wrote to memory of 1736	3896	cmd.exe	106
PID 4512 wrote to memory of 4492	4512	MicrosoftEnvelope.exe	108
PID 3156 wrote to memory of 756	3156	2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	110
PID 756 wrote to memory of 4704	756	cmd.exe	112
PID 4512 wrote to memory of 4960	4512	MicrosoftEnvelope.exe	113
PID 3156 wrote to memory of 2332	3156	2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	114
PID 2332 wrote to memory of 2284	2332	cmd.exe	116
PID 4512 wrote to memory of 3296	4512	MicrosoftEnvelope.exe	117
PID 3156 wrote to memory of 4116	3156	2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	118
PID 4116 wrote to memory of 2792	4116	cmd.exe	120
PID 2920 wrote to memory of 4100	2920	SecurityServiceHub.exe	121
PID 4100 wrote to memory of 2392	4100	cmd.exe	123
PID 3156 wrote to memory of 4940	3156	2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe	124
PID 4940 wrote to memory of 4724	4940	cmd.exe	126
PID 2920 wrote to memory of 4024	2920	SecurityServiceHub.exe	127
PID 4024 wrote to memory of 4640	4024	cmd.exe	129
PID 3296 wrote to memory of 2644	3296	MicrosoftMsmqRuntimeInterop.exe	130
PID 2596 wrote to memory of 3600	2596	SecurityServiceHub.exe	141
PID 3600 wrote to memory of 3440	3600	cmd.exe	143
PID 2596 wrote to memory of 624	2596	SecurityServiceHub.exe	144
PID 624 wrote to memory of 3900	624	cmd.exe	146
PID 2596 wrote to memory of 3728	2596	SecurityServiceHub.exe	147
PID 3728 wrote to memory of 4728	3728	cmd.exe	149
PID 3908 wrote to memory of 4808	3908	SecurityServiceHub.exe	151
PID 4808 wrote to memory of 1704	4808	cmd.exe	153
PID 3908 wrote to memory of 4268	3908	SecurityServiceHub.exe	154
PID 4268 wrote to memory of 4996	4268	cmd.exe	156
PID 3908 wrote to memory of 5112	3908	SecurityServiceHub.exe	157
PID 5112 wrote to memory of 1264	5112	cmd.exe	159

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_de23460d2f26ceb38423bce05a2066fe_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  Powershell -executionpolicy bypass -NonInteractive -windowstyle Hidden -file C:\Users\Admin\AppData\Local\Temp\tmp43F9.tmp.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1680
- C:\Users\Admin\AppData\Local\ServiceHubSecuritySystemServiceHub.dll
  C:\Users\Admin\AppData\Local\ServiceHubSecuritySystemServiceHub.dll -p123
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4552
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /f /tn SecurityServiceHub /tr "C:\Users\Admin\AppData\Local\ServiceHub\SecurityServiceHub.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1824
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc onstart minute /mo 30 /f /tn MicrosoftOneDriveStandalone /tr "C:\Users\Admin\AppData\Roaming\windows\SecurityCryptography.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3248
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 7 /f /tn SecurityHealthEnvelope /tr "C:\Users\Admin\AppData\Local\windows\MicrosoftEnvelope.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3908
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wmic path win32_computersystemproduct get uuid /value
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_computersystemproduct get uuid /value
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:396
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c Wmic os get Caption /value
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    Wmic os get Caption /value
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4704
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wmic /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct get displayname
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct get displayname
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2284
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wmic path win32_VideoController get name /value
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_VideoController get name /value
    3⤵
    - System Location Discovery: System Language Discovery
    - Detects videocard installed
    PID:2792
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wmic computersystem get totalphysicalmemory
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic computersystem get totalphysicalmemory
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4724

C:\Users\Admin\AppData\Local\ServiceHub\SecurityServiceHub.exe
C:\Users\Admin\AppData\Local\ServiceHub\SecurityServiceHub.exe
1⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c wmic process where ExecutablePath='%HomeDrive%\\Users\\%username%\\AppData\\Roaming\\system32\\svchost.exe' Get ProcessID
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where ExecutablePath='C:\\Users\\Admin\\AppData\\Roaming\\system32\\svchost.exe' Get ProcessID
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1736
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wmic path win32_computersystemproduct get uuid /value
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_computersystemproduct get uuid /value
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2392
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wmic /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct get displayname
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct get displayname
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4640

C:\Users\Admin\AppData\Local\windows\MicrosoftEnvelope.exe
C:\Users\Admin\AppData\Local\windows\MicrosoftEnvelope.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 7 /f /tn MicrosoftEdgeScriptRuntime /tr "C:\Users\Admin\AppData\Local\Diagnostics\1612347604\2021051119.000\MicrosoftMsmqRuntimeInterop.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3732
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 7 /f /tn MicrosoftEnvelope /tr "C:\Users\Admin\AppData\Local\windows\MicrosoftEnvelope.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4492
- C:\Users\Admin\AppData\Local\Diagnostics\1612347604\2021051119.000\MicrosoftResourceManagementresources.dll
  C:\Users\Admin\AppData\Local\Diagnostics\1612347604\2021051119.000\MicrosoftResourceManagementresources.dll -pHelloAnalayser:)
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4960
- C:\Users\Admin\AppData\Local\Diagnostics\1612347604\2021051119.000\MicrosoftMsmqRuntimeInterop.exe
  "C:\Users\Admin\AppData\Local\Diagnostics\1612347604\2021051119.000\MicrosoftMsmqRuntimeInterop.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 7 /f /tn MicrosoftInkResources /tr "C:\Users\Admin\AppData\Local\Diagnostics\1612347604\2021051119.000\MicrosoftMsmqRuntimeInterop.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2644

C:\Users\Admin\AppData\Local\ServiceHub\SecurityServiceHub.exe
C:\Users\Admin\AppData\Local\ServiceHub\SecurityServiceHub.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c wmic process where ExecutablePath='%HomeDrive%\\Users\\%username%\\AppData\\Roaming\\system32\\svchost.exe' Get ProcessID
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where ExecutablePath='C:\\Users\\Admin\\AppData\\Roaming\\system32\\svchost.exe' Get ProcessID
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3440
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wmic path win32_computersystemproduct get uuid /value
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_computersystemproduct get uuid /value
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3900
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wmic /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct get displayname
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct get displayname
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4728

C:\Users\Admin\AppData\Local\ServiceHub\SecurityServiceHub.exe
C:\Users\Admin\AppData\Local\ServiceHub\SecurityServiceHub.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c wmic process where ExecutablePath='%HomeDrive%\\Users\\%username%\\AppData\\Roaming\\system32\\svchost.exe' Get ProcessID
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where ExecutablePath='C:\\Users\\Admin\\AppData\\Roaming\\system32\\svchost.exe' Get ProcessID
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1704
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wmic path win32_computersystemproduct get uuid /value
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_computersystemproduct get uuid /value
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wmic /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct get displayname
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct get displayname
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftMsmqRuntimeInterop.exe

Path C:\Users\Admin\AppData\Local\Diagnostics\1612347604\2021051119.000\MicrosoftMsmqRuntimeInterop.exe
Size 487KB
SHA256 f46f121e1a096b5e0f2c5602b1de590ae226e5d45ee9b97ce7d13efd35894aa2
MD5 995109a0b9489beaeee02a58e2bac292
SHA1 8ff7ec2dc0a4aa31452719406e293cf951e124a0
SHA512 06791ed9af044763d3d371543341395aa214fc3010414ecc2fbb29ce7cdaa55c01e3f2a3f251772817d9811c469551c9dfe9c4171a0057f2f12625299eee724c
SSDEEP 6144:qXo/gpghIYqbRJavZ3kHzHMGX1cG4nJiiYzXE6UofdFpho8r1I9WcYneeWyZKVVB:qYi1TJc0HzwnJHyaQd/erNVth
TLSH
T1E5B4E0433AA88B05D5642AF6C0EF683413D5AEC32673E6997F18379D0E427A3DD44B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftResourceManagementresources.dll

Path C:\Users\Admin\AppData\Local\Diagnostics\1612347604\2021051119.000\MicrosoftResourceManagementresources.dll
Size 809KB
SHA256 e73a182865f9f1c4c37f87a8f6bfafc19b36d3d750b953ea99f00367e3284f7e
MD5 ae12d02b39095e5b2986811c0e2d0051
SHA1 9382cd9988b2f0d41807e627d02832384c690031
SHA512 e1cd18a761b1bcaafc868cc2cb325484aec134bcfe077cdef15e26717bbf30c698a8142ab1211df821b005e7c2c7c6993106122f7a37200c7b00615b8176864b
SSDEEP 24576:DhvJVJdMxSA4ekw6G4WcqXgieabBCz8edTWSS:r3dWQeX9jwieayoSS
TLSH
T173050202BFD55472E6B21D3656256B20293D79201F38CF9FA3D44E6DEA305D1EA30BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityServiceHub.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecurityServiceHub.exe.log
Size 1KB
SHA256 ed64f6534a508b0a5fd65a461f632bb5b2725e0a5a319534bd89dc8f9a08c746
MD5 bed77d3c21014d530833ab18e2e93a29
SHA1 9298022a43195c3f78c6904f4166334a6384f955
SHA512 f7f5b9eb830b6c87d16f3f241026507bea63a02420e0fc65461e544f290bcf1a61eee22d317988fe10e386c03c90e23defa721921a6aef62b0e01301776c08ea
TLSH
T1A2315B303122B5D90D422F570C186ED922EF47497BA89F5C7965335DCE2A44BDB220E3
MD5 SHA1 SHA512 TLSH

Submit Download

ServiceHubSecuritySystemServiceHub.dll

Path C:\Users\Admin\AppData\Local\ServiceHubSecuritySystemServiceHub.dll
Size 870KB
SHA256 6c94c696e4c4151f373569e845b4a9e903885d152fe049b2fcf76f3b5d004f98
MD5 013d9d0c437daf1267fd0c4302493840
SHA1 290e7c13cd54a37d3bcbd43182fc14ce0b1b992c
SHA512 de3f16ab2912a170b34024c3d9aec73c1d70bc1992cb77f36d6634c92e36d90bd04b08c412a0021a47dc1884eacbc63a43abfc9e77e5b7c5382531f8dbe50a23
SSDEEP 24576:+ry2uXzm/RYpXVFFta79uaVn9YKMT6am21hxytZZpKYp0W:+unJpXVFy59G3milYp5
TLSH
T1E615F1F0AEE078B0E131243574A8E63C3BEA7C199F2489ABD78AE51D35704C125B6F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityServiceHub.exe

Path C:\Users\Admin\AppData\Local\ServiceHub\SecurityServiceHub.exe
Size 204KB
SHA256 ef498b88f3255c046d0f55ee571bc7f2c03453981d284ff3d3434e273f7da8dd
MD5 869b9c6da662c33ef98d4c02de240eaf
SHA1 bba51e44bc33c27a5224fd1881f486dd81836e97
SHA512 4e21088e5d83677c20a90779fcff3fab236ab7b25a8f18f6a2b764e9f3a556e8150889c6ce32e7c6ad753e82cf0d2796b3ce0d35141d39092580ff3766b071c6
SSDEEP 3072:lDKW1LgppLRHMY0TBfJvjcTp5XewaCxuHcKWVQCIp38YxZOc3:lDKW1Lgbdl0TBBvjc/eTF8HVwrj
TLSH
T17314BF1171C1C1B3C4B7153044E6CB799A7A70724B7A96D7B7D81BBA6E203E1A3362CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_c2rztdz5.cnr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c2rztdz5.cnr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmp43F9.tmp.ps1

Path C:\Users\Admin\AppData\Local\Temp\tmp43F9.tmp.ps1
Size 117B
SHA256 c42eb405a28d493899ebd7574011b45f121ab0da8d6ca96b379f9f3199b0b566
MD5 b1481c7cefa4a7063d453f726e3b3658
SHA1 6c151e7a968c80b5969c3fe75c9caaa52cfee007
SHA512 a84e371cbc1494cd65aea6321f54d2861780f2f8004c217c15d096994ab12ecd5d3bb2a57997d60b1b0e2363859f03ae1ec7d0aeda200bd6b18810174c970d24
TLSH
T1CCB09B31910201D5E231375194154759307FE529455D09010539181C5010DA9637AE36
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEnvelope.exe

Path C:\Users\Admin\AppData\Local\windows\MicrosoftEnvelope.exe
Size 975KB
SHA256 ef7c84296697650bf4290c686b81a33272bd319fc8a5e18df35d3a1844539f28
MD5 c64f650c58af5481c0eab30ba3a77002
SHA1 664064b8a1c90b5399238d9793434a5271343471
SHA512 ed5d71398579a639e69ae647e137661e1c18b882c49ac4ac0555a8d8bb3975d57a94def49d0c9efc0951ac716b1d3857991d70f07539823e1eaad7177cde9834
SSDEEP 24576:vwnU4TDL0PMEDefkBhI204srFNO/3GsXsiumpstOwS7:4ntTX0PPDYkBS2toI8iumGs
TLSH
T11525222274C1C2B3C47B957081D58A386D353462876A96C7B66D2BAB7F113E1E3372CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1264-280-0x0000000002C10000-0x0000000002CF3000-memory.dmp

Download

memory/1680-53-0x00000000071B0000-0x00000000071C4000-memory.dmp

Download

memory/1680-44-0x0000000006DA0000-0x0000000006DBE000-memory.dmp

Download

memory/1680-62-0x0000000005E70000-0x0000000005EE4000-memory.dmp

Download

memory/1680-13-0x00000000021E0000-0x0000000002216000-memory.dmp

Download

memory/1680-15-0x0000000002190000-0x00000000021A0000-memory.dmp

Download

memory/1680-14-0x0000000002190000-0x00000000021A0000-memory.dmp

Download

memory/1680-16-0x0000000004BB0000-0x00000000051D8000-memory.dmp

Download

memory/1680-17-0x0000000005240000-0x0000000005262000-memory.dmp

Download

memory/1680-18-0x00000000053E0000-0x0000000005446000-memory.dmp

Download

memory/1680-19-0x0000000005580000-0x00000000055E6000-memory.dmp

Download

memory/1680-61-0x0000000004B00000-0x0000000004B87000-memory.dmp

Download

memory/1680-25-0x00000000055F0000-0x0000000005944000-memory.dmp

Download

memory/1680-28-0x0000000005BC0000-0x0000000005BDE000-memory.dmp

Download

memory/1680-29-0x0000000005C50000-0x0000000005C9C000-memory.dmp

Download

memory/1680-60-0x0000000004AD0000-0x0000000004AF4000-memory.dmp

Download

memory/1680-59-0x0000000004A90000-0x0000000004AA2000-memory.dmp

Download

memory/1680-55-0x00000000071E0000-0x00000000071E8000-memory.dmp

Download

memory/1680-54-0x00000000071F0000-0x000000000720A000-memory.dmp

Download

memory/1680-34-0x000000007F420000-0x000000007F430000-memory.dmp

Download

memory/1680-35-0x0000000006DC0000-0x0000000006DF2000-memory.dmp

Download

memory/1680-36-0x000000006F970000-0x000000006F9BC000-memory.dmp

Download

memory/1680-52-0x00000000071A0000-0x00000000071AE000-memory.dmp

Download

memory/1680-45-0x0000000006E00000-0x0000000006EA3000-memory.dmp

Download

memory/1680-46-0x00000000075C0000-0x0000000007C3A000-memory.dmp

Download

memory/1680-47-0x0000000006F70000-0x0000000006F8A000-memory.dmp

Download

memory/1680-48-0x0000000006FE0000-0x0000000006FEA000-memory.dmp

Download

memory/1680-49-0x0000000007230000-0x00000000072C6000-memory.dmp

Download

memory/1680-50-0x0000000007160000-0x0000000007171000-memory.dmp

Download

memory/1704-279-0x0000000002AE0000-0x0000000002BC3000-memory.dmp

Download

memory/1736-137-0x00000000030B0000-0x0000000003193000-memory.dmp

Download

memory/2284-182-0x0000000000780000-0x0000000000863000-memory.dmp

Download

memory/2596-230-0x0000000004950000-0x0000000004982000-memory.dmp

Download

memory/2596-252-0x00000000050C0000-0x0000000005147000-memory.dmp

Download

memory/2596-229-0x0000000002490000-0x00000000024C2000-memory.dmp

Download

memory/2596-243-0x00000000050C0000-0x0000000005147000-memory.dmp

Download

memory/2920-205-0x00000000060C0000-0x00000000060C6000-memory.dmp

Download

memory/2920-221-0x0000000006840000-0x0000000006847000-memory.dmp

Download

memory/2920-204-0x0000000005330000-0x0000000005393000-memory.dmp

Download

memory/2920-203-0x00000000050F0000-0x0000000005177000-memory.dmp

Download

memory/2920-219-0x0000000005330000-0x0000000005393000-memory.dmp

Download

memory/2920-206-0x0000000006840000-0x0000000006847000-memory.dmp

Download

memory/2920-130-0x0000000002190000-0x00000000021C2000-memory.dmp

Download

memory/2920-131-0x0000000002340000-0x0000000002372000-memory.dmp

Download

memory/2920-218-0x00000000050F0000-0x0000000005177000-memory.dmp

Download

memory/3156-32-0x0000000003090000-0x00000000030A0000-memory.dmp

Download

memory/3156-11-0x0000000003090000-0x00000000030A0000-memory.dmp

Download

memory/3156-125-0x0000000007D50000-0x0000000007DB3000-memory.dmp

Download

memory/3156-124-0x0000000007B10000-0x0000000007B97000-memory.dmp

Download

memory/3156-284-0x0000000007D50000-0x0000000007DB3000-memory.dmp

Download

memory/3156-56-0x0000000003090000-0x00000000030A0000-memory.dmp

Download

memory/3156-1-0x0000000007EE0000-0x0000000008C40000-memory.dmp

Download

memory/3156-184-0x000000000C4C0000-0x000000000C4D8000-memory.dmp

Download

memory/3156-51-0x0000000003090000-0x00000000030A0000-memory.dmp

Download

memory/3156-2-0x0000000003090000-0x00000000030A0000-memory.dmp

Download

memory/3156-3-0x0000000007170000-0x0000000007714000-memory.dmp

Download

memory/3156-4-0x0000000009C40000-0x000000000A99E000-memory.dmp

Download

memory/3156-191-0x00000000097B0000-0x0000000009B04000-memory.dmp

Download

memory/3156-192-0x000000000C4E0000-0x000000000C52C000-memory.dmp

Download

memory/3156-194-0x000000000C530000-0x000000000C551000-memory.dmp

Download

memory/3156-193-0x000000000F770000-0x000000000F7AC000-memory.dmp

Download

memory/3156-231-0x0000000007B10000-0x0000000007B97000-memory.dmp

Download

memory/3156-5-0x0000000007990000-0x0000000007A2C000-memory.dmp

Download

memory/3156-200-0x000000000B950000-0x000000000B957000-memory.dmp

Download

memory/3156-199-0x000000000B800000-0x000000000B806000-memory.dmp

Download

memory/3156-198-0x0000000007D50000-0x0000000007DB3000-memory.dmp

Download

memory/3156-6-0x0000000007A50000-0x0000000007AE2000-memory.dmp

Download

memory/3156-33-0x0000000003090000-0x00000000030A0000-memory.dmp

Download

memory/3156-0-0x0000000003090000-0x00000000030A0000-memory.dmp

Download

memory/3156-30-0x0000000003090000-0x00000000030A0000-memory.dmp

Download

memory/3156-126-0x0000000003090000-0x00000000030A0000-memory.dmp

Download

memory/3156-10-0x0000000003090000-0x00000000030A0000-memory.dmp

Download

memory/3156-9-0x0000000007BB0000-0x0000000007C06000-memory.dmp

Download

memory/3156-8-0x0000000002E80000-0x0000000002E8A000-memory.dmp

Download

memory/3156-223-0x0000000007D50000-0x0000000007DB3000-memory.dmp

Download

memory/3156-7-0x0000000003090000-0x00000000030A0000-memory.dmp

Download

memory/3296-190-0x000000001B630000-0x000000001B6D6000-memory.dmp

Download

memory/3296-249-0x000000001B940000-0x000000001B948000-memory.dmp

Download

memory/3296-195-0x000000001D870000-0x000000001DD3E000-memory.dmp

Download

memory/3296-238-0x000000001BE80000-0x000000001BECA000-memory.dmp

Download

memory/3296-239-0x000000001B440000-0x000000001B456000-memory.dmp

Download

memory/3296-201-0x000000001BE20000-0x000000001BE7E000-memory.dmp

Download

memory/3296-248-0x000000001C7B0000-0x000000001C84C000-memory.dmp

Download

memory/3296-242-0x00000000010E0000-0x00000000010EC000-memory.dmp

Download

memory/3440-240-0x0000000002D30000-0x0000000002E13000-memory.dmp

Download

memory/3908-274-0x0000000002480000-0x00000000024B2000-memory.dmp

Download

memory/3908-282-0x00000000050F0000-0x0000000005177000-memory.dmp

Download

memory/3908-289-0x00000000050F0000-0x0000000005177000-memory.dmp

Download

memory/4512-188-0x0000000002630000-0x00000000026B7000-memory.dmp

Download

memory/4552-123-0x0000000002900000-0x0000000002987000-memory.dmp

Download

memory/4640-196-0x0000000002FC0000-0x00000000030A3000-memory.dmp

Download

memory/4724-189-0x00000000029D0000-0x0000000002AB3000-memory.dmp

Download

memory/4728-241-0x0000000003060000-0x0000000003143000-memory.dmp

Download

memory/4960-183-0x0000000003560000-0x00000000035E7000-memory.dmp

Download